socgholish | e594138784abf1f134d592920819545325d237af0f1320455a431c99ac38de2a

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-02-2025 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e594138784abf1f134d592920819545325d237af0f1320455a431c99ac38de2aN.html
Size

127KB
MD5

21e71a591d6075cd1774f789dc4770d0
SHA1

69fd32bd9891fc180fc3266d59513f460b06a298
SHA256

e594138784abf1f134d592920819545325d237af0f1320455a431c99ac38de2a
SHA512

40d9412222e396a375bb8645e30e28c4c9e30ead741a326f7be057ac9fbce8cff3915c895d4025ed49e8efddae8750b4173686b15be3985a50866d9932e2d942
SSDEEP

768:1pHl1Cnj/kx+Bw24Tp7pQ3gTnEmjnO6oa0/OPrSeRnwim8Qx8bWfMaYNTdVwXC5Z:1rM3gTnEmK6oJ/eR5ZWXC5DDmcDOxmVh

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "445538128"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e6d3a1564d09c4b81394d28aa8cc37d000000000200000000001066000000010000200000004ef981891d7abba2771f76d88e46ed29ef9486101728eb8e3d4bac7f54166d7f000000000e8000000002000020000000f9cfe0a77bec05155e734f2d7f3746e824d026d35174c4330ad7d5ac25392b8520000000b68b2cec02e0f468661335acc30c38926dfd1dfc711719b5e1d2fb88da45d45440000000e84924355880c3e59e84cd6502f729e6cd29bb1d9c470260c35ade54125b3e63cc30394b656afb3a0407fc3a32e0e0a8ebeef419185e2808b199bdd668e42f49	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F25463C1-E95A-11EF-846E-46BBF83CD43C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f286d0677ddb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e6d3a1564d09c4b81394d28aa8cc37d000000000200000000001066000000010000200000004c78e005e752d3c09a4a1b4232351dde7741d52f89d221f8cab3c89bd3e2dae1000000000e8000000002000020000000e3297373c05ad29644511cecfe693bfadcfde2f5ab87f0ec8d8b34d88cce3b5e900000001fd964d97df7766cd07e37a84ab4da76613baefa58a35cd7d8a449f38e8e36cd40a5838b7a1947d021359037e7030018a38eee552f5a163ff1a808f2157b3b1ab96c3af7844bfc03cac9605e7ac0c3dde376ee6694ba59cb35e82846c545764841216c74af532d3031bfd4e2f7c05ceb156266a8190f015e3bd97368be64a28eb388dd5ac086634bb93a9e8db45a1951400000000863818fc4c85c5a5f37a6f41769c83574d9dc4dacfe71c2e0657ca12e6c3ec12822c184077a45aac915432849526efb65c7e8b33e149f13b79f1e3c2de80d15	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2916	2180	iexplore.exe	30
PID 2180 wrote to memory of 2916	2180	iexplore.exe	30
PID 2180 wrote to memory of 2916	2180	iexplore.exe	30
PID 2180 wrote to memory of 2916	2180	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e594138784abf1f134d592920819545325d237af0f1320455a431c99ac38de2aN.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
66fc9d3b4c2380e8a26d9f57d982a85e

SHA1
a11e423be23e24bc5c0b39efdc745cb6c61383c4

SHA256
e0cab13c9c018b52b6d640595db12d6faf000a79f7348ff48e28e3f7af0ef82f

SHA512
f4d8d7539c98996537f96d10cede365a7e4113c4914265ad83d15c028ab6d874888b530bf103339a5a398fbc87eb5462407f8190440f713a9b2caf3d1bcf2fc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c947f9bec14c190c6a10395118c4f5e

SHA1
59c82dadf300d4bcdf155ba294a00196ec82b2f0

SHA256
9e2e3953c49561b3ac4a110f7e576f26b5961f655f0ef3f03b2f4529e1cc1a5f

SHA512
16a1e684e4d04ceb74fa9e06c32039d261e70c49a599ec07156ee1c286ca3e6137d0dcf748bb56898f1eddfe00a1a059fbf97495bb0badfd80510a0c4d81b04d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa1be4bd3cc91c64f26e17dc99defcf7

SHA1
678aba292a15c54f8a44be5e5d6deba6874df753

SHA256
cdceca4d43739d4342474b04298eb2f75a3dcbf2905b4862053734a643bdbbfc

SHA512
f43bf7a9f07fb2b6940d8207d0872fe9c37c07a6712222ed0fd341886c03cf941d13203c2c5a04720b6d6ddc11b998dcb8adbfd502ea308a4be1deace21771bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
faf22f24849aed40aafe2a3f12c9d505

SHA1
ad566351e6e8f7127b563e88ee98bf0e10db092a

SHA256
efc5b5a020db874f59c7e24a16cc4cfef55728fd90e7058e13084806fc83a364

SHA512
60d6309fcdfae36a4222f5f277a315e59fe135fd1392e8f7b73c00023539c1b77338c859a78d5251d95ee1de9b357ded839dfee5ad072fc06c07848e42f27f0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
085c0a51a94b010cff737f2cb31aee34

SHA1
adfe0c8627eac910a74188c4ea550255e24ed142

SHA256
ae1a5f9062b56939b66a812088a2c853313660c6336c304bcd1e96e0fc7a028f

SHA512
7e6f6ed961c4d21d66020b5f57e55a332033fd665a3d02e253ee311111ad25f94602a4e50e619ef111bcb2a62981e13929ee358be6f21dbd1feb8ed4b12a54fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f9a573396627462fb5287c50b7266ef

SHA1
1c5142dd3f3e5d9566c77e67b215ba9d3dcb9187

SHA256
42e6654fb95f7609ea0e1a9256b94b93139a202c0b57ec4ebe8b4ebea669d2f6

SHA512
3c5e61ffbe8d18e8b62f36856cf5ff9a3881207b6af5066b33a0921a8ec200c990b922edff6e7a900242cc326684faa87fc51f2a349913c4b638c6e25001ba84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03110a09bae3e541c2b379b854c9f5d5

SHA1
e39791db85acff1e434e92534974114a4f043009

SHA256
3daed51c07a35b6fc465a64087abc6dca1402e61c07be73eea873301741f63d3

SHA512
b7c446651c5fbadf1d48f67c4f1e6dbd37b8ee24164d42dd9a55f9068c1393cacd64ffb69169fc3248413a98d7fa6428dfaa9bd6cb32e8e4dfd2621e472b2c36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
149e4c98e2652873835881ae99697881

SHA1
42f3a3002092f632b359993f6e4f78820c49eba5

SHA256
74d4d4528213e944242dd3f81f67db5b1b82a7e496b81600cb5b40f5bd9f28b2

SHA512
a3f1bda97bba8d5f2723da59a709d69c1a60cb00b81c26be1caea0d701ac0554ca0f387e2e823cd0e5c9345047650c2b841f57f2965ef8100cc6efd774984931

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDB43.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE1DB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit