49a6613b3b1575f5bedec9f348d5afca76ce39dc5f867a03aa5750135498b9b3

Analysis

max time kernel
146s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe
Size

656KB
MD5

96b4efb322e9f719e9da043e26a2bd97
SHA1

3825278830bb9a9d8b3bff6968b9fe730018179c
SHA256

49a6613b3b1575f5bedec9f348d5afca76ce39dc5f867a03aa5750135498b9b3
SHA512

1cdcf1c622a88e0f7c73838a67517f229509dfd9c39359a37843e012901b7c1c56d30897d31c9eb7f6ad8f1f36cfb2e34729954c9058c297a6fa40d4ac8141c0
SSDEEP

12288:R5QepwNJe5vSyv7eTmYcfOT9p9rEf2w0RZ5h:R5Q9lmXOzZEf2w0jf

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
736	questresult.exe
1896	questresult.exe
2536	questresult117.exe
3048	questresult.exe

Loads dropped DLL 3 IoCs

pid	Process
1896	questresult.exe
2536	questresult117.exe
3048	questresult.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	questresult117.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	questresult117.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	questresult117.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	questresult117.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\QVMNTUPQ.htm	questresult117.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\QuestResult\questresult.dll	questresult.exe
File opened for modification	C:\Program Files (x86)\QuestResult\questresult.dll	questresult.exe
File created	C:\Program Files (x86)\QuestResult\questresult.exe	questresult.exe
File created	C:\Program Files (x86)\QuestResult\uninstall.exe	96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	questresult.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	questresult.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	questresult117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	questresult.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral2/files/0x000700000002342f-36.dat	nsis_installer_1

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	questresult117.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	questresult117.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	questresult117.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	questresult117.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	questresult117.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	questresult117.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	questresult117.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	questresult117.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe
2536	questresult117.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3048	questresult.exe
3048	questresult.exe
3048	questresult.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 736	404	96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe	85
PID 404 wrote to memory of 736	404	96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe	85
PID 404 wrote to memory of 736	404	96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe	85
PID 404 wrote to memory of 1896	404	96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe	86
PID 404 wrote to memory of 1896	404	96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe	86
PID 404 wrote to memory of 1896	404	96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe	86
PID 2536 wrote to memory of 3048	2536	questresult117.exe	88
PID 2536 wrote to memory of 3048	2536	questresult117.exe	88
PID 2536 wrote to memory of 3048	2536	questresult117.exe	88

C:\Users\Admin\AppData\Local\Temp\96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:404
- C:\Users\Admin\AppData\Local\Temp\nsg7D40.tmp\questresult.exe
  "C:\Users\Admin\AppData\Local\Temp\nsg7D40.tmp\questresult.exe" "C:\Users\Admin\AppData\Local\Temp\nsg7D40.tmp\questresult.dll" 214660732
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:736
- C:\Users\Admin\AppData\Local\Temp\nsg7D40.tmp\questresult.exe
  "C:\Users\Admin\AppData\Local\Temp\nsg7D40.tmp\questresult.exe" "C:\Users\Admin\AppData\Local\Temp\nsg7D40.tmp\questresult.dll" unakaxab "" funekeki
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1896

C:\ProgramData\QuestResult\questresult117.exe
"C:\ProgramData\QuestResult\questresult117.exe" "C:\Program Files (x86)\QuestResult\questresult.dll" nemefune emigazaqay
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Program Files (x86)\QuestResult\questresult.exe
  "C:\Program Files (x86)\QuestResult\questresult.exe" "C:\Program Files (x86)\QuestResult\questresult.dll" ibuxejaqu xitacilaje
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsg7D40.tmp\questresult.dll

Filesize
560KB

MD5
11c68ce0141613e5334d461052a1f83e

SHA1
68a0374e839a4d276dac48ca1dbf24421741895f

SHA256
41061830e68af9b6fd1b33fc218016d8ff53edcf5247c590787ebcd4354ed79f

SHA512
5102c50be4c6723381c0359f58b5c5ac7077d2de585bf639ed8ec4eb6d65ed46061e6734336ea7c429f0aa2d50545dab36f49ec067d50c242569e097ae7ad501

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7D40.tmp\questresult.exe

Filesize
48KB

MD5
b88d605702d92e81c8dfcc5a33841dd4

SHA1
44d944a6ca25df041cc914cc329f5ade9592486f

SHA256
0e2fade0af3c09ef949cf065411fc93a611b43ae469bd2fc125c9fbe86fe3058

SHA512
4075625551b08901527d0ba6d62132d4d94b8807caa1b929a30ec3566b5c8b588e794f8785863c043aed59d0fcbcf3da3bec9cd6b6cc4cf02e0db2f038bb785d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7D40.tmp\uninstall.exe

Filesize
83KB

MD5
b8581e4563421179a21eb5f9daff2380

SHA1
99531598663bfaf0acd2e656532d9df44a69e4f3

SHA256
79334466126d6e4bf47b1964675c01885a9dbf27541fd72e72aae58f95acfd23

SHA512
800e36eeff74e6e0a03d2cb75c71a9460c6fa1cbcc7457301996e20f1e578cf0cf9cba66de8e964bedf0f4a188bd954dc4799c0a87e4d2cea76b8b8e4b92cb33

Download Submit
memory/1896-13-0x00000000004E0000-0x0000000000562000-memory.dmp

Filesize
520KB

Download
memory/2536-25-0x0000000000670000-0x00000000006F2000-memory.dmp

Filesize
520KB

Download
memory/3048-44-0x0000000000630000-0x00000000006B2000-memory.dmp

Filesize
520KB

Download