Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
396b4efb322...18.exe
windows7-x64
796b4efb322...18.exe
windows10-2004-x64
7$0/questresult.dll
windows7-x64
1$0/questresult.dll
windows10-2004-x64
1$0/questresult.exe
windows7-x64
1$0/questresult.exe
windows10-2004-x64
3$0/uninstall.exe
windows7-x64
7$0/uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
147s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14/08/2024, 16:01
Static task
static1
Behavioral task
behavioral1
Sample
96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$0/questresult.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral4
Sample
$0/questresult.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$0/questresult.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral6
Sample
$0/questresult.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$0/uninstall.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral8
Sample
$0/uninstall.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe
-
Size
656KB
-
MD5
96b4efb322e9f719e9da043e26a2bd97
-
SHA1
3825278830bb9a9d8b3bff6968b9fe730018179c
-
SHA256
49a6613b3b1575f5bedec9f348d5afca76ce39dc5f867a03aa5750135498b9b3
-
SHA512
1cdcf1c622a88e0f7c73838a67517f229509dfd9c39359a37843e012901b7c1c56d30897d31c9eb7f6ad8f1f36cfb2e34729954c9058c297a6fa40d4ac8141c0
-
SSDEEP
12288:R5QepwNJe5vSyv7eTmYcfOT9p9rEf2w0RZ5h:R5Q9lmXOzZEf2w0jf
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1284 questresult.exe 2036 questresult.exe 2644 questresult117.exe 2528 questresult.exe -
Loads dropped DLL 9 IoCs
pid Process 2476 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe 2476 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe 2476 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe 2476 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe 2036 questresult.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2528 questresult.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat questresult117.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQJWOD1Y.htm questresult117.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\QuestResult\questresult.dll questresult.exe File opened for modification C:\Program Files (x86)\QuestResult\questresult.dll questresult.exe File created C:\Program Files (x86)\QuestResult\questresult.exe questresult.exe File created C:\Program Files (x86)\QuestResult\uninstall.exe 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language questresult.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language questresult117.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language questresult.exe -
NSIS installer 1 IoCs
resource yara_rule behavioral1/files/0x00050000000186b7-46.dat nsis_installer_1 -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections questresult117.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB0602B5-1DB9-48E8-93B1-B509B67AD4AE}\WpadNetworkName = "Network 3" questresult117.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix questresult117.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" questresult117.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings questresult117.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 questresult117.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad questresult117.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB0602B5-1DB9-48E8-93B1-B509B67AD4AE}\WpadDecisionReason = "1" questresult117.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-03-51-b6-45-0a\WpadDecision = "0" questresult117.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB0602B5-1DB9-48E8-93B1-B509B67AD4AE}\a6-03-51-b6-45-0a questresult117.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-03-51-b6-45-0a\WpadDecisionReason = "1" questresult117.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-03-51-b6-45-0a\WpadDecisionTime = 10ab537c63eeda01 questresult117.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings questresult117.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 questresult117.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB0602B5-1DB9-48E8-93B1-B509B67AD4AE} questresult117.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB0602B5-1DB9-48E8-93B1-B509B67AD4AE}\WpadDecision = "0" questresult117.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-03-51-b6-45-0a questresult117.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" questresult117.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" questresult117.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" questresult117.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 questresult117.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ questresult117.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB0602B5-1DB9-48E8-93B1-B509B67AD4AE}\WpadDecisionTime = 10ab537c63eeda01 questresult117.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" questresult117.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe 2644 questresult117.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2528 questresult.exe 2528 questresult.exe 2528 questresult.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2476 wrote to memory of 1284 2476 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe 31 PID 2476 wrote to memory of 1284 2476 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe 31 PID 2476 wrote to memory of 1284 2476 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe 31 PID 2476 wrote to memory of 1284 2476 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe 31 PID 2476 wrote to memory of 2036 2476 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe 32 PID 2476 wrote to memory of 2036 2476 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe 32 PID 2476 wrote to memory of 2036 2476 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe 32 PID 2476 wrote to memory of 2036 2476 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe 32 PID 2644 wrote to memory of 2528 2644 questresult117.exe 34 PID 2644 wrote to memory of 2528 2644 questresult117.exe 34 PID 2644 wrote to memory of 2528 2644 questresult117.exe 34 PID 2644 wrote to memory of 2528 2644 questresult117.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\nseF97E.tmp\questresult.exe"C:\Users\Admin\AppData\Local\Temp\nseF97E.tmp\questresult.exe" "C:\Users\Admin\AppData\Local\Temp\nseF97E.tmp\questresult.dll" 2146607322⤵
- Executes dropped EXE
PID:1284
-
-
C:\Users\Admin\AppData\Local\Temp\nseF97E.tmp\questresult.exe"C:\Users\Admin\AppData\Local\Temp\nseF97E.tmp\questresult.exe" "C:\Users\Admin\AppData\Local\Temp\nseF97E.tmp\questresult.dll" unakaxab "" funekeki2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2036
-
-
C:\ProgramData\QuestResult\questresult117.exe"C:\ProgramData\QuestResult\questresult117.exe" "C:\Program Files (x86)\QuestResult\questresult.dll" nemefune emigazaqay1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Program Files (x86)\QuestResult\questresult.exe"C:\Program Files (x86)\QuestResult\questresult.exe" "C:\Program Files (x86)\QuestResult\questresult.dll" ibuxejaqu xitacilaje2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2528
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
560KB
MD511c68ce0141613e5334d461052a1f83e
SHA168a0374e839a4d276dac48ca1dbf24421741895f
SHA25641061830e68af9b6fd1b33fc218016d8ff53edcf5247c590787ebcd4354ed79f
SHA5125102c50be4c6723381c0359f58b5c5ac7077d2de585bf639ed8ec4eb6d65ed46061e6734336ea7c429f0aa2d50545dab36f49ec067d50c242569e097ae7ad501
-
Filesize
83KB
MD5b8581e4563421179a21eb5f9daff2380
SHA199531598663bfaf0acd2e656532d9df44a69e4f3
SHA25679334466126d6e4bf47b1964675c01885a9dbf27541fd72e72aae58f95acfd23
SHA512800e36eeff74e6e0a03d2cb75c71a9460c6fa1cbcc7457301996e20f1e578cf0cf9cba66de8e964bedf0f4a188bd954dc4799c0a87e4d2cea76b8b8e4b92cb33
-
Filesize
48KB
MD5b88d605702d92e81c8dfcc5a33841dd4
SHA144d944a6ca25df041cc914cc329f5ade9592486f
SHA2560e2fade0af3c09ef949cf065411fc93a611b43ae469bd2fc125c9fbe86fe3058
SHA5124075625551b08901527d0ba6d62132d4d94b8807caa1b929a30ec3566b5c8b588e794f8785863c043aed59d0fcbcf3da3bec9cd6b6cc4cf02e0db2f038bb785d