75c2cbfb3aab4e29fb8c8bb483009902eef4548e6ac55c8cb174326add7fc4c7

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe
Size 232KB
Sample261014-d9aa4sec93
SHA256 75c2cbfb3aab4e29fb8c8bb483009902eef4548e6ac55c8cb174326add7fc4c7
MD5 5e52758c2a62ff66dd8fbc305871ec3c
SHA1 a44906f7d2555664426bb97a817cee8dbc96c37d
SHA512 8e871b0f8159205f383adb44f0f3b639d596b31f1270f77934f14ca365ad9e66fb066121d26f65bbbc2bab1d175c86137e9d2ed1d69c580fa7c3a4f6229d07dd
SSDEEP 6144:aVh1l5i0Mm6aQc6Uec3yKmgbKjoV8IC4Ypw:aVhH16TBUVypgJ6Iz
TLSH
T1F3341312D259C446E9D5CDB14EAB1BA38374AE93D4221D2309897DCB1873BCBC7CA397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
728	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe
728	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe
728	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes a VBScript file via the Windows Script Host. 1 TTPs 7 IoCs

execution

Visual Basic

T1059.005

pid	Process
3504	wscript.exe
4188	wscript.exe
3712	wscript.exe
2076	wscript.exe
3708	wscript.exe
4716	wscript.exe
1332	wscript.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4240	cmd.exe
3532	cmd.exe
2208	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 3532	728	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe	88
PID 728 wrote to memory of 3504	728	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe	91
PID 728 wrote to memory of 4188	728	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe	92
PID 728 wrote to memory of 3712	728	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe	94
PID 728 wrote to memory of 2076	728	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe	95
PID 728 wrote to memory of 3708	728	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe	96
PID 728 wrote to memory of 4716	728	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe	97
PID 728 wrote to memory of 1332	728	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe	98
PID 728 wrote to memory of 2208	728	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe	99
PID 728 wrote to memory of 4240	728	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe	101

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe"
1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:728
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin5772.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3532
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" /nologo "C:\Users\Admin\AppData\Local\Temp\_tinAE2D.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:3504
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" /nologo "C:\Users\Admin\AppData\Local\Temp\_tinD283.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4188
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" /nologo "C:\Users\Admin\AppData\Local\Temp\_tinFADA.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:3712
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" /nologo "C:\Users\Admin\AppData\Local\Temp\_tinAE2D.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:2076
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" /nologo "C:\Users\Admin\AppData\Local\Temp\_tin82C7.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:3708
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" /nologo "C:\Users\Admin\AppData\Local\Temp\_tin1AB1.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:4716
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" /nologo "C:\Users\Admin\AppData\Local\Temp\_tinFADA.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:1332
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin15D9.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2208
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin7A4B.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.ini

Path C:\ProgramData\InstallMate\1F9A088B\cfg\1.ini
Size 2B
SHA256 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
MD5 e0aa021e21dddbd6d8cecec71e9cf564
SHA1 9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
SHA512 900110c951560eff857b440e89cc29f529416e0e3b3d7f0ad51651bfdbd8025b91768c5ed7db5352d1a5523354ce06ced2c42047e33a3e958a1bba5f742db874
MD5 SHA1 SHA512

Submit Download

Setup.exe

Path C:\ProgramData\InstallMate\{DBB02F63-2284-42AA-B1BC-F2912BC5B32B}\Setup.exe
Size 15KB
SHA256 7d471a8df92de59217c60f1d1b2882fb04eadb44cf2dd313bba3c7e4d39678b4
MD5 39e03e22e2c5cb67a7a750805de9435a
SHA1 50a3ff79f3815f58c8f2bb918fe156037a892387
SHA512 c7944d56f70190b3e6417f8923c844308d4840954afd613320c497170d87aa1300dc65472926c8691a242aa7fafbbdb3f2357ec178b340789f92245bb00dfff8
SSDEEP 192:0NCPnjIw3YKDPp3MJg+jc09JyowJL/8ngkTh8Tou7+wpBvm:0UPnjItKDPp3Igu9JYJLyPuc
TLSH
T10E62F707DB115410E4A18E31C9EBD6E50E3EFD43EDA5A13F57802E4F2CF27A86250A6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.ico

Path C:\ProgramData\InstallMate\{DBB02F63-2284-42AA-B1BC-F2912BC5B32B}\Setup.ico
Size 4KB
SHA256 0ec48e3c1886bc0169a4bc262f012e9b7914e3b440bb0ecc4d8123924abc9b93
MD5 c3926cef276c0940dadbc8142153cec9
SHA1 f8b350d2b7158f5ab147938961439860d77b9cb4
SHA512 5b9958095b8a7b39b3a2226a5242faec8d2d799d10e1e4ed6dbfb8aaebe51b7496cf4bb5ad588366a296671df3ba46a3f42860abc7f9501b4cc5efd55dd87904
SSDEEP 48:n4yMXU3X9qyyOOta08t7E/gbN1pv6u6m0Qddg6C0pQG5b1i9IhS:6U34OOtJyg4Dsm0Q3MrG6gS
TLSH
T191A19922E110CC98C9988432CD9BDAF50429FC17EC2966772BD17F4F2E779A5D22155C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1F9A088B.dat

Path C:\Users\Admin\AppData\Local\Temp\1F9A088B.dat
Size 284KB
SHA256 8137f8cb6c2552bb8289f86fa727dc44d24148d8852011ba435cd559c42f091d
MD5 c3ff8fa413d59dd74c15e69274972676
SHA1 1990a9d9badef689d8cde654fb05c198505a0698
SHA512 7b6b26545e8182d2695aa7b91fa01a2cd7a66816eb4094d65aec633338d57725995d07160e27c0b7550848a68ea5628d8790e3091f194871e69b0c64e668b1a5
SSDEEP 6144:a2FhfETQcW61yFiGpxE+BHqWo0P/5GeoEK/oS4:a2FhGQ2yQQE+7PP/Yem/f4
TLSH
T1655485E1FE77CA36F8026774019B5FD15F305BB461806413B1EA523F4A163ACA38A5AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Setup.dll

Path C:\Users\Admin\AppData\Local\Temp\1F9A088B\_Setup.dll
Size 146KB
SHA256 5b5d7c5be3342e0e03f825c71700f52dece2919347744589be3fc701f16a2b0a
MD5 45856456d315c994ecc0455a07a5bab5
SHA1 ca563d75cf5c004928e5683e26c74fa718640cbb
SHA512 8d27df045361f1ec08f314e2832197bc1bbcf0003e05720d6de50b34eb8320b04afe084b4c9c25bf5eb49fcf54d919bdba3427ca1e69150e28220e6c9a4caff9
SSDEEP 3072:vIBpR0CR1WU8fyo9p9e/G5fknuoM6nHTk:4WC2fV6HA
TLSH
T1CCE3AA92E7F94555F5F73B74AABB46A21D36BC55EA38CA0F2204005E2D32F40DE607A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Setupx.dll

Path C:\Users\Admin\AppData\Local\Temp\1F9A088B\_Setupx.dll
Size 16KB
SHA256 f32c9be19334ec4a212d173f43e3a97e08434000ff7cef8584afbf72e05ba845
MD5 f17dce858db6f84c1c149f8aebb1ce58
SHA1 e54f8c536dd66610d0678a3532c4f8834b01abe6
SHA512 c08f9efb7a3514c7829d7c9bd0ef384bbe038e695021a089b354eab6e9c13408fab31a01f502013c27c1a50e2e223ad3c33f4ed7424498b4077091c0044b7ce7
SSDEEP 384:aFwcZM7faYeyMH8fEYqPY4toFN6NanW8r7E9nKjWueFuk:ew8MOyM7PRSN6kInV7t
TLSH
T15072081067E501B2E2B31BB47F71B2194AFA7D250CE4998E87D246482D30953FA3E7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tsu-02D8.dll

Path C:\Users\Admin\AppData\Local\Temp\Tsu-02D8.dll
Size 245KB
SHA256 f94e3692cf74256ef5f9df081592603e5b3aac4490ce39cf88363c5f24fa5aa7
MD5 8c7a58965b71c9dfbf1a14d3369a2620
SHA1 26380249b9bdf1ab864b1c8fa4d01e4c28ba9b5c
SHA512 97302e9a0f53fb7239c92049d61d65be2958de3d674cdc25fb2ac10424814930e982278d6d6e8df2e270116a5a1b7d1cfea14250aea99191f3efd571357c7023
SSDEEP 3072:tTV2y5NMzbk+pGQN/YEbu0qoIoh+F8u0LJUHsbghNULQEYNYEa2CXkl4qTU6IGtK:bmI+Mol+F625AX2CXkOAkA
TLSH
T1F6346C91B7A0C03FD6B3163415AB7B22A5BAFA300F28F54AA3205ED56D35B43F51D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tin15D9.bat

Path C:\Users\Admin\AppData\Local\Temp\_tin15D9.bat
Size 50B
SHA256 5ead9548701ea8dd089a9948831c919596f4ee000079cb9f5eb5deddf4805b91
MD5 b14b156f4978f66175379ff3809d0f80
SHA1 a4cfd329a7401d24c23133631303d6e2e3287a0d
SHA512 37944fd4356a52773f25b82dce69392e490dc1c80bf041b1db24adc515e3ecbaebb5cd4b8a343c5cfb77fe7eed594051ad3746e0776fd5706edd9a25ff2a335a
TLSH
T1119002110449165429063244831758818A10CC985148409E81C54619E381710649E1D5
MD5 SHA1 SHA512 TLSH

Submit Download

_tin1AB1.vbs

Path C:\Users\Admin\AppData\Local\Temp\_tin1AB1.vbs
Size 819B
SHA256 f4d936a415ae3cd24c5d9187edab39a62eaf0db2073e77d4c8b49f33bc278e4e
MD5 4fc74f76541590d5ca6a7c2191ed028c
SHA1 4ae94977e81d60e093fa3915c909f61ca8608557
SHA512 39f010dcc35256a775e0332d7be2e05cb80e4f7944e5764140134b317b5854771a6539979432e301987a8547615819ead9dc9868f741c43b167149f0c8e1af54
TLSH
T16401C265E51BCE6B84234BF2844BC24AF17045086D3A591F3240DD483B07718A3C42A9
MD5 SHA1 SHA512 TLSH

Submit Download

_tin5772.bat

Path C:\Users\Admin\AppData\Local\Temp\_tin5772.bat
Size 44B
SHA256 abbcc7ff4a1890332d23f4bd4993bf28d14380524ba97df7f73e4fd8f8937019
MD5 540e66ebee906b69c66c1b93a316d710
SHA1 04726ef5b5d1eb05fd319b71180a0611ae42ead4
SHA512 fa60e7f3cec49642fd2868d35974dd0c54d44f06f26b48dbd71cc0b8e48131e1fa75557ddc27fc2047f507cc7bfd7bef9685194f07d62f4772e23c79ec38e45e
MD5 SHA1 SHA512

Submit Download

_tin7A4B.bat

Path C:\Users\Admin\AppData\Local\Temp\_tin7A4B.bat
Size 46B
SHA256 07b57944ce23c513c8291c8b36dbce08f164a454807529ae9a9281135a982740
MD5 d2338116a935583bc18b9c318023ad66
SHA1 1a05b0742f4025a9350eacd0edc4fcc2ca00ad1c
SHA512 37a7f93b6af947880f0524b521675648f7ac757b378677c86fa15dbd762c6a4738391483b492122acf2547a7554079461862d2b6535bb16bfe00b09fab1edf28
MD5 SHA1 SHA512

Submit Download

_tin82C7.vbs

Path C:\Users\Admin\AppData\Local\Temp\_tin82C7.vbs
Size 419B
SHA256 25463c6282c472fe3697cb0454bf21cdc0817a41671aa01781603730011d2521
MD5 04e110c1d238bde89dd77043fceb91eb
SHA1 a765d5fd622c7fd2d97a82b7f6d1ce86bb8f2b21
SHA512 49b54053b85a86bc3115a7ab33d74b5bc4648a5e1125fb7194ca1617b421c732315a48540c71abcf6819f7fbf05484a566020974383aa62163cc4a688f769f93
TLSH
T13BE0AB31E63BCE7B882306F6800BC38AB4600A08AC76495D7288CD08370AB2CA3C6174
MD5 SHA1 SHA512 TLSH

Submit Download

_tinAE2D.vbs

Path C:\Users\Admin\AppData\Local\Temp\_tinAE2D.vbs
Size 304B
SHA256 6146375d6c618fe09470201ce218d3e94147a024300a48609b75865817740f24
MD5 59db5ee072fe519fa4a08b7de3b827a7
SHA1 e53dfc73bc681dcd93cef702844074d587e0c512
SHA512 287fbfb2e7ad53d34dd7b036315f9b910e8693f2f29db67d5443d571a4568b3e2ada4d2f9029c92d16f5c36149d412b33baf5b8ce530a8659079070c60cfad38
TLSH
T1BCE0CD22E303CA678937159949C1908DD49400C05D35522D6B94DC9DBE53F70A6D41F8
MD5 SHA1 SHA512 TLSH

Submit Download

_tinD283.vbs

Path C:\Users\Admin\AppData\Local\Temp\_tinD283.vbs
Size 1KB
SHA256 37dadb9a734eece411d9cc186ded839d2aad16e63f6d901aa17499756b9e46cc
MD5 4768fda034928caba51531a6c0f237fa
SHA1 92bbf1f5dad2fe3dd33e9c71326e7538ef4f75c7
SHA512 c6f3862c6a8b96e7ea747bf919d811079f22ed33db2d9e3f651294bbd9021333196e7fcb73e4b8c04d342450359d49e06c3b58352e4f77f3a54268506a30b94b
TLSH
T16021EE21A81FA573492323B2214BC05FB6B81528AD6C1975B447CA093E1FE2C9BCD26D
MD5 SHA1 SHA512 TLSH

Submit Download

_tinFADA.vbs

Path C:\Users\Admin\AppData\Local\Temp\_tinFADA.vbs
Size 2KB
SHA256 33b1fce2c2327375b4096452597fee0369709043b12a4715c817b02a585fe66a
MD5 35a1eba810aeb169226f9bc350c4f958
SHA1 2b500ac4776e5c9616466ac9e63b9c3817bbc22a
SHA512 b79259698bac3c430030bab9c8ae6a1d47bd468e74787803e8176f2297cd83fd5b487245dbb951d963bfcc6aefe66e9ced7b84f38c9750094f4d7a08da54839a
TLSH
T16A5121E57847E82845334BF7BE479809E894E65717EAA8423D089FC40F39258F2E1FB4
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads