75c2cbfb3aab4e29fb8c8bb483009902eef4548e6ac55c8cb174326add7fc4c7

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe
Size 232KB
Sample261014-d9aa4sec93
SHA256 75c2cbfb3aab4e29fb8c8bb483009902eef4548e6ac55c8cb174326add7fc4c7
MD5 5e52758c2a62ff66dd8fbc305871ec3c
SHA1 a44906f7d2555664426bb97a817cee8dbc96c37d
SHA512 8e871b0f8159205f383adb44f0f3b639d596b31f1270f77934f14ca365ad9e66fb066121d26f65bbbc2bab1d175c86137e9d2ed1d69c580fa7c3a4f6229d07dd
SSDEEP 6144:aVh1l5i0Mm6aQc6Uec3yKmgbKjoV8IC4Ypw:aVhH16TBUVypgJ6Iz
TLSH
T1F3341312D259C446E9D5CDB14EAB1BA38374AE93D4221D2309897DCB1873BCBC7CA397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4464	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe
4464	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe
4464	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes a VBScript file via the Windows Script Host. 1 TTPs 7 IoCs

execution

Visual Basic

T1059.005

pid	Process
5460	wscript.exe
2324	wscript.exe
2244	wscript.exe
4240	wscript.exe
4644	wscript.exe
1908	wscript.exe
4488	wscript.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4224	cmd.exe
3636	cmd.exe
5032	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4224	4464	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe	89
PID 4464 wrote to memory of 1908	4464	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe	91
PID 4464 wrote to memory of 4488	4464	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe	92
PID 4464 wrote to memory of 5460	4464	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe	94
PID 4464 wrote to memory of 2324	4464	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe	95
PID 4464 wrote to memory of 2244	4464	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe	96
PID 4464 wrote to memory of 4240	4464	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe	97
PID 4464 wrote to memory of 4644	4464	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe	98
PID 4464 wrote to memory of 3636	4464	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe	99
PID 4464 wrote to memory of 5032	4464	jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe	101

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.AdLoad.ulgo.exe"
1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin5772.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4224
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" /nologo "C:\Users\Admin\AppData\Local\Temp\_tinAE2D.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:1908
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" /nologo "C:\Users\Admin\AppData\Local\Temp\_tinD283.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4488
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" /nologo "C:\Users\Admin\AppData\Local\Temp\_tinFADA.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:5460
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" /nologo "C:\Users\Admin\AppData\Local\Temp\_tinAE2D.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:2324
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" /nologo "C:\Users\Admin\AppData\Local\Temp\_tin82C7.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:2244
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" /nologo "C:\Users\Admin\AppData\Local\Temp\_tin1AB1.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:4240
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" /nologo "C:\Users\Admin\AppData\Local\Temp\_tinFADA.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:4644
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin15D9.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3636
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin7A4B.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.ini

Path C:\ProgramData\InstallMate\4695F6AD\cfg\1.ini
Size 2B
SHA256 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
MD5 e0aa021e21dddbd6d8cecec71e9cf564
SHA1 9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
SHA512 900110c951560eff857b440e89cc29f529416e0e3b3d7f0ad51651bfdbd8025b91768c5ed7db5352d1a5523354ce06ced2c42047e33a3e958a1bba5f742db874
MD5 SHA1 SHA512

Submit Download

4695F6AD.dat

Path C:\Users\Admin\AppData\Local\Temp\4695F6AD.dat
Size 284KB
SHA256 8137f8cb6c2552bb8289f86fa727dc44d24148d8852011ba435cd559c42f091d
MD5 c3ff8fa413d59dd74c15e69274972676
SHA1 1990a9d9badef689d8cde654fb05c198505a0698
SHA512 7b6b26545e8182d2695aa7b91fa01a2cd7a66816eb4094d65aec633338d57725995d07160e27c0b7550848a68ea5628d8790e3091f194871e69b0c64e668b1a5
SSDEEP 6144:a2FhfETQcW61yFiGpxE+BHqWo0P/5GeoEK/oS4:a2FhGQ2yQQE+7PP/Yem/f4
TLSH
T1655485E1FE77CA36F8026774019B5FD15F305BB461806413B1EA523F4A163ACA38A5AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\4695F6AD\Setup.exe
Size 15KB
SHA256 7d471a8df92de59217c60f1d1b2882fb04eadb44cf2dd313bba3c7e4d39678b4
MD5 39e03e22e2c5cb67a7a750805de9435a
SHA1 50a3ff79f3815f58c8f2bb918fe156037a892387
SHA512 c7944d56f70190b3e6417f8923c844308d4840954afd613320c497170d87aa1300dc65472926c8691a242aa7fafbbdb3f2357ec178b340789f92245bb00dfff8
SSDEEP 192:0NCPnjIw3YKDPp3MJg+jc09JyowJL/8ngkTh8Tou7+wpBvm:0UPnjItKDPp3Igu9JYJLyPuc
TLSH
T10E62F707DB115410E4A18E31C9EBD6E50E3EFD43EDA5A13F57802E4F2CF27A86250A6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.ico

Path C:\Users\Admin\AppData\Local\Temp\4695F6AD\Setup.ico
Size 4KB
SHA256 0ec48e3c1886bc0169a4bc262f012e9b7914e3b440bb0ecc4d8123924abc9b93
MD5 c3926cef276c0940dadbc8142153cec9
SHA1 f8b350d2b7158f5ab147938961439860d77b9cb4
SHA512 5b9958095b8a7b39b3a2226a5242faec8d2d799d10e1e4ed6dbfb8aaebe51b7496cf4bb5ad588366a296671df3ba46a3f42860abc7f9501b4cc5efd55dd87904
SSDEEP 48:n4yMXU3X9qyyOOta08t7E/gbN1pv6u6m0Qddg6C0pQG5b1i9IhS:6U34OOtJyg4Dsm0Q3MrG6gS
TLSH
T191A19922E110CC98C9988432CD9BDAF50429FC17EC2966772BD17F4F2E779A5D22155C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Setup.dll

Path C:\Users\Admin\AppData\Local\Temp\4695F6AD\_Setup.dll
Size 146KB
SHA256 5b5d7c5be3342e0e03f825c71700f52dece2919347744589be3fc701f16a2b0a
MD5 45856456d315c994ecc0455a07a5bab5
SHA1 ca563d75cf5c004928e5683e26c74fa718640cbb
SHA512 8d27df045361f1ec08f314e2832197bc1bbcf0003e05720d6de50b34eb8320b04afe084b4c9c25bf5eb49fcf54d919bdba3427ca1e69150e28220e6c9a4caff9
SSDEEP 3072:vIBpR0CR1WU8fyo9p9e/G5fknuoM6nHTk:4WC2fV6HA
TLSH
T1CCE3AA92E7F94555F5F73B74AABB46A21D36BC55EA38CA0F2204005E2D32F40DE607A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Setupx.dll

Path C:\Users\Admin\AppData\Local\Temp\4695F6AD\_Setupx.dll
Size 16KB
SHA256 f32c9be19334ec4a212d173f43e3a97e08434000ff7cef8584afbf72e05ba845
MD5 f17dce858db6f84c1c149f8aebb1ce58
SHA1 e54f8c536dd66610d0678a3532c4f8834b01abe6
SHA512 c08f9efb7a3514c7829d7c9bd0ef384bbe038e695021a089b354eab6e9c13408fab31a01f502013c27c1a50e2e223ad3c33f4ed7424498b4077091c0044b7ce7
SSDEEP 384:aFwcZM7faYeyMH8fEYqPY4toFN6NanW8r7E9nKjWueFuk:ew8MOyM7PRSN6kInV7t
TLSH
T15072081067E501B2E2B31BB47F71B2194AFA7D250CE4998E87D246482D30953FA3E7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tsu-1170.dll

Path C:\Users\Admin\AppData\Local\Temp\Tsu-1170.dll
Size 245KB
SHA256 f94e3692cf74256ef5f9df081592603e5b3aac4490ce39cf88363c5f24fa5aa7
MD5 8c7a58965b71c9dfbf1a14d3369a2620
SHA1 26380249b9bdf1ab864b1c8fa4d01e4c28ba9b5c
SHA512 97302e9a0f53fb7239c92049d61d65be2958de3d674cdc25fb2ac10424814930e982278d6d6e8df2e270116a5a1b7d1cfea14250aea99191f3efd571357c7023
SSDEEP 3072:tTV2y5NMzbk+pGQN/YEbu0qoIoh+F8u0LJUHsbghNULQEYNYEa2CXkl4qTU6IGtK:bmI+Mol+F625AX2CXkOAkA
TLSH
T1F6346C91B7A0C03FD6B3163415AB7B22A5BAFA300F28F54AA3205ED56D35B43F51D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tin15D9.bat

Path C:\Users\Admin\AppData\Local\Temp\_tin15D9.bat
Size 50B
SHA256 fecabfe00bbd4b7f00dea58f0a474ffc312018874a6f32cc314fa294fb6e8bf7
MD5 08ca270804a539f32bf0eb94ee6a4f49
SHA1 629c39fafec8462ee575dff5abe19b7b1bd3bd75
SHA512 8e3ed16708de835eaee3817518f80acb2855dd67c2310a5acbdcd2bd3828c9ef7ebe3c8ee18e1aa54de7bb11bff4c03e59cfc0a499af6095571840f527f0ccb3
TLSH
T1E990021208661AD4280507C043076C814A14C4982146445D41890529C791B04645D5D1
MD5 SHA1 SHA512 TLSH

Submit Download

_tin1AB1.vbs

Path C:\Users\Admin\AppData\Local\Temp\_tin1AB1.vbs
Size 819B
SHA256 fa4d0c7bb7e01f87c2d7b475a795513cb67349ee8fb10f267da89050fce66941
MD5 db4ad910e7e436fd6e223478e2beff92
SHA1 2a8069e0312d24103893a94388755a86179b10e4
SHA512 022001efecb271fef43ca8e5fd3e30141de87d47570bd953a86211797da9bdceda9104025eda7a4326f829193e2b81b198d15af3427f1313f17951c531fa05e4
TLSH
T1E5018265E92FCEAB85234BE2844BC24AF17045087D7A592E3644DD483F17B19E2C42A5
MD5 SHA1 SHA512 TLSH

Submit Download

_tin5772.bat

Path C:\Users\Admin\AppData\Local\Temp\_tin5772.bat
Size 44B
SHA256 20e95c24c28e28eab5ef78fa9c208d5efdad29909b0042e4245c61c1367d5e36
MD5 c543162cbd875322fb6ad985ab751ec6
SHA1 aad6f43f9c25265b02c16801e3e0fef9064a307a
SHA512 d4b6cc5be5b9e67f37c9a16f04245f652e932abe9f3b0313d557bc72b027ed2949dfd9dc5fa45f690e3175f058537b16500ba6ca8da98384054ff088ff202498
MD5 SHA1 SHA512

Submit Download

_tin7A4B.bat

Path C:\Users\Admin\AppData\Local\Temp\_tin7A4B.bat
Size 46B
SHA256 3ee5b2863cb0df073633caeea8bf7d1aab22e1ca960be304b7e3c29720a1953d
MD5 3d0138814755ea5bfdc3ca0517aa6591
SHA1 732c5c698a779452c1377ef46901410e31c75a08
SHA512 ad1a5f067482e68bce819cbffc2538e741009ea310076d8dc1234eb2935276086137cccf0286a8634700333ac6958f386a8d45b32b21686517bd79a0811eb7d2
MD5 SHA1 SHA512

Submit Download

_tin82C7.vbs

Path C:\Users\Admin\AppData\Local\Temp\_tin82C7.vbs
Size 419B
SHA256 2aa2fe3abb348819826dba1c190530dfa0af082f47a13a30b3753f94966c5a38
MD5 2644a4ef2603b5028a1cb783284efe6a
SHA1 97c8420f731565196363a9230a1faf865843ba89
SHA512 670e8b39b7e206d877bed8b4258e7797417a0619f8d07abb04d6ffca1b6bd682754d294afd03c38aa95bb0324e001e7bfa2008a82056387d871e3d0d4c868dd4
TLSH
T1C6E0AB31E63BCDBB88230AF2800BC38AB4600608BC76492D3298CD083B1AF2CE3C5170
MD5 SHA1 SHA512 TLSH

Submit Download

_tinAE2D.vbs

Path C:\Users\Admin\AppData\Local\Temp\_tinAE2D.vbs
Size 304B
SHA256 f3c802c2717333f36399e9aa6c6c390b6ed97ebf7f727a1612a4e95d0b4c7c36
MD5 931c2fc9e703c78d5e5147a14e16a6d0
SHA1 a4a42bfa987c8bca67ab5102c88eac3237634929
SHA512 b2b972a9fb78ee9c56d82771be9bc94f09f591a6a3bc0e8c60cfe385253f2014132ae748afb980e2ad6d6d9cb29f6c7db175c9526d39ae9839194495484aaaa7
TLSH
T114E0CD22E303CEA7892306D545C2904DD49800C02D35522D6B95DC9CBD53F64E5D41F4
MD5 SHA1 SHA512 TLSH

Submit Download

_tinD283.vbs

Path C:\Users\Admin\AppData\Local\Temp\_tinD283.vbs
Size 1KB
SHA256 e68d61782ca4af1ee2d6f1bcf23862039a6ab8c310575310c82ade3844259397
MD5 d4d654b672fc8acab89fb05445f29cb5
SHA1 fa760970d391ee60b20111605887ec9ee42f6fc7
SHA512 91108ebd9d5f1fe24fb71357123aef8b2b1cea130a8e73a248037cc9eb91e840a98c0d85d1fc089c22ab74758b31ecc9d7cc35e4dbe4c0ee9991196cbcb7d68c
TLSH
T14E212020A41FA5B3492323B2214BC05B76B815187DBC1975B4478F0A2D0FE2CCBCD17D
MD5 SHA1 SHA512 TLSH

Submit Download

_tinFADA.vbs

Path C:\Users\Admin\AppData\Local\Temp\_tinFADA.vbs
Size 2KB
SHA256 f1cf6dfed3151112d2b6de014f5958bac2e5b0e4cda9b4700705a90041aac823
MD5 a714fd1bb71ce6a38235d62a1a63546e
SHA1 bb4b1d4136b3f51927737326eb8186703c0372d5
SHA512 8f0c0d8e92bc03327719aa459d6a603ee1edc07c11991f6392d054db21afc15d4cdf6a06b9d6525e46648747b1ac4308b4eb0ca4e0961c8d5bb93424b231fe08
TLSH
T11B5121E57947E82845334BF7BE479819E894E65717EAA8023D089FC40F39258F2E1F74
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads