socgholish | bb4ef06ef89851c79fd5c305b4c03e3b0df530f4be446f05c1c85a0a18443d20

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
15-02-2025 20:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_fc12fc8abdcb71908ba3ba57f9b732bf.html
Size

86KB
MD5

fc12fc8abdcb71908ba3ba57f9b732bf
SHA1

cfcfbb3fb469f6f1cc1bf63d32cd6315ee17d54a
SHA256

bb4ef06ef89851c79fd5c305b4c03e3b0df530f4be446f05c1c85a0a18443d20
SHA512

848f4dbab6d4f755a151696d2f2b2eae3e47d93592db593d1f958c9755d6978d2a12415ee686429c2c73e73a85ead71bd83900ad37f1fdfb4adf66a9e26370bb
SSDEEP

1536:CJox8mRk/lodohovNLodohbthxPLyC6tMSfcfd:CaElodohovNLodohbthcC6tMSfcfd

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4F0DC91-EBD8-11EF-AC25-4298DBAE743E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a14aef43ac40d5409cbb15a318522b29000000000200000000001066000000010000200000006c8cedd00373212642b18530d8ad65910a43b600a11379bd1a744b1a007346ce000000000e8000000002000020000000b350d3ce8f210c5c712fbc4430c3929da2de1fd85cf178ecf050c73e6a47ff20200000004e8878d32dd7db360ccbf2d289c519b5c39ce976be55594769c79ec57a15cb8640000000e3449527f625f9e267d989b0394203b334ca1f30d038103af27ea292b7735ceeafe1f2e6da048bd110dfdffaef0c33ada2b83d36831c7a6a253c97b8087bfce8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a14aef43ac40d5409cbb15a318522b290000000002000000000010660000000100002000000012aacbdc8265921fa0d23360b05fe9b73558ec03fe087977cd1227b52410bd86000000000e8000000002000020000000d2f728248c6e47e2b418432ec4bc0888f13467d665f6a3bfe3a31cabc0e30d0090000000a71c9b3f7f4aec1dd5b723b3c6ae281c6cf59911fba88dda9e282a94b9e024fd9931aefd485c60b5ddca169fc719b0dc2fb7d852670a711fbc342a0b05d16f7fa074b2a62b9fbc8fb0a03b3c80ae70dd1dae6aa5748b3206d9d0619bc69bacf4aaddc73be7e4815921ee5b392ae8efb08d747048f1d6ad543f965a2d7ac924807a4c926506d60e51f24a53f293e1545740000000107885ad2d168dcc253dd5a5a2a96cc7cbccd475b5e8a489fd2c6e917551b8b158b72a9f396225f326778c2987b5b9d729794a8550fa0a707de46fa66a1a341e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "445812018"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c0139ce57fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2420	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2420	iexplore.exe
2420	iexplore.exe
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2752	2420	iexplore.exe	29
PID 2420 wrote to memory of 2752	2420	iexplore.exe	29
PID 2420 wrote to memory of 2752	2420	iexplore.exe	29
PID 2420 wrote to memory of 2752	2420	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fc12fc8abdcb71908ba3ba57f9b732bf.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
eea2c9d6e8fd96f25534ea9303094c19

SHA1
89fc779fc679c4042e29d03b32245c512d961946

SHA256
b84064e8cc6e58aa329110ca1874796277088c475da12004a4cb24185df20721

SHA512
a3b7935f510dce387a029c29e4e4b859b80b488d66077d56faacb402bf42d0e8e4d5cf4518c35bf84a2446ec6661fa2112252d05894c64cd2fa00d694840b2c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e1fc47ec3363ee3c138c5f6853608a3

SHA1
f7dee878a74f1f6d4a9c5d7a0d3a1af06cd614a4

SHA256
61102e6237cc9556511cb68e514adefbae4afbf5c3fe6f3a6e9b2f84af82f2ac

SHA512
a67a630e78ebfd225574007e1ad252c0ef41a404e86e280308b1457d97f3055eecfd9e465cec12764aef19c97533702f964e2ac85b49080f8f6a04bb402b3763

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec68e71537390cabfdb02cfdafef52e2

SHA1
c6411e5c9ea2c400ec1e8e6e5e48face615eaa6d

SHA256
9c7f68c9d73d74763d3c10b1a42c8ed6cce8fe1cd56c7efb9fe376f2a4788a1a

SHA512
773d0ff969325a3bc476145d2cbc76b75b900bda9a6f2e3662d5f320cf575fe5fe19b0611340cffe263cf5001b8b6aa7d03a6dd31d07fafb096cc6aab7a639c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f717c8a548c89acc6882aaef9645dc12

SHA1
119a3e58c1cbbac2ecf65d9261aa98213a757330

SHA256
6f3a877089957dd8b4591a9ae7f554fa1ff4a95adf6b63d43639234a1ed64188

SHA512
5899e4046c514dbd534d0f7d44323ff3b5ae903f2e0ab5fa93ca769442c4f8006083fbed04b3849e49ded193e7d4fc53215975381f3cf76ffa7104b8131a1715

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08c514a44b2602f42c74788a3620562e

SHA1
e01bd4ee8217118a1142ffdc78a8eb4ca8564eff

SHA256
7fb2e0c6daf9d663a84437aa1b8dc057e6e7421c560afbc01cd0f5f381d184b7

SHA512
508703c3a5828c5fb9080e2cc04417d25ce9e753f576cb1928af5580e55a8c3d25c22bed029c7fa0d784c80ea8e7fb21f863e46e9bdf0f4b56c4e92235c7ae68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31d35ad77350c59fdfa7961a9ab73718

SHA1
32cfde33eeb8413fae92917359cf9346a3b182e5

SHA256
c45d7c952ed9c3a8013c7875f512b9b4e35954700a3b962e63d0a19ef340e48a

SHA512
3b6ce9fd02498426402781e848b9b0c5f1e36e7f4b9987b3f39272758792f2867156fa0911490af07def5e8032b4ee901a657fe4657847edc144768d16ed906a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
685c6e62f219e6331f117bfeb8040246

SHA1
0e4e31d1b86da9f1ae72674c3547642a68c521b2

SHA256
ef98efdf3355d44c4b71cd9db871c18af9c6b66bb9d4cb843f3e62b7b70cd019

SHA512
232a2989ef60196d0e9dfd2b4e153f92ab53c83335b46e6191cb07676a395e0a65a7a28e87262612f9f544d596f8361204c9a561a1fd3995d584f477087e0baf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c4278064da8e55e7e5a8664c97dc946

SHA1
e7b6a6d9b12f08589c06a581e0a0b7b28ce84706

SHA256
07cd0647e1e4b890c63068cc5c3c600f2f83c128a796b76723ebdf10411fdabc

SHA512
2e88ddcd44239a05f49264d0dc960b2210dca73f8a5063e254c3014dd9c24cb2fcb93e52c61ed2b97f59dd2e2ca1d0367ac9bbdaa6998599e3edede7133535cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72f4c079c1f5dff9232be99816fe2e61

SHA1
bc5d5afdcef4bdc3120e2eade447a3ba9175e470

SHA256
30a8f7ee170ab41b7e202948b06f4d7657c5e6b849cda9484d5eb86f10da042e

SHA512
696a49156ae886f7cd78ccf4deaf576bce355ed36a1ded964abdf1b4a36f56db5628fba18501ba58d6af89963362d03e4178e60c624266dd7461684cf9c1ef7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b8cae6ef4c6572c398e449da56ec5b7

SHA1
e542cbb6442b1c6ec1ba4329f05007e959b09f40

SHA256
ba5f66579cc867adac7866b6e6248ee4c06d59fe47bb320497464ae54e1a2da9

SHA512
7f2c9606ddda07e1144e158ee41047f0dba2da94817fff6bdd8363390e97da9fc90f2af8d06b13e1d00defefab0e2a7c3244e585b87b03c820e016dbce0a0d42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04efb83e44b980c53c80d5690bc3dfd7

SHA1
6793fa2f44a5bf8e2c74c634171a6212f591c6cf

SHA256
5e8b6d594cc3df81a06ad3d1a6c2e22cba8375e7542117d379fcd8fae5c384a1

SHA512
4e740c2c040af140cada4ba91a59b61ebfe5f138a7283b02e72a42666731e58a46ef7fb4d9cc943527f7b74a2a7565c6236e3509d04d443abae23035d0488066

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5003ae9ca3dfdf878bf4f95f1126cf67

SHA1
926a4de0028c9a6b28839961057b2889a2b97cb1

SHA256
d494f74424f100bb9c4109779930f2b002a9ab34b68f06fbb45caf50d02b7539

SHA512
e10dac00def8372be2d8ca151b833351b08de27a3e456e5c104b9972444ff7f60d8e470230ed20b25706e9c085d2b37c6ec1920bc68d2102881c9944be01f1fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
388650568557e4e312a208d9d2ae95e4

SHA1
d7ff5d7f6912e0be92a2aee9b6412a9db90a17e1

SHA256
e572b12942b4d9a422c4bcfa4a1386e9fe82228591c5d3980ec740c49f8f44d1

SHA512
a42da012a12595b927ab0caebd6c948ae534f4b598a7e2e271327ebac93549a55d397ca6390da59770a09fc95449cb9f34c5fab61d7dd126a6c1b6e908926f0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8B420DKQ\v2[2].js

Filesize
4B

MD5
350fd6ef6446635f7a8f608434a405ec

SHA1
a4b6c275ac2c80ec925b5c0c5c6abb79ba897356

SHA256
d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179

SHA512
c80ee0076d4ed85badaca8443b52e2c2820bcaf7dcb87a92888de21fa312441d7723db2de5538396ae706099b859fccec8a7c246d24b39fc6538c4bcd7d2ce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F94.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2042.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit