Overview
overview
7Static
static
3jaffacakes...ic.exe
windows10-2004-x64
7jaffacakes...ic.exe
windows11-ltsc_2024-x64
7$0/questbasic.dll
windows10-2004-x64
1$0/questbasic.dll
windows11-ltsc_2024-x64
1$0/questbasic.exe
windows10-2004-x64
3$0/questbasic.exe
windows11-ltsc_2024-x64
3$0/uninstall.exe
windows10-2004-x64
7$0/uninstall.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/10/2026, 11:34
Behavioral task
behavioral1
Sample
jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
$0/questbasic.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
$0/questbasic.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
$0/questbasic.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
$0/questbasic.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
$0/uninstall.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
$0/uninstall.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
- Size 997KB
- Sample261014-npys3styhs
- SHA256 6d75dce2fed51d9d13c42a5f44ef7ff8f5e752d41f8749231b281aa61e4cd89c
- MD5 5b5cb3f50baa7ce8a42a12ef57f6be5f
- SHA1 e9b196d9e1a583086bcd1839af6ea3f6fb75e49d
- SHA512 2128f44da127f4f85080471c24392f1e1136d2714326277ea887fcf680a518597bc75fc781e17673ddf7eb427367fffa31c54d6ef910ccb32a24b7456ff27380
- SSDEEP 24576:poj2/LEil398a5+OwQwt43+ze2Yay2/40aJE:hDEixB5+OwQfOze0y2UJE
- TLSH T1F52533907DC0D4B3DF137530AFA39A150A23A627586753A35BC01FAFC23A6D19E58ACD
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 2704 questbasic.exe 776 questbasic.exe 4440 questbasic.exe - Loads dropped DLL 8 IoCs
pid Process 4484 jaffacakes118_UDS.DangerousObject.Multi.Generic.exe 4484 jaffacakes118_UDS.DangerousObject.Multi.Generic.exe 2704 questbasic.exe 776 questbasic.exe 4440 questbasic.exe 4484 jaffacakes118_UDS.DangerousObject.Multi.Generic.exe 4484 jaffacakes118_UDS.DangerousObject.Multi.Generic.exe 4484 jaffacakes118_UDS.DangerousObject.Multi.Generic.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 questbasic.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE questbasic.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies questbasic.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 questbasic.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\RH9GDVE2.htm questbasic.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\QuestBasic\uninstall.exe jaffacakes118_UDS.DangerousObject.Multi.Generic.exe File created C:\Program Files (x86)\QuestBasic\questbasic.dll questbasic.exe File opened for modification C:\Program Files (x86)\QuestBasic\questbasic.dll questbasic.exe File created C:\Program Files (x86)\QuestBasic\questbasic.exe questbasic.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname questbasic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain questbasic.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_UDS.DangerousObject.Multi.Generic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language questbasic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language questbasic.exe - NSIS installer 1 IoCs
resource yara_rule behavioral1/files/0x001700000001db03-128.dat nsis_installer_1 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} questbasic.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\TopResultURLFallback = "http://www.questbasic.com/?tmp=redir_bho_bing&dist=0&prt=QUESTBASIC114&keywords={searchTerms}" questbasic.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{86F14831-D88C-4BC8-B871-C8FB24D95D9B}\TopResultURLFallback = "http://www.questbasic.com/?tmp=redir_bho_bing&dist=0&prt=QUESTBASIC114&keywords={searchTerms}" questbasic.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\SearchScopes questbasic.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{86F14831-D88C-4BC8-B871-C8FB24D95D9B} questbasic.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{86F14831-D88C-4BC8-B871-C8FB24D95D9B}\DisplayName = "QuestBasic" questbasic.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{86F14831-D88C-4BC8-B871-C8FB24D95D9B}\URL = "http://www.questbasic.com/?prt=QUESTBASIC114&keywords={searchTerms}" questbasic.exe - Modifies data under HKEY_USERS 8 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ questbasic.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" questbasic.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" questbasic.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" questbasic.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" questbasic.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix questbasic.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" questbasic.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" questbasic.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2704 questbasic.exe 2704 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe 776 questbasic.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4440 questbasic.exe 4440 questbasic.exe 4440 questbasic.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4484 wrote to memory of 2704 4484 jaffacakes118_UDS.DangerousObject.Multi.Generic.exe 96 PID 776 wrote to memory of 4440 776 questbasic.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_UDS.DangerousObject.Multi.Generic.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_UDS.DangerousObject.Multi.Generic.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\nsbC820.tmp\questbasic.exe"C:\Users\Admin\AppData\Local\Temp\nsbC820.tmp\questbasic.exe" "C:\Users\Admin\AppData\Local\Temp\nsbC820.tmp\questbasic.dll" "vowihokasuz" " " "uvacegozijeji"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:2704
-
-
C:\Program Files (x86)\QuestBasic\questbasic.exe"C:\Program Files (x86)\QuestBasic\questbasic.exe" "C:\Program Files (x86)\QuestBasic\questbasic.dll" rihikoxu gezoxuvo1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Program Files (x86)\QuestBasic\questbasic.exe"C:\Program Files (x86)\QuestBasic\questbasic.exe" "C:\Program Files (x86)\QuestBasic\questbasic.dll" yeqagezo ikoxubuye2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4440
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\QuestBasic\questbasic114.exe
- Size 22KB
- SHA256 4c5f4c0897c8e765a7bce92914f758bbc276c2256b3d5105bbfb62f59524e81d
- MD5 6973f29c29a3eeee35567657e52f2d53
- SHA1 2efab86aa9d2a1c323dbc761b0a837b922282aea
- SHA512 8e4151c0518fc560e1c4d76e3d6128d551f29a5c5080a32d4593848c3b356fe71149b67ff060c94b81384011bcd7b48d2df036c119a53c1b89ed1a91f8d9d5f0
- SSDEEP 384:qBYaCj8bP0yG60JDIgPURCblLVU107wnq/Hl+uY3vJml:8C4Rd0JDnFRhU107wn2FNisl
- TLSH T138A23B23B8929177C88285B049A99A03E73F55061FB04097CF94259FBF726E1AD3E307
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsbC820.tmp\questbasic.dll
- Size 868KB
- SHA256 6f8ab6b73b19003d72856d1894758bfdd9e88606e44397d89cd533ba7282b626
- MD5 e9b691e878a23750a2726aaa356f46e7
- SHA1 5cd77790c918bcb660e281f3c70120195dab92ed
- SHA512 e9a9cef7a963ee3121051ebdd472f7c98f661ff982cdff355a62307590b65317e50e19eca295ba8ebeb1335e9a9cf6b5465a9a525563884e38980e42b80974f5
- SSDEEP 12288:SaXu0GV1In89icmaMgGz3cE5bJsrBJXAataADHgOTtA7PTS82PSIYjxOhbKOo:7ki89iV93cCsFAAjbtuPTt2PWxobKO
- TLSH T1781523A01C8280F2CE0B59BB59151B19387E659052F1A4CFD6DEF1FAAF302D8967D287
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsbC820.tmp\uninstall.exe
- Size 78KB
- SHA256 dd1fb0babead3e4cfc4f1c2b6da6e188ade41656cd991dd67ae9080244166896
- MD5 44f90c8f57c78ff549af6ce114277f57
- SHA1 ddf8b6eb49b804f9082b892a439d8bb297f88cae
- SHA512 451072bd2ae46c724da08c6ae8ad44c0ad78d41d16ec17c781f4e155e9e9347583b725ec3597f15a71263931a825e689b4b95141f91652075d69d82b567e4df8
- SSDEEP 1536:PEkjY1zy214Qay0DGkJ7qAELVigJpVjcpDCxH9TplS1N/RA2/DD:8kjAJ4dDGkJ+AI0mguH9TpAN/RX/H
- TLSH T16273D10737C098B7C7AA063105BBEBBEFBB7965111216F570B900F6F2A219839A1D15B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nss8C10.tmp\InstallOptions.dll
- Size 13KB
- SHA256 551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc
- MD5 d765c492c21689e3d9d61634371fd861
- SHA1 ac200933671ae52c9d5544d0e2e8e9144d286c83
- SHA512 9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f
- SSDEEP 192:9B6RvrfvOuJQDghBy/X7QKq3TLGciZJf0EzWzMnz6WoF1dBs:v6RrviWaX7eiZJ7nz6bB
- TLSH T14D525D61738488F3E786063E745237138BD926257CA15DE2C6330FCA6A2718D7EF6342
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nss8C10.tmp\System.dll
- Size 10KB
- SHA256 802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
- MD5 fe24766ba314f620d57d0cf7339103c0
- SHA1 8641545f03f03ff07485d6ec4d7b41cbb898c269
- SHA512 60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
- SSDEEP 192:rO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1aMBgMO:yKAFERdlxhGRYUzqZaMB
- TLSH T18E226C5547A041F3DD60823C08973D272BA837148EA54ED3CFD314429E296A6BCBC336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nss8C10.tmp\ioSpecial.ini
- Size 698B
- SHA256 e32cf30de8ddf3ca2d5c9d4dbe3690197c86ce7ffc024d2ea7ae4a9e03244d52
- MD5 cb761ded4c64ca28b42c0c007e611901
- SHA1 45f50e33d3b5b7b74eb5bf65ccf8f89c4824b644
- SHA512 20ea0ce6fae32ce57a3a3552671020b97265ee7c2b5180979af98dacfe6f55c5fefb48eb69e3cbf21dfb7f8e1f63911e82cb796efe533f8c0d87941f2022c102
- TLSH T13F01C098C45FA3240861305625EC77E1D7613C2C0B2238B250628907474EAC78AEDDC1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nss8C10.tmp\ioSpecial.ini
- Size 560B
- SHA256 1ee3e4d772ed323ff9658d448a44f859db562d24183219c151eced93f69ad1eb
- MD5 29e643646d6d0b90caaf161e603ebead
- SHA1 623090c9bdff9446aff9f6c39160c6d33a765523
- SHA512 e3faf3d22d2e404e64fc2c098922943daaf77de2d403a9a41d494e5ca05f6002015756b57a3f2c2f9c853aaeeef3bc24e86fc7a867b4ddd2f14f22f9130baeed
- TLSH T10BF0C65CC44D1216082131475AFDBBE193E02C348B5616B1C131CA07874FEC5C8DD9C1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nss8C10.tmp\modern-wizard.bmp
- Size 150KB
- SHA256 614d5d54c44ca502b3f433f39a6729c11b7e6a6d60aedbc59092e91f35fb5a95
- MD5 79233b82a7a8fdc258f223161eec8d5f
- SHA1 b5b4a92eeb619bd426c8f4d9ede4a4f2e8ee85ed
- SHA512 9d1e05d9cf3455b6ed03a25defcb3cede5800cd951a2050cb7cdeb1f0f869a93a08f3083d6c2548ab78391219623e93ac98c9644c8f966b9fca13af712607ab3
- SSDEEP 384:QeH0fR9FDyy4pqeTbmd811S729+D9zUug+1Sp5xwocI5AK5G1/Zk3Ju8X:vQEy/eTbmd811S729YAu1k3TY/Zk3vX
- TLSH T13CE39364F096A5C4D828967DBE74BD2E00615DCB38E94E4F1B2E3DB403F36038595EAE
- MD5 SHA1 SHA512 SSDEEP TLSH
