socgholish | cab9695cd772ad48340471ca7a6fc536ffe1fe02319e91042b8971a03c50597a

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8af4954a42c5cc0452b7a639b44326e6.html
Size

81KB
MD5

8af4954a42c5cc0452b7a639b44326e6
SHA1

27e492cf2d9b0bd94464091b9c4d16dc65e2ba65
SHA256

cab9695cd772ad48340471ca7a6fc536ffe1fe02319e91042b8971a03c50597a
SHA512

79a65878464488c7cfaf54fc678bdbe7a0b350bb25c97e8b4446fb36214cb9b78b6ce9d835396ce63fa0d533486b992d01a365c9eca28a494306ad41f99ebf51
SSDEEP

1536:C/x8m/kD1odohuXtzodoh9FVdCntMIutbd:CdU1odohuXtzodoh9FVdCntMIutbd

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 503de41c1ca0db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{44972421-0C0F-11F0-BD4E-7E1302FB0A39} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000030ecb70aedbc454a9f5837d565becf1d00000000020000000000106600000001000020000000756d6e0db25a352217c153830b892e14b6143f2aa5eff72f8a5bda55303330a0000000000e80000000020000200000003a826d8a82c12919e49433d0cb58ebce73193392a8a6133f20685c0e050a637c90000000646b61829561655607171cc6fad72ec188bf01f87d6d9d07685eb148fcb34b01d252606f09d0c7d3468c0e5775852f2ce3aa05e02abae2ed109980041b158ab59206238358da1ae03c28e8baccc71d04de64baf2e7dfdabd616f2b7ada54b886aa949ec6062827f18974aef9d6c5ff5ba5cf76973209022daa97e08313a90ed7eb12f3ac27e580681499cd7863b1f44e400000008b2e0b1aec8c202c5364942f5a1d1418a63baa221924809cf184ab1f5087c11873288792c4f5c154dba6d5679b9fac8616f1cd935586589f2d75d17104487b95	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "449353890"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000030ecb70aedbc454a9f5837d565becf1d00000000020000000000106600000001000020000000b812c8f899e5c7fd3110c5c45b176d2c27ec0796da25631c27625cd1ef955dfa000000000e80000000020000200000007ac0f15c3481864b28e4a9c381ab73a571dbd14ce6e7864eb913e6d85a7d1575200000004f5e923a82ba99e98fd874b658dbf426a20882279fae443913a2eed3073657e9400000006326999be57d2f91d1655019c6da6aad2c8209d77079f1e610c5cbbea41554fe72b04ab8eeb559baa289da1f7822800039fbf6f39ed81d59902fd56083177c06	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2784	2928	iexplore.exe	30
PID 2928 wrote to memory of 2784	2928	iexplore.exe	30
PID 2928 wrote to memory of 2784	2928	iexplore.exe	30
PID 2928 wrote to memory of 2784	2928	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8af4954a42c5cc0452b7a639b44326e6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
f26c32a0daccda9d0d402c04407cf7e8

SHA1
ee7c2682ee1598596789ab5335685bdd6df95b4b

SHA256
19f27fdad23b4410b113f92a9d6a8162a686ab94dab2ba0fcf5a62748863800a

SHA512
b0d224b86485618fde480e842cf8b34b3ca8372466ef81b53f446f3bf40b0ed99660907e7b81e4b68dd6e1663b0ffc1528a53cab115c17773d2cbc804c536768

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e83fbaa0162077593a2fdcf5b2df3be

SHA1
00c58ea16b7373ce6601dfadda2cfe38b0f36b2a

SHA256
50d48e1d8f5c5a8e74c499fd5ad55ba62b3150c106fbce1a36f27ecdd5324b39

SHA512
6439fce52ae841c545ca32cf8d22b86dde63a6308336111b2a872b9d4b7a7b0e6e68d358d328f48b6ef9442b09c7aa98b57ea4acb5a8c585be6fbc6ae1003646

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ab9a614a776039fa69738a4a16c8338

SHA1
07ae4634066432938eb505825ed859a894465c60

SHA256
a8e6dd16fcfde0aee3db34435212da66823aa4c1a27c3f5961de71cd43017f6c

SHA512
d297b0286ddb3823bbbab7e49065888cf5de645ebb5a2aa516c2bbb43cd1b96086311c5bffea114c8ef059bf5453184c5b97b69ea9b5a2f63876ceec97096093

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34e8065680bef205c1bef43d8a64c7a2

SHA1
99d442abdfa10c5b9fff96a13c7a2b39c49faa5f

SHA256
733a4fc07d1a789d724781e78484fa25e6035f0501f19c65bbd514c6231db928

SHA512
8dc6b600be554e74c3e3c0bee0f8c30e3d1d077275beea6c7def6c5add896859227ef49061b1d0507822715af8aef9454625bc9e8d92608f95757a1da515e220

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e29e4aa69e82b13da7ef7934930520c

SHA1
3f48a5ff2d0b8ae7a9d01234e65f529c402f101b

SHA256
8b279922972a40ec2866bc537cf102037b24baaac264bdf86169eb6b79be20e5

SHA512
647dcc439cf242e87cf81eb1db76221f773a31f5641b5755d94b45de0c09644b1adc091f61a7bc01d508d866b78527fae03f01efe4170cfb706fd36619211364

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f7eb64cda2fb7a85893d58f28e0b0c1

SHA1
e69da08a0c7ac909e40da58e4f9cc867c175edda

SHA256
ebc668debc22be2236c30e07fce41e394d53eff7a3afb7127c7d2fd36b8f458c

SHA512
48290f995fd4081f3f73eae8c3dda16bf0d1cb1473dcac3d947f0c185469914fb4902b6b1aa229eede7bba6780a68c35191bfd04ebcea97260517ca952b9f822

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a3cf224c7f07ea6e086ff892913b1f3

SHA1
a20f9b456067a2cd0324c9fe2c819a5f5b54bf73

SHA256
55ec5ac60a37b8ed5be120d5c15799bdfd0d04f01a0ecf80f124edf0c2a9eac9

SHA512
e8d8bd35c20b00dfe33056cbe0f14b293d6532d33d5025e26d9e126a32214f8cc5d9ec39893b7c2145d0a50d7f1bfc61c4948cd9a3bfee62df53409f3383699a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
1382a82b0c1486864c4980b754257781

SHA1
674956bfd7578fd0da4dc9cdee6a51561bb747cd

SHA256
b36d83a8f0cc293e93e3f77ad3a532f50c15a176bb8a27018e5a31fb15322d70

SHA512
3b65f23e820f867fccb93833601d7bfc3f4243257ef878db7950eb95a277e06d21dd7a399a6bf5a0204a884bebbab701754fd2e82ddae4f598f4270e1f171c58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9GP4P3HF\v2[1].js

Filesize
4B

MD5
350fd6ef6446635f7a8f608434a405ec

SHA1
a4b6c275ac2c80ec925b5c0c5c6abb79ba897356

SHA256
d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179

SHA512
c80ee0076d4ed85badaca8443b52e2c2820bcaf7dcb87a92888de21fa312441d7723db2de5538396ae706099b859fccec8a7c246d24b39fc6538c4bcd7d2ce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab88D1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar88E4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBAAA.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit