Overview
overview
7Static
static
396b4efb322...18.exe
windows7-x64
796b4efb322...18.exe
windows10-2004-x64
7$0/questresult.dll
windows7-x64
1$0/questresult.dll
windows10-2004-x64
1$0/questresult.exe
windows7-x64
1$0/questresult.exe
windows10-2004-x64
3$0/uninstall.exe
windows7-x64
7$0/uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
146s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/08/2024, 16:01
Static task
static1
Behavioral task
behavioral1
Sample
96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$0/questresult.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$0/questresult.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$0/questresult.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$0/questresult.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$0/uninstall.exe
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
$0/uninstall.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
General
-
Target
96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe
-
Size
656KB
-
MD5
96b4efb322e9f719e9da043e26a2bd97
-
SHA1
3825278830bb9a9d8b3bff6968b9fe730018179c
-
SHA256
49a6613b3b1575f5bedec9f348d5afca76ce39dc5f867a03aa5750135498b9b3
-
SHA512
1cdcf1c622a88e0f7c73838a67517f229509dfd9c39359a37843e012901b7c1c56d30897d31c9eb7f6ad8f1f36cfb2e34729954c9058c297a6fa40d4ac8141c0
-
SSDEEP
12288:R5QepwNJe5vSyv7eTmYcfOT9p9rEf2w0RZ5h:R5Q9lmXOzZEf2w0jf
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 736 questresult.exe 1896 questresult.exe 2536 questresult117.exe 3048 questresult.exe -
Loads dropped DLL 3 IoCs
pid Process 1896 questresult.exe 2536 questresult117.exe 3048 questresult.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 questresult117.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE questresult117.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies questresult117.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 questresult117.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\QVMNTUPQ.htm questresult117.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\QuestResult\questresult.dll questresult.exe File opened for modification C:\Program Files (x86)\QuestResult\questresult.dll questresult.exe File created C:\Program Files (x86)\QuestResult\questresult.exe questresult.exe File created C:\Program Files (x86)\QuestResult\uninstall.exe 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language questresult.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language questresult.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language questresult117.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language questresult.exe -
NSIS installer 1 IoCs
resource yara_rule behavioral2/files/0x000700000002342f-36.dat nsis_installer_1 -
Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" questresult117.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" questresult117.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ questresult117.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" questresult117.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" questresult117.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" questresult117.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" questresult117.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix questresult117.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe 2536 questresult117.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3048 questresult.exe 3048 questresult.exe 3048 questresult.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 404 wrote to memory of 736 404 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe 85 PID 404 wrote to memory of 736 404 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe 85 PID 404 wrote to memory of 736 404 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe 85 PID 404 wrote to memory of 1896 404 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe 86 PID 404 wrote to memory of 1896 404 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe 86 PID 404 wrote to memory of 1896 404 96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe 86 PID 2536 wrote to memory of 3048 2536 questresult117.exe 88 PID 2536 wrote to memory of 3048 2536 questresult117.exe 88 PID 2536 wrote to memory of 3048 2536 questresult117.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\nsg7D40.tmp\questresult.exe"C:\Users\Admin\AppData\Local\Temp\nsg7D40.tmp\questresult.exe" "C:\Users\Admin\AppData\Local\Temp\nsg7D40.tmp\questresult.dll" 2146607322⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:736
-
-
C:\Users\Admin\AppData\Local\Temp\nsg7D40.tmp\questresult.exe"C:\Users\Admin\AppData\Local\Temp\nsg7D40.tmp\questresult.exe" "C:\Users\Admin\AppData\Local\Temp\nsg7D40.tmp\questresult.dll" unakaxab "" funekeki2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1896
-
-
C:\ProgramData\QuestResult\questresult117.exe"C:\ProgramData\QuestResult\questresult117.exe" "C:\Program Files (x86)\QuestResult\questresult.dll" nemefune emigazaqay1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Program Files (x86)\QuestResult\questresult.exe"C:\Program Files (x86)\QuestResult\questresult.exe" "C:\Program Files (x86)\QuestResult\questresult.dll" ibuxejaqu xitacilaje2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
560KB
MD511c68ce0141613e5334d461052a1f83e
SHA168a0374e839a4d276dac48ca1dbf24421741895f
SHA25641061830e68af9b6fd1b33fc218016d8ff53edcf5247c590787ebcd4354ed79f
SHA5125102c50be4c6723381c0359f58b5c5ac7077d2de585bf639ed8ec4eb6d65ed46061e6734336ea7c429f0aa2d50545dab36f49ec067d50c242569e097ae7ad501
-
Filesize
48KB
MD5b88d605702d92e81c8dfcc5a33841dd4
SHA144d944a6ca25df041cc914cc329f5ade9592486f
SHA2560e2fade0af3c09ef949cf065411fc93a611b43ae469bd2fc125c9fbe86fe3058
SHA5124075625551b08901527d0ba6d62132d4d94b8807caa1b929a30ec3566b5c8b588e794f8785863c043aed59d0fcbcf3da3bec9cd6b6cc4cf02e0db2f038bb785d
-
Filesize
83KB
MD5b8581e4563421179a21eb5f9daff2380
SHA199531598663bfaf0acd2e656532d9df44a69e4f3
SHA25679334466126d6e4bf47b1964675c01885a9dbf27541fd72e72aae58f95acfd23
SHA512800e36eeff74e6e0a03d2cb75c71a9460c6fa1cbcc7457301996e20f1e578cf0cf9cba66de8e964bedf0f4a188bd954dc4799c0a87e4d2cea76b8b8e4b92cb33