Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 03:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe
- Size 239KB
- Sample261014-d86b6ae17x
- SHA256 6c2cfb5a2df3b6d16c3fd9abf68396467e7e92e6b2e9bf759e5c1d34861d95c3
- MD5 4e9ca92e67c989efd9310e332c258d6f
- SHA1 a65c7f29ed58c033e9f6bd8b1d8234bf2107cb4b
- SHA512 119e4163844da7dbcd8f1c9e9387f15e885a5e325db79a048d642021489930b5a64d2f34724bed0e107bcae3d33d8e664867b09a5f0ac287f438c0c344a11466
- SSDEEP 6144:tV+qKpQ0ZNZ8QMgOAFqUu7FqQACdItSa4jF8GtwkM6J:tVcZNZlOyqB7szCdItS/jwkM6J
- TLSH T1E6341227E3A896E6C7F04C318BDA9B37EC39E906D1718F465CC96E9F16366638D04321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 3336 jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe 3336 jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe 3336 jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe"1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3336
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\0A24F192.dat
- Size 313KB
- SHA256 d753012f4f3abf32a2f5a782510016ada93a7cb42f232f1229657d95085f2e42
- MD5 9e6899a7f903d7d192e4e602f99e27c3
- SHA1 dcb7e113cfb14e622b773979057f7d35bf822d1e
- SHA512 4539c0dedd0fc6152aa670a72178da662c12fd02605a38d52079f6f64f3acdca276a2fd424573511c9f41d0d3cc4a588aaee86eed3c934e480e6281e4de991f0
- SSDEEP 6144:+wdA6r0gGUFueUQrris0V1c5xIfcc+nf0FTMGuXRqi5FK1bC8:py6rHGUgXQyLAu6feYGsZwb
- TLSH T1BE64A6D5FE6ADA26F8066730009B1BD15E306BB4A6807013B5DA633F0A6739D63471EF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0A24F192\_Setup.dll
- Size 117KB
- SHA256 557bf5e2acddcb11f7ff488481087c320c0ee19ec0254a37ef6b67bf793e584e
- MD5 70ad6c943adb2d9a1d137e7b9cb798e9
- SHA1 0b7181394e83e0aa41a03fe0f044ee36bddc56c2
- SHA512 e363bf3d8e000a5e62d63385b29f2e1996874ebd3dd7a6abd13599dddb8ce4e7d3b39b2f61a3d7f8593b6952172fd4fa1f22702b72936a64e053de792e67b623
- SSDEEP 3072:ERKZmYOqayjztaqt6t2NbpmO9a1CrtP21Z7/zzpN77z2m8yzs2UvdGEbUJ5uzYve:EUmZs
- TLSH T144C39A92EEC68491F0E5433494BF86D72E32BC11D525CE0F5388366E3D76681BE90BE9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0A24F192\_Setupx.dll
- Size 18KB
- SHA256 0a2860aa7756385cb3563f8215e402f2acf64ac29323de7e50727725b3518b7a
- MD5 e7c9c21963dadf9183ab0c8caaf15d11
- SHA1 2111704294a03dd7bf9822672c3fe2f1b6153592
- SHA512 65a4292970f6b9e3441bd3ffd30c79f6c951f3a4944ad801f201b55d85198adb785ea3e3b38f371f02c1da390ec280112dbccc592c12aa8d76c63bdbc35801ff
- SSDEEP 384:h4cZeJ78xvIYUVUYtN+L1Pzt2jTX6NanW8r7E3nKjWseFk7Ic:h48vxvIYqNW1Pp6TX6k6nVpo
- TLSH T13282091067E101B2E3F71BB47D61711A4BEE7E740CA4E88E87D256892934A13FA7E353
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Tsu-0D08.dll
- Size 246KB
- SHA256 3cf077afb7ff0d7f7e9c7039c05c2d19c50d50941a73f4245093856ca8d2405f
- MD5 e671c2b76207304be7b9b601ea91773c
- SHA1 1e801677f242467cecb3a4fa148a9acf6485c49b
- SHA512 e2b7821b3fad3f24f644a75f7edee5bda4eae70a5ec6a9bb33bc52d5704bae77b81ef222ce65292ddc29a2a2322f81fb4ed9f74e730b8f9366b083717be94026
- SSDEEP 6144:6cmqSqZyfQHOz+Ib/dz98lAA6RtD+uy7D:RmCmbVz98lBS3yX
- TLSH T126348E91B3A0803BD6B3163059EF7773B6F9FD300728C64A8360AF953979643E519B1A
- MD5 SHA1 SHA512 SSDEEP TLSH