socgholish | 0f438f52c155284e775e11f923cd93d697b164f63cc94e873c9ddb6769fc0f3e

Analysis

max time kernel
134s
max time network
155s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
10-02-2025 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_db64225856c5ba92be87d4a5168ac3ec.html
Size

48KB
MD5

db64225856c5ba92be87d4a5168ac3ec
SHA1

6f4763c6c3a4adfc26bf250f2f86f36ad12abdb4
SHA256

0f438f52c155284e775e11f923cd93d697b164f63cc94e873c9ddb6769fc0f3e
SHA512

ca65bb0b1fe27462392eb97048c0b6cbda6458f6effd4cb7bb9dc0290ffa4314ca0b5716e7d022cd6e00420af5e5a3a0552e22a8388d473b4fcb9ebf3348cfdd
SSDEEP

1536:ptUtUKuIMkUn2WwUAUUU0UY2B+UuUuUDUFU8QU5UU2UQU2UzU2UwUFUOU+UnUDU/:PUtUKuIpU21UAUUU0UY2B+UuUuUDUFUs

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B451D871-E7AA-11EF-BA44-CA806D3F5BF8} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "445352466"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2480	2208	iexplore.exe	30
PID 2208 wrote to memory of 2480	2208	iexplore.exe	30
PID 2208 wrote to memory of 2480	2208	iexplore.exe	30
PID 2208 wrote to memory of 2480	2208	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_db64225856c5ba92be87d4a5168ac3ec.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74e8333dc0e789372a9715c74a11c3c5

SHA1
e13367dd4fae4f1bfd184316a8c00aaff140394f

SHA256
8e7f60325d5a7f2ad1c94775ffcb0fc5508ed445e11b746c0ccdeaf896296f3d

SHA512
666bb17ce384c871b66c0d7daf4b54ab7ddca85f0d89ea8506e2b3a2e5dc5df4e121faec4d10ae45e3849d6834483f1e839a59eeb6d20133f1c83ad181117428

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a390c0097cd573e18f44c57551e9b22

SHA1
1a0ce67d042fa0e643d69ec230644466dbf70017

SHA256
07433f5e69db9c2a190dcff3dafec2402412b8c509af7b8bd0e1b992effb25d6

SHA512
a63ce09883ec08f2574d8ded0197a461d956d0874c44b8e0af83ec8a321ba285717fd1dd65ddf5b770fc03217949b24c870b81b13c1d95c3dcb2bdbd1ebd36d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92262bf7d6cf885b85182d477a4c87c2

SHA1
b31ed91b8c6d4a6bfedcac274cfd416dede3eb06

SHA256
54661a969d059230583a9d8b1c57f0b6b4341403e47b7636d5372ef68bdad9d0

SHA512
74d8a1d1f77bb1c05bdcce66327c7bca990e0f9483c587479cf1acd318b8e74c8aa48d4e11d305dbcd113fcd45a967151987763114cee87a6e8076d835d732e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f84aa520a2340ff91bbe14a3b693042e

SHA1
9a93a7694ff52de8992f5e53ab101345978257eb

SHA256
034456a9debf4308ff9d5611f1afebf2fe16040598eae8818575f3708ede9aa5

SHA512
be46c380312bbb3ab9eb73877379e3340b248fb0ced85305c17cc6bf8bdc11e7f653654cb034b9ac74b590787efdc565845d966c3cb4fe4f94b781a1492c166b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b714a45b999c84a461c6361afc4d50d6

SHA1
cd2c336c58755b0830e3eae96bf576420ebb3299

SHA256
587d10f14cbe995958fda83bcac923ba6842e5b53109d7a028c0a415ac8cf8a1

SHA512
4ac7a286f46cb16f2c582b692e40e3b67b450821f3646ff3137cb7cae801bb4f39e168d9976f223392514d800dedb0e7288627c7f30f6b650abd5e76dc59dc7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c42e5d2173cee1e7d3b58dca8618799a

SHA1
6efbbf053b9275b2d6e725a7acaa6b993268bd26

SHA256
31037c39fbfa4ef26a0a5d82ff647288b4623894061b0cf14196484897fd737e

SHA512
c3c0efc9e956a44734a9206928df1facf5cad439df03e833e1b66f9617314ffa73dfcc6ca0e7c408f95ce43b37b4500b4b2ff44bb6a88801ad27543d966f7f3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e5b2f404d615c3869cc4e5e381ab887

SHA1
316ad96cef52b52aeed6da86eaad3b2733178df1

SHA256
be2a907969ea4cf8a7235d22560823d8808253295da2369733d88574ba28c96a

SHA512
4d1f03b319f4678adb9b05f65d4a8059368834374a20fc5f9820eef687b4c789bdbe5121ff52fb7266d405fc7ba755d1f434045e923829fda0cb20e38d525b7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ecc3fdf86ab8bbfeeec2e0afb50a4f0

SHA1
aeea18cb7275df5aeb1f55b5aa8c89f31dedb3c2

SHA256
b79b2bb4f17b335212f0807cd0ce11111fb7a9239abdc1e9b9f6bb57d716b5a0

SHA512
930920372bc3d6792e07a356617f010673159af913a8485c30b489045693a4166e280858e210ad787ffc1fc92b06a1a4631b81c78cd3d8f744ff2e808366a92b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb0523f24e94f9ecf153e1284ff4b898

SHA1
0d6c81a162728a396b2210da52384baaffb39822

SHA256
a5a4f30cbd95c356ce47a02613515a63caf254f38905caf462f736b7b0932894

SHA512
525aec34a457a34eff537cb3b3816f17032c82dc75b82dd3da9a30d6f50ff0204bcbb9db939fde34e91d67cb0eb92385fe5f62f95832e935fd2d7a9cac8b929c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6ede466a1feb258acad102fd295e1c3

SHA1
535844a8ae38b7f8d19e849c83215aa5a0759320

SHA256
6c439887538e78bfff12f50a5fccac4e7e9bff6757bc879de33730f1dc5a3c9f

SHA512
fefa87b2ddfc3de9679920c08f76885cf0ab30a47d79d40dffb8d59fb76ea719062bd4c02943a732e41dfc242f76d8bbf0105b8891d9092e905d7fd660802d13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4771cb4126b9d0a512ebfbec4e6004d3

SHA1
981dfa63574603f0a15eca2e4388091300d6505e

SHA256
b52a323bebc0b948a26aa956d50aaa27af05ee9f13fe80672f2e555cb66ba8d3

SHA512
0d784c81517a83dad1361f7ccbdebab4c3778ecfba7ed9d66c0e503c13d464c47a4ae8cabc3f4f1dae80b75e2d41d2e135de7b4ee62c31c71eaab1322a668a29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8450d67941b3c8ae6c06540cbfc0c84d

SHA1
24ca91b49050988e7012513210c11a4e44866703

SHA256
1530ff19f45acf8a92dd06a6e5f11091187d886d48c54cb2cf5c6d7e9cc99240

SHA512
e45e2aecc5bf2c4d59f9303c7f98ce1fe600271f570d0af316c6861b2fa6c9a5d9677106af1076f3279a876c12b9cd5106d89b0fbae25a87ee203dbf576100f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed1fca39439d6e20daf65b4a12026163

SHA1
f12bc120834c54f5675e5060888d109f743c1163

SHA256
001e0ccc39044cddde1a8b1cd34ee6003c81a74c50ef2083e91034edbd35832b

SHA512
6f97837a7a9bd92618269d146e813bdc5f1b4cd0538ffcc383d24864783fadb2ed129a6b6f6664522398d9c22e7a1962edf1e4dc1fec8127e330e59a938d7628

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT668XG4\f[1].txt

Filesize
43KB

MD5
e3f4ff7ea79e91f010343a26232fb1d2

SHA1
0fd1bab13b44dad931d43fe91b601584fe82d56e

SHA256
6f1a58bea1c3058deaa8c4f560b0821c050baa5c014b257020656f4b8f275706

SHA512
e6b81b5ecc41a20f91ccf3431264c6d1a5a14b4d85ec7ebc7c0a4f0d96d3d02687b1e136e33ca11e73cbbe76d4a7e475a48a931961790c8f194db2ca34ca13dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab913A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar915C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit