Overview
overview
7Static
static
3jaffacakes...ic.exe
windows10-2004-x64
7jaffacakes...ic.exe
windows11-ltsc_2024-x64
7$0/questbasic.dll
windows10-2004-x64
1$0/questbasic.dll
windows11-ltsc_2024-x64
1$0/questbasic.exe
windows10-2004-x64
3$0/questbasic.exe
windows11-ltsc_2024-x64
3$0/uninstall.exe
windows10-2004-x64
7$0/uninstall.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 11:34
Behavioral task
behavioral1
Sample
jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
$0/questbasic.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
$0/questbasic.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
$0/questbasic.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
$0/questbasic.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
$0/uninstall.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
$0/uninstall.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
- Size 997KB
- Sample261014-npys3styhs
- SHA256 6d75dce2fed51d9d13c42a5f44ef7ff8f5e752d41f8749231b281aa61e4cd89c
- MD5 5b5cb3f50baa7ce8a42a12ef57f6be5f
- SHA1 e9b196d9e1a583086bcd1839af6ea3f6fb75e49d
- SHA512 2128f44da127f4f85080471c24392f1e1136d2714326277ea887fcf680a518597bc75fc781e17673ddf7eb427367fffa31c54d6ef910ccb32a24b7456ff27380
- SSDEEP 24576:poj2/LEil398a5+OwQwt43+ze2Yay2/40aJE:hDEixB5+OwQfOze0y2UJE
- TLSH T1F52533907DC0D4B3DF137530AFA39A150A23A627586753A35BC01FAFC23A6D19E58ACD
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 1244 questbasic.exe 2800 questbasic.exe 1468 questbasic.exe - Loads dropped DLL 8 IoCs
pid Process 1832 jaffacakes118_UDS.DangerousObject.Multi.Generic.exe 1832 jaffacakes118_UDS.DangerousObject.Multi.Generic.exe 1244 questbasic.exe 2800 questbasic.exe 1468 questbasic.exe 1832 jaffacakes118_UDS.DangerousObject.Multi.Generic.exe 1832 jaffacakes118_UDS.DangerousObject.Multi.Generic.exe 1832 jaffacakes118_UDS.DangerousObject.Multi.Generic.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE questbasic.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies questbasic.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 questbasic.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\LONDE60O.htm questbasic.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 questbasic.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\QuestBasic\questbasic.exe questbasic.exe File created C:\Program Files (x86)\QuestBasic\uninstall.exe jaffacakes118_UDS.DangerousObject.Multi.Generic.exe File created C:\Program Files (x86)\QuestBasic\questbasic.dll questbasic.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname questbasic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain questbasic.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_UDS.DangerousObject.Multi.Generic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language questbasic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language questbasic.exe - NSIS installer 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c625-114.dat nsis_installer_1 -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\SearchScopes\{86F14831-D88C-4BC8-B871-C8FB24D95D9B}\TopResultURLFallback = "http://www.questbasic.com/?tmp=redir_bho_bing&dist=0&prt=QUESTBASIC114&keywords={searchTerms}" questbasic.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\SearchScopes questbasic.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\SearchScopes\{86F14831-D88C-4BC8-B871-C8FB24D95D9B} questbasic.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\SearchScopes\{86F14831-D88C-4BC8-B871-C8FB24D95D9B}\DisplayName = "QuestBasic" questbasic.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\SearchScopes\{86F14831-D88C-4BC8-B871-C8FB24D95D9B}\URL = "http://www.questbasic.com/?prt=QUESTBASIC114&keywords={searchTerms}" questbasic.exe - Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" questbasic.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" questbasic.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" questbasic.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix questbasic.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" questbasic.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" questbasic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ questbasic.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" questbasic.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1244 questbasic.exe 1244 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe 2800 questbasic.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1468 questbasic.exe 1468 questbasic.exe 1468 questbasic.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1832 wrote to memory of 1244 1832 jaffacakes118_UDS.DangerousObject.Multi.Generic.exe 88 PID 2800 wrote to memory of 1468 2800 questbasic.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_UDS.DangerousObject.Multi.Generic.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_UDS.DangerousObject.Multi.Generic.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\nsoCB77.tmp\questbasic.exe"C:\Users\Admin\AppData\Local\Temp\nsoCB77.tmp\questbasic.exe" "C:\Users\Admin\AppData\Local\Temp\nsoCB77.tmp\questbasic.dll" "vowihokasuz" " " "uvacegozijeji"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:1244
-
-
C:\Program Files (x86)\QuestBasic\questbasic.exe"C:\Program Files (x86)\QuestBasic\questbasic.exe" "C:\Program Files (x86)\QuestBasic\questbasic.dll" rihikoxu gezoxuvo1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Program Files (x86)\QuestBasic\questbasic.exe"C:\Program Files (x86)\QuestBasic\questbasic.exe" "C:\Program Files (x86)\QuestBasic\questbasic.dll" yeqagezo ikoxubuye2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1468
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsoCB77.tmp\questbasic.dll
- Size 868KB
- SHA256 6f8ab6b73b19003d72856d1894758bfdd9e88606e44397d89cd533ba7282b626
- MD5 e9b691e878a23750a2726aaa356f46e7
- SHA1 5cd77790c918bcb660e281f3c70120195dab92ed
- SHA512 e9a9cef7a963ee3121051ebdd472f7c98f661ff982cdff355a62307590b65317e50e19eca295ba8ebeb1335e9a9cf6b5465a9a525563884e38980e42b80974f5
- SSDEEP 12288:SaXu0GV1In89icmaMgGz3cE5bJsrBJXAataADHgOTtA7PTS82PSIYjxOhbKOo:7ki89iV93cCsFAAjbtuPTt2PWxobKO
- TLSH T1781523A01C8280F2CE0B59BB59151B19387E659052F1A4CFD6DEF1FAAF302D8967D287
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsoCB77.tmp\questbasic.exe
- Size 22KB
- SHA256 4c5f4c0897c8e765a7bce92914f758bbc276c2256b3d5105bbfb62f59524e81d
- MD5 6973f29c29a3eeee35567657e52f2d53
- SHA1 2efab86aa9d2a1c323dbc761b0a837b922282aea
- SHA512 8e4151c0518fc560e1c4d76e3d6128d551f29a5c5080a32d4593848c3b356fe71149b67ff060c94b81384011bcd7b48d2df036c119a53c1b89ed1a91f8d9d5f0
- SSDEEP 384:qBYaCj8bP0yG60JDIgPURCblLVU107wnq/Hl+uY3vJml:8C4Rd0JDnFRhU107wn2FNisl
- TLSH T138A23B23B8929177C88285B049A99A03E73F55061FB04097CF94259FBF726E1AD3E307
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsoCB77.tmp\uninstall.exe
- Size 78KB
- SHA256 dd1fb0babead3e4cfc4f1c2b6da6e188ade41656cd991dd67ae9080244166896
- MD5 44f90c8f57c78ff549af6ce114277f57
- SHA1 ddf8b6eb49b804f9082b892a439d8bb297f88cae
- SHA512 451072bd2ae46c724da08c6ae8ad44c0ad78d41d16ec17c781f4e155e9e9347583b725ec3597f15a71263931a825e689b4b95141f91652075d69d82b567e4df8
- SSDEEP 1536:PEkjY1zy214Qay0DGkJ7qAELVigJpVjcpDCxH9TplS1N/RA2/DD:8kjAJ4dDGkJ+AI0mguH9TpAN/RX/H
- TLSH T16273D10737C098B7C7AA063105BBEBBEFBB7965111216F570B900F6F2A219839A1D15B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsq90DE.tmp\InstallOptions.dll
- Size 13KB
- SHA256 551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc
- MD5 d765c492c21689e3d9d61634371fd861
- SHA1 ac200933671ae52c9d5544d0e2e8e9144d286c83
- SHA512 9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f
- SSDEEP 192:9B6RvrfvOuJQDghBy/X7QKq3TLGciZJf0EzWzMnz6WoF1dBs:v6RrviWaX7eiZJ7nz6bB
- TLSH T14D525D61738488F3E786063E745237138BD926257CA15DE2C6330FCA6A2718D7EF6342
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsq90DE.tmp\System.dll
- Size 10KB
- SHA256 802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
- MD5 fe24766ba314f620d57d0cf7339103c0
- SHA1 8641545f03f03ff07485d6ec4d7b41cbb898c269
- SHA512 60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
- SSDEEP 192:rO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1aMBgMO:yKAFERdlxhGRYUzqZaMB
- TLSH T18E226C5547A041F3DD60823C08973D272BA837148EA54ED3CFD314429E296A6BCBC336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsq90DE.tmp\ioSpecial.ini
- Size 698B
- SHA256 6b9d7cd065d4e2892e177c58249cbd3c54bc8dace11383da9793cfeb7c43a1a5
- MD5 9ec94a761ea21fd2afc01bffb7b5bd31
- SHA1 bc301ee0a1e52d7d0831bb2a4c57435eddcdf6d5
- SHA512 d77e3646377cd8a739d58073c23c2ffe8ba44efee138f804fbb80c4286e7ee109c417d9308d0ab681979120361638e8fa467f8ae67416ccc175e90ac1420db89
- TLSH T11901C098C45F93240861305625FD77D1D7603C2C4B2238B290628907474DAC78AEEDC1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsq90DE.tmp\ioSpecial.ini
- Size 560B
- SHA256 b1a56bff8ec2eb0e3d17b3fd5e1d443f89ab4ff503e56721fbaafde6f9507d4c
- MD5 467f3749f6d4792392f8d41a20b3d87d
- SHA1 dc8e37feeb5d51c868c38dbe5ab89a4afb761250
- SHA512 2a49afba4ce3a903a7ee748a0ae9fc08e11ba3616a914c6b7adb591d09ed05e7286a6b2823f725c48290b9a8ca6785303a96f6ead4e5b1bda48de260141b8dee
- TLSH T11EF0C66CD44E021A082531075AFDBBD197A43C34CB1615B1C1758907870FFC5C8DD9C1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsq90DE.tmp\ioSpecial.ini
- Size 737B
- SHA256 a44fea510fadeeb843bf122cb9b4fe129d5f335348768d8bb7b32db2a1fc7ff5
- MD5 7961809e868008258847bd7c6b57093e
- SHA1 ff57b9a942e02c5681fa8bcbaf81d759f83adffa
- SHA512 385c05a2654091c5c0e6daa88398e1824d3ba44c8387b733daa22ec0cc66b6deb5706caff05525339318b88d5d351614130ee878868563212891850f61ce2345
- TLSH T1DD01D088C45F93650821308A24FDB7D1E7A03C2C4B2238F290618907474DEC7C9DD9D2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsq90DE.tmp\modern-wizard.bmp
- Size 150KB
- SHA256 614d5d54c44ca502b3f433f39a6729c11b7e6a6d60aedbc59092e91f35fb5a95
- MD5 79233b82a7a8fdc258f223161eec8d5f
- SHA1 b5b4a92eeb619bd426c8f4d9ede4a4f2e8ee85ed
- SHA512 9d1e05d9cf3455b6ed03a25defcb3cede5800cd951a2050cb7cdeb1f0f869a93a08f3083d6c2548ab78391219623e93ac98c9644c8f966b9fca13af712607ab3
- SSDEEP 384:QeH0fR9FDyy4pqeTbmd811S729+D9zUug+1Sp5xwocI5AK5G1/Zk3Ju8X:vQEy/eTbmd811S729YAu1k3TY/Zk3vX
- TLSH T13CE39364F096A5C4D828967DBE74BD2E00615DCB38E94E4F1B2E3DB403F36038595EAE
- MD5 SHA1 SHA512 SSDEEP TLSH
