Analysis
-
max time kernel
94s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2024 04:15
Static task
static1
Behavioral task
behavioral1
Sample
161ea69e2dbc7cdc2d1563b33483f7dc_JaffaCakes118.vbs
Resource
win7-20240903-en
General
-
Target
161ea69e2dbc7cdc2d1563b33483f7dc_JaffaCakes118.vbs
-
Size
48KB
-
MD5
161ea69e2dbc7cdc2d1563b33483f7dc
-
SHA1
2b401f55ba770f610e7325e8b748ce20fb81a479
-
SHA256
b32fbffba97ac21165d2a20b0a1a378df3cac949c2b080f2026c1cbb05e4f2e6
-
SHA512
676d096573df0a6869fee4452eb70315299647da44ef392fc595ac46f8a10ef7683388882685d77cf8cdf0b85e6dfe24271ffed9528ac1beae86f6299dad750b
-
SSDEEP
384:ZNGj1lwgeCKKGCQR0TXp4CNH49bAeeYkYPOuFtjLHe/DX4DE47ppKOrJrdofKW5Q:ZNGNlXp4CpKFtjLHe/sDE46O1r/4Z9+
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1680 WScript.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing WScript.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\SearchURL WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{557C21FE-7274-410D-853E-9ED4471BF193}" WScript.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\New Windows\Allow WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Recherche avec cherche.us\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\scriptjava.html" WScript.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\RunOnceHasShown = "1" WScript.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\WarnOnClose = "1" WScript.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\OpenAllHomePages = "1" WScript.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\PopupsUseNewWindow = "1" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.cherche.us" WScript.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\MenuExt\Recherche avec cherche.us WScript.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\UseHomepageForNewTab = "1" WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultName = "cherche.us" WScript.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\SearchScopes\{557C21FE-7274-410D-853E-9ED4471BF193} WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.cherche.us" WScript.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\WarnOnCloseAdvanced = "0" WScript.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\ShortcutBehavior = "1" WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page_bak = "http://www.cherche.us" WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar = "http://www.cherche.us" WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\SearchURL\ = "http://www.cherche.us/keyword/%s" WScript.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main WScript.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main WScript.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\RunOnceComplete = "1" WScript.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedInstalled = "1" WScript.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\SearchScopes WScript.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "1" WScript.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\ShowTabsWelcome = "0" WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.cherche.us" WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL = "http://www.cherche.us/Result.php?client=pub-0420647136319153&cof=GIMP%3A009900%3BT%3A000000%3BALC%3A551a8b%3BGFNT%3AB7B7B7%3BLC%3A2200cc%3BBGC%3AFFFFFF%3BVLC%3A551a8b%3BGALT%3A008B45%3BFORID%3A11%3BDIV%3A%23FFFFF0%3B&ie=ISO-8859-1&q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8" WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{557C21FE-7274-410D-853E-9ED4471BF193}\URL = "http://www.cherche.us/Result.php?client=pub-0420647136319153&cof=GIMP%3A009900%3BT%3A000000%3BALC%3A551a8b%3BGFNT%3AB7B7B7%3BLC%3A2200cc%3BBGC%3AFFFFFF%3BVLC%3A551a8b%3BGALT%3A008B45%3BFORID%3A11%3BDIV%3A%23FFFFF0%3B&ie=ISO-8859-1&q={searchTerms}+&meta=" WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Secondary_Page_URL = "http://www.cherche.us" WScript.exe Set value (data) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.chat-land.org = 0000 WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\UseMRUSwitching = "no" WScript.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\OpenAdjacent = "1" WScript.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\QuickTabsThreshold = "2" WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\SearchURL\SearchAssistant = "http://www.cherche.us" WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{557C21FE-7274-410D-853E-9ED4471BF193}\DisplayName = "cherche.us" WScript.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\Enabled = "1" WScript.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\OpenInForeground = "0" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant = "http://www.cherche.us" WScript.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\AutoSearch = "4" WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.cherche.us/keyword/" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.cherche.us" WScript.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.cherche.us" WScript.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Chat-Land site de chat et de rencontre gratuit.URL
Filesize114B
MD5244754ca15ab6b53538ac4892e94e71b
SHA10a1aa01f780e1f9700548c2c980dbe0e6df0816a
SHA2569ff5fb4d6950df4e9c5c8fb8c39ce4b897ef84bd03eb7ae331cb055630f24972
SHA5125bbdcde5c4a3e2874ca60d291486da2b7707680d7a1f6f8ae378164535a0fb023400755a854014859ce863032d8173066845e7a4fe6c8e366f137adab56ca721
-
Filesize
111B
MD559fb4c8a24156f6a0688c716507c051a
SHA1e0b34adc310ddeabfbdfb891d0dbd1b8cadfa95f
SHA2560245577afda63003906e4ef0993c27fbfc7af7f3f35f3f866a1005175eb0d220
SHA5127f0a1870757f2c7b1d6fefda0822ce67ca39d33bc2f177607916d684936c8d3f0f913cb916ef8fbd7e9505e6d5c6d5318e28d8fe2f626051a8db20f70daea35e
-
C:\Users\Admin\Favorites\Chat-Land Privilèges\Chat-Land Forum Partager astuces et discuter en ligne.URL
Filesize116B
MD5db3338c53c20955c25964ff86b11d736
SHA17059a02b56c2574a9beaac14bdfe11d556263d2c
SHA256d181aab1d646e73f59af8ab0d6b6b33bb73f71cf57a09abad0b6f2f486c07884
SHA512f05e3254be5087f3e2b8972f928e6267a39cf01b1d6e841bcc3bc53e7deda63ab8a847e00872686f46b9cfe25f2ac9ddee3ce0d8ed47d9ae08ce22e54a4e7516
-
Filesize
130B
MD5833fcd970b27196d5baa719eb58d782e
SHA1e3d3439d2251df38865f78fb2f2009b03019c091
SHA256a47693979afd6177ac6a30fdac4d93fcb582be00dbb2bf753d80e96d4e2a49af
SHA5129a6ad24beaba4e0b6e769d5bb2da79cd67799cf922568c7eb4f2e0e9d373d14dc22e9006f83560c52a34ac6a0d8b7f8fb9c35ae6f7ebc32c6db5c94b3ae42c3c
-
Filesize
147B
MD564853268c16e2c3e442a43598f7ec919
SHA1884fa0ffca248b0380144bbe38eebffdb6f267f1
SHA256deb5af851509658cf4c8de196530de52fd1087b030e261d4789f1a6df6c8b0d0
SHA512ec7d94711d674ef81361f77ea4a701b23eff289f220995d50b47f20e808aaa8e00e9a61a759fbd8e6a0f0acf1b4d8d893bd11fdf1ec00a282a0b07e2afd75a0b
-
Filesize
118B
MD56b12793aae622b085d7e9c0a10ca9c36
SHA18c258cbc5656f2f27c963708746daa6cc3e53bd8
SHA25607342931ac64a6e0e8c45d6e718011d7616458ee2c05b6b499385055c1cbc3f1
SHA5123260d2444109fb7f7baba4b907f47a7fba262c5487234f538d691cbfa41ba17d74e9fc6a3bd3832608f276014e2a7accca35875de5cbba1241b15531db84f232
-
Filesize
121B
MD516b290744a2ac3d96ed1c898e1889bca
SHA19af3a29f53d01d17496ffa1efe1a9ed5e6b98bf7
SHA25634e29ce5a902628a049297398e9f1d843cfe8e1439b2aaab3056245057bb3528
SHA51245959de1d63387c4302ccc47cd6b013ead3254db1d5cd66d06ffc7465e20b44e6d0e9a2d7d01d3125cbe964a4168fb23e2a9d2fb84cce9e94bd61f3d8d79b3cf
-
Filesize
109B
MD55468bb7b155cb47a6612773c67324b71
SHA1b53bb54aa60130d898132639a2117c944c1b283c
SHA2561bb008d99889da05ae3b457fc7bda84d29c02528a07a6ceb4b7e353646068d67
SHA512a7931fc18160179a5368cfc15c7f0a984112253ac43ed11bc04e6ecffe3b1c749b64a10c28114b87c1c960c8349b05a490d17a11c8c75b3fb159e259f246c98a
-
Filesize
121B
MD5688cc041d7dd9e717491fc816108b426
SHA18f68c16d74923a81b271d305582784913c9f6666
SHA256f15654b8d22a13e0017dac359f7b8cbbc6b506c1801e6fbbb2cbde619556b8e4
SHA5124c05496988f2b943dfa35d96478a2e8256b91b247318017af896018cc84c4f6d28cba239c8506b0c7bca502e7a23169e5556303cc2d0e1937d3dabfc16652d8f
-
Filesize
125B
MD54e05f37b146024bfbf0d5760704786fb
SHA18a01b6d6567d1cb9fee7b34f0ba57ce79c6dc860
SHA25608a70576d298d511dbaffbba789e1a769117b54d92e40ace6a1b8d31607ad4e5
SHA5121771c603f4900e840dc92faba274f123e38502a2fa330b8becb894614099604cdc48d94adf30609991bc1ab7ad87a4b47917020c723170697f5e036845cab3eb
-
Filesize
126B
MD52c36a46947c884e313f950cf56dd80d7
SHA16bb210e385959b70b4845583bccdff9be37278eb
SHA25689be27f658ce6cce3a60c1adeb7ec2ae139c40d500c512987dc05d5eacb186c8
SHA5122f6230bbb848a55f66cf6428bfebd73e61046243d1e82b371f58b34cc59be7fafbba7bc73d64afe17e0167cde2f1d9d7de72069c13cb23564a4d7590eb6386ff
-
Filesize
120B
MD5424719d33362878c8dc16bb7e89daf4f
SHA182736aae26d3f68aae8601fb2502e82f4ec3b44f
SHA256342dfb6f2b2024705585352386fdd8816e022a6f404626d2017acb20491388dc
SHA512284cf4e22f0fea8d4004cca43d81b1a3e96fc740e6250f48c16e7efefdfb8988af9208269a9924235c5c8ddc7d4de26f4d7ebc9dd95a2bbff245c0ebe56d6de9
-
Filesize
115B
MD5a7c2cd91a677d3f1d220319bc87b1bf4
SHA1d26afa8eda5fe4cadcc631135631b432f1bb4d87
SHA256e3935089e58f39bb8f00a63192ffbdadf4782b2c5d24b191588988a784904e5f
SHA512a6eda4aea6a9d213678d1e06c700c79e45d84ee09c8e96196f0b2019cc1ad3eb133705617e92200bd7a427ae50c0b1bc37b4e691cffbaabbf11adba390ef9d8e
-
Filesize
118B
MD57556629560d424de183eb6aba692ab80
SHA18fcb7993868d8e95bfe43debc9108b5bb6928321
SHA256221f463e4e902f0b3385690e9af428636ded330098bf922c11c3ce19d589460a
SHA51236a3f584052083dc1871ce996cbc2ea69be2e13572c8f20ea0db2bbdc08b83132e0d610f2d5d2aef5c2223c7067ff91a7c92f2e25dbfaf68f6d07a0f2949c33a
-
Filesize
117B
MD5b39e13a5d2c40fbfa0fbd7e647183cf5
SHA1e628e8a15ceea3b9b7d8cd0e9a504baa7eec0834
SHA256a0676a4add77c80804a3842663539539ebec77aba9dd3660490c7b5c57f2b575
SHA5121e43ea41b95431fb13e4506957f8a6944417b119d1d6a81f4d3db1c408c40672f8c0e0793f661b19f455f3079e04285d32c32fc0614610cbcc0c78249971819a
-
Filesize
118B
MD5d45b52dc200aee45cf4db063cfea6b7e
SHA1b23476457c2a5ed807d038b2d96b4538109bcd91
SHA256c407353c24611941757e4c1ac2a219bc4df6464ea9ec542b3a6ead600ac33804
SHA512fe3b5d9d1f6328594662b3de332ded64c10c94bd8735bd3abefd2baa971433e4e99f001ca638fac286af98beb9ae7188673c34066925e26fddd6b6569df9a34f
-
Filesize
123B
MD5136a491dd01bfec590775101c034816b
SHA1b3aeec10e40f3568107c465d50c3c074ea836648
SHA25679c154edd7a7da17970fa1435e2679d424058b09d87a97270a6ec991bc18b7e2
SHA5123c5814ffd98339a55aa8cc78de898a8c28f477631d7d9d26e5da1313a73d1b04486e074eeabbdd2666ff6ce74bd1bfda9493ca2af10968116e72ed65421399e9
-
Filesize
120B
MD59caf60dae9de419674ee3b2c89d4bd47
SHA171baba1bc3fc5a2507e2e6cc7354389a4bd2016d
SHA2569995997a8fc302c2638e4cf83dd603c8c0a9a06a44894c7865a37702bf51b337
SHA5121627144f866b743c5e26eeb9ad7e99a444c9d85466c6b3fd22586bdcd3809e166dca37c4b673238974ff3fff378b082f891737a1b60103deb6829979388575a2