b32fbffba97ac21165d2a20b0a1a378df3cac949c2b080f2026c1cbb05e4f2e6

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

161ea69e2dbc7cdc2d1563b33483f7dc_JaffaCakes118.vbs
Size

48KB
MD5

161ea69e2dbc7cdc2d1563b33483f7dc
SHA1

2b401f55ba770f610e7325e8b748ce20fb81a479
SHA256

b32fbffba97ac21165d2a20b0a1a378df3cac949c2b080f2026c1cbb05e4f2e6
SHA512

676d096573df0a6869fee4452eb70315299647da44ef392fc595ac46f8a10ef7683388882685d77cf8cdf0b85e6dfe24271ffed9528ac1beae86f6299dad750b
SSDEEP

384:ZNGj1lwgeCKKGCQR0TXp4CNH49bAeeYkYPOuFtjLHe/DX4DE47ppKOrJrdofKW5Q:ZNGNlXp4CpKFtjLHe/sDE46O1r/4Z9+

Score

7^/10

spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2364	WScript.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\OpenAdjacent = "1"	WScript.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\UseHomepageForNewTab = "1"	WScript.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\PopupsUseNewWindow = "1"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Start Page_bak = "http://www.cherche.us"	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\{557C21FE-7274-410D-853E-9ED4471BF193}	WScript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	WScript.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\WarnOnCloseAdvanced = "0"	WScript.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\WarnOnClose = "1"	WScript.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\SearchMigratedInstalled = "1"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\UseMRUSwitching = "no"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL = "http://www.cherche.us/Result.php?client=pub-0420647136319153&cof=GIMP%3A009900%3BT%3A000000%3BALC%3A551a8b%3BGFNT%3AB7B7B7%3BLC%3A2200cc%3BBGC%3AFFFFFF%3BVLC%3A551a8b%3BGALT%3A008B45%3BFORID%3A11%3BDIV%3A%23FFFFF0%3B&ie=ISO-8859-1&q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"	WScript.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\New Windows\Allow\*.chat-land.org = 0000	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	WScript.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\ShortcutBehavior = "1"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant = "http://www.cherche.us"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Default_Secondary_Page_URL = "http://www.cherche.us"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.cherche.us"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\SearchMigratedDefaultName = "cherche.us"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchUrl\SearchAssistant = "http://www.cherche.us"	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.cherche.us"	WScript.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\Enabled = "1"	WScript.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\QuickTabsThreshold = "2"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Search Bar = "http://www.cherche.us"	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchURL	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchUrl\ = "http://www.cherche.us/keyword/%s"	WScript.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\AutoSearch = "4"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\{557C21FE-7274-410D-853E-9ED4471BF193}\DisplayName = "cherche.us"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\Search Page = "http://www.cherche.us"	WScript.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\RunOnceComplete = "1"	WScript.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\ShowTabsWelcome = "0"	WScript.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\OpenInForeground = "0"	WScript.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\OpenAllHomePages = "1"	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\MenuExt\Recherche avec cherche.us	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\MenuExt\Recherche avec cherche.us\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\scriptjava.html"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\{557C21FE-7274-410D-853E-9ED4471BF193}\URL = "http://www.cherche.us/Result.php?client=pub-0420647136319153&cof=GIMP%3A009900%3BT%3A000000%3BALC%3A551a8b%3BGFNT%3AB7B7B7%3BLC%3A2200cc%3BBGC%3AFFFFFF%3BVLC%3A551a8b%3BGALT%3A008B45%3BFORID%3A11%3BDIV%3A%23FFFFF0%3B&ie=ISO-8859-1&q={searchTerms}+&meta="	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://www.cherche.us"	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\New Windows\Allow	WScript.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\RunOnceHasShown = "1"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.cherche.us/keyword/"	WScript.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\Version = "1"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{557C21FE-7274-410D-853E-9ED4471BF193}"	WScript.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.cherche.us"	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\161ea69e2dbc7cdc2d1563b33483f7dc_JaffaCakes118.vbs"
1⤵
- Deletes itself
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Chat-Land site de chat et de rencontre gratuit.URL

Filesize
114B

MD5
276a44ec8c22d17736e3c57c564a91cc

SHA1
9699d9a076cc42de510d2017719db664a47e66dd

SHA256
c6ecc8ebba0fea98b746dae11b01a703d57e5f3b9cfe597c801b9190ecc136c5

SHA512
7f05803dfc131a3a9079101b39f25dddd9b22cb5130046fd880c296c26caaa8d9deb324287b8882cc9b3905658e4291963438d24e971f68ae223b4562965a5b2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Internet.URL

Filesize
111B

MD5
f34cca368f069869626a81c30480bdad

SHA1
c0d7b0cbbd74524356cc7a11b519d008b629e2de

SHA256
1977f443cc5f99aa92d91d302d894d6a7aca7caccc9a0586f8cd5f5f8e487fb9

SHA512
c368c6c2c494565d304e521db8ed1c0aab982ad35f3b355e209436845a09ef85e39581b47948f5c19069916a75c18b19c8da99c6a7759ecf3dfea419e95c814b

Download Submit
C:\Users\Admin\Favorites\Chat-Land Privilèges\Chat-Land Forum Partager astuces et discuter en ligne.URL

Filesize
116B

MD5
17f1b1a56f759ebeaa5ec1bb74c84f24

SHA1
68d39239d6e8a57e098f0431804ed21b523dde71

SHA256
6fcbb1a708d3db688f3ab04fcb6335094cc2e8d36b7ae71324f7022fede388fe

SHA512
c3edc24ad9b90c6ec1414de5f042226a5696dba197eacc3f649a1512182626a2ec703867515c9e079c611feaa4961710d4e3206f4eb95288c00881e5ad9f747f

Download Submit
C:\Users\Admin\Favorites\Chat-Land Privilèges\Chat-Land Inscription gratuite VIP.URL

Filesize
130B

MD5
7410038f159709f3843723837460e1b9

SHA1
08e2421f2b156ab8b72e91d290974c5ae8db808d

SHA256
923d01e7ca9a7e0b7ab65dcd213edb8acba6e0f5fa9caf97add23b127245027e

SHA512
e3ebed95b54a0c4b6043a8f8f774293e79fd33be36be29e7a388e92e88a517db85e320a97ccf93d3fbd258e09efe4fd6cf56ec0169a5264e7634f8111eca01bb

Download Submit
C:\Users\Admin\Favorites\Chat-Land Privilèges\Chat-Land Inscription premium.URL

Filesize
147B

MD5
9b501a7f024fb9c6cc8c1f2fbe7d0087

SHA1
1aeca778a14a147a296a900c893144cf517d90ca

SHA256
7882fb554a2c72188ccc8cf07c80c20b480411dc9bfe91b7790c5f4d9f4836cd

SHA512
ede592db341f66d8a35f9e889e74fd4b09131266c5ee39fd3b5aa69b4fb28c118e11c3068310cc0ac866fa5986149d74f7574573c00da3c9abe1dd86594371bf

Download Submit
C:\Users\Admin\Favorites\Chat-Land Privilèges\Chat-Land Mon Album Photos.URL

Filesize
121B

MD5
ad07040a97462bc813a2583314f43ad6

SHA1
b40d7435a97f69b96d1253df10ca0940bfdfbe80

SHA256
a80a367c2e2de6dce291645bdf7c0f1a1eec69b3f02b38da0d3a51baf5bd51fc

SHA512
6813d35fef2ae94c145520f8041729b9290e36b15ec57b7f26163671d0db71e3259a56c728b906d9a682cea503bd833a950242a23beb652f60ec7214ebcb6d3b

Download Submit
C:\Users\Admin\Favorites\Chat-Land Privilèges\Chat-Land Radio.URL

Filesize
109B

MD5
c973e69793ec69aa9a89ab1ce3cb2ae4

SHA1
16724f68018e37ade11ceb0874afff3cdd3906ce

SHA256
febb540673fa142010ba991445a14b9b0a4629491d3834c5c0f08c3d7a6687b1

SHA512
0e35f9915a3c8c7c55725fb3909b82fc90e1da075ecf67660046525289b60c896523140a75b4f400f80bd07a168ee37c26e0a41a1714030272f90f4e30983baa

Download Submit
C:\Users\Admin\Favorites\Chat-Land Privilèges\Chat-Land Ticket gagnant Jouez et gagnez.URL

Filesize
121B

MD5
b06c4e77b9ae1ef604db6add57813f56

SHA1
b219fa695716411c5598c8a51784899041aeb624

SHA256
7bd3faecec178caeec729b03468e2c7d5cc743b31bbe25a0a7b33d2c3497f947

SHA512
39747fac85cdc9dc8f6d6e4251f39095d9580d49f90562a3f2c4ed4acf870f34008c3904450edd84b79fe819d3bc3c0b5a47f5bc48dda30a1fa261edaeef7091

Download Submit
C:\Users\Admin\Favorites\Chat-Land Privilèges\Chat-Land Top miss & mister.URL

Filesize
125B

MD5
9376ab843a935c656fb9c8989dde9b16

SHA1
f3fc3f95709e7ea745053fbf7b3d47b25452a122

SHA256
cab6a0bb23b5ec157406eed7dc4f0ad26d872b736bdbdb674786fe4b1b03bee0

SHA512
86d422cabf6cb8223c74ff8adc97115513e2936225cdf1c9305dfbebf0c77887fc0893fffff4f21652b4d76fa5ff699117cd641507c948cc20ae5fbc77ab3e51

Download Submit
C:\Users\Admin\Favorites\Chat-Land Privilèges\Chat-Land Trouver l'Elu(e).URL

Filesize
126B

MD5
8c2f11f9a5ec4a1f4705fa454494157a

SHA1
2ecfdb607c4d73e2a984c32a40167073ddc36036

SHA256
aa80f35b518c8f877a57e3052d24ea3b171fb3f52d474ff9811b94cd7813e92e

SHA512
0fc3e883e34cf86662d44c09d95a3c30d6c32926388e34559247144b9fdbfcf0f6b8e1c059022831665c2fdff0e3057d2f61b7ceb543580b6473b4cec1e6a017

Download Submit
C:\Users\Admin\Favorites\Chat-Land Privilèges\Chat-Land la connaissance à la portée de tous.URL

Filesize
54B

MD5
1e7e5e93c2a5aadaf932f93d25c57f3e

SHA1
e7f667aa97730f90c464f0a789b9fe1150d5f85c

SHA256
8b94d04fece582e4182e8e73f46fb86eb8e965c69c526c42805abb9e43641e35

SHA512
c8cfbaa6d818616dc0786f2812cdcef7a17863405fd8dfab55335dd931f279466a6364c4373355497be67904772db9a98ddb809f610464ab02f502e490ed96d1

Download Submit
C:\Users\Admin\Favorites\Chat-Land Privilèges\Divertissements\Chat-Land Jeux.URL

Filesize
115B

MD5
770e261622f0c93a961bb54f15d69cb5

SHA1
144539bea8bd03b69f9182c42a34f266a3a44989

SHA256
e7ad27c665b4bb674b12a34d3a30df27b0bef84bd0e22c33dcb10ce82cc2ded7

SHA512
ff23869bf6b719f2e9a830fd0bfd786d7e03560ee10dac6264faefcb44ea5b46e2b3ac11d274a044d6ef122a17fe24b8ebd253ca0255bd6f31becf13e49a2224

Download Submit
C:\Users\Admin\Favorites\Chat-Land Privilèges\Divertissements\Chat-Land Videos Droles.URL

Filesize
117B

MD5
618369fd0ae3c64de681ddd6c02c9771

SHA1
cae26ab9bd4be3408e6269c596f256c98c7a06ee

SHA256
ae4d5baadfe62ac3c1fd50cb53d79c9a10a36bc670e71d877d73afcc0152a894

SHA512
ac86d47744ac3849227e826317420bf94ad725249235657b6eaf1fea8a15b471f36946a085c3fa0a02e7cac7c09b26c97ccde0259bb84701adc558970de7d14e

Download Submit
C:\Users\Admin\Favorites\Chat-Land Privilèges\Divertissements\Chat-Land blagues.URL

Filesize
118B

MD5
4beab8822439ba0934825ecc01b3ef03

SHA1
bc4a730b7318084ea96fbbbf8c12abb3edf920b5

SHA256
0699a53401fe35c71429f338787f59e75a443cdfd44fe84ddcdeca2c29a906d8

SHA512
54e046c2ab1b27559d47d196cee90b8ad2b6a99c477ee09ed99f479ad56a08edfb419b0c5035fc6d21d927eaf2ec87ad2b68884877dbad0cddd31af9f21cdb9b

Download Submit
C:\Users\Admin\Favorites\Chat-Land Privilèges\Téléchargement Gratuit.URL

Filesize
120B

MD5
9f30df6ec0029251971c365733f59ecb

SHA1
d42570d3db49ccecb6acbe177e89f7b98b2b104b

SHA256
fd1d63fe7891bf074ce06b38b5792d3f027b778414637a3d2e0f71c63b870634

SHA512
81ed1b2a465fb47239c8783553cbaae1225258a3d2cb9d57c16003ec20f556865a1dae7453182e1b46887a9dd4ed93c284fa0be05a950b4beac60dab72669687

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads