9b82d5f1f6b31fadcf8176a86a4f8495ae06647b88a10e6e0672db290aeab7d8

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.hrvk.exe
Size 829KB
Sample261014-edjqcaed26
SHA256 9b82d5f1f6b31fadcf8176a86a4f8495ae06647b88a10e6e0672db290aeab7d8
MD5 f15651506fa85a836631d01ef9754bb7
SHA1 c3917abce107a0980d8362ff604fa83bb8224b41
SHA512 28cfaf010f252ca973ff1196bc536a58d96519303c09a06c27af3389bed9357197aae80296db03cb08853140fa64a4377917513e7ce9fe529775698e7965e032
SSDEEP 24576:HdSNu2lc2/5kP2J4+sJ4sEL1jjs+THx3IIxa2CJ:Hshx5k84+yDEL1jjtTH543J
TLSH
T1D7050241390CA4D2EA5D423ABC1F9D668AC17D7EAB8056EF71A5F3DF30F22B64267011
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 10 IoCs

pid	Process
3428	jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.hrvk.exe
3428	jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.hrvk.exe
3428	jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.hrvk.exe
3428	jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.hrvk.exe
3428	jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.hrvk.exe
3428	jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.hrvk.exe
3428	jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.hrvk.exe
3428	jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.hrvk.exe
3428	jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.hrvk.exe
3428	jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.hrvk.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3428-0-0x0000000000400000-0x0000000000826000-memory.dmp	upx
behavioral2/memory/3428-192-0x0000000000400000-0x0000000000826000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.hrvk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.hrvk.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.hrvk.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.hrvk.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.hrvk.exe"
1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LuaBridge.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\LuaBridge.dll
Size 12KB
SHA256 959c090aa0c41925dbeafbbd455cd766f8d3b8d62ad47b8f8a0116ad542efe79
MD5 8e11ed4d0b151add7e69bdd36bdfe349
SHA1 6cddd66e26a3a2d98b32f5db6f39e6a32f9b3807
SHA512 4eeac9ce126c87b068d412b72c8c6c73ba5160b39f9f302aa5c16014cbc9d5c4dbbfb0881c65736c85131266f18b5f5814bdff0de5e602b91b9972802b8c0fcc
SSDEEP 192:i7eFv+UTmEZbZIPlKt5tswGZQu1PQrnWVwxlhgzNpkfnT:iOvHTXZbStWu/lPQr7lOzNCT
TLSH
T1F742F801632104B1DF9501B1B077BF128AFA780172C3585A9F5E66893D63B96DF3B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ltn12.lua

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\LuaSocket\lua\ltn12.lua
Size 8KB
SHA256 b1864aed85c114354b04fbe9b3f41c5ebc4df6d129e08ef65a0c413d0daabd29
MD5 e440044afe6c761507a996b5b45ab0f9
SHA1 ef772c758fd5d6098b41375f35ac26f3963cc306
SHA512 8a82df90459929de1c91ed29a122a149749d42adbb85faf0c3123d0f0886babc90cb93de85105feb7497b46552a6747ae05b985f5a488d1d8f1a2a7db44077b4
SSDEEP 192:PYfxR7f6v6kObk2D0P9+INoAlEEvKbMEMuWKlrSDrGXJ5GPYbo8+b2uP0XJUMwsr:PN6kObkyar5libMv+sCorbrMwsDiDK
TLSH
T1B002BB8A3D86F1B569F2DA99984B6401F1668853827A0164FC1C94D43F3026DF3FEFB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mime.lua

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\LuaSocket\lua\mime.lua
Size 2KB
SHA256 e9167e0da842a0b856cbe6a2cf576f2d11bcedb5985e8e4c8c71a73486f6fa5a
MD5 4bfdaaab9014fe129bc6388fd5687c8f
SHA1 2c6ff28245e1dc7ec9ac1c43c3cda354d07b2c4a
SHA512 3a1a4d838bb5cafe71da262ee7bd6dccbd30dd4d7abe0d04f6ecf96bf704d5e111967be812894a47f2eb3374ee110620b7cc47eebac8b72ddcf7f506ba82a607
TLSH
T1CB51E260BDC3B4E1E4E3E856D19F5814F0692817103512A1BC4D16971B7357AE2FF6F8
MD5 SHA1 SHA512 TLSH

Submit Download

socket.lua

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\LuaSocket\lua\socket.lua
Size 4KB
SHA256 15fd138a169cae80fecf4c797b33a257d587ed446f02ecf3ef913e307a22f96d
MD5 74dbe1060e91112e1c21ef9870b4a587
SHA1 86afb6aecb0a8387ffa5dead1cc9808332f94310
SHA512 73218ebb2ad27d3402173054be997089549698d9112acb4b1c9fe044689a40ceda3df00304d336d2034e61c04832f52d971509240414838841d40f53fc0c3723
SSDEEP 96:LGvAOKAXAHPAF8AHnAHqUNaewVMw7MlvMncAlMNAA/:GWaoP3onoqBJVv7Yv7Qz0
TLSH
T1D781668DBDA3F265BAF3E694998B2005F176845312781106F85C80A17F7251DE3FEBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

http.lua

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\LuaSocket\lua\socket\http.lua
Size 12KB
SHA256 d10fbef2fe8aa983fc6950772c6bec4dc4f909f24ab64732c14b3e5f3318700c
MD5 7bd12178adca19b584ed1320fdae1e81
SHA1 839753d73984bda68047585bbc36f9344f51c34d
SHA512 634428c0e7dc62e7c44f60586c0ab0cedb8b55d9e7f2432f7f681aa58e0a8a444168d104d25c51b7839c06817f83f52a7baa4a0e45df6db283d6d5aa0d5e424e
SSDEEP 384:x7/thyc+f7zLajrZhVoaOt2yyViz/vcvwkD:F/thyc+f7zyoaOt2yqiz/avD
TLSH
T194421147BD83B060F9F2C255E9871A06F26A902354291095F8BC42DE3F711ACD3FDBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

url.lua

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\LuaSocket\lua\socket\url.lua
Size 10KB
SHA256 269526c11dbb25b1b4b13eec4e7577e15de33ca18afa70a2be5f373b771bd1ab
MD5 8fb662c362da002b833793ea7794fdaf
SHA1 7afaf1ad22c95690cbb3f55226b617121efc20eb
SHA512 b0b766ac2b5cff879009ad9f74295f7ab0bf8b0628b8aece5597243e0fa96f4a85361728fd8a08eea7d2629dfc5e5d8b6aebca432075ad74c131ad3161a475c7
SSDEEP 192:zF/d/WjwnQdkUDv7wIECAAA4HaHjCRBxj6AqyQUh/T1htnSDiKbn:zfWjwXUDv7uCAx4HaD+Bxj6AqK/TTsiY
TLSH
T14422FE2C3D82E222EAF1E7538EBF0985F118916311691528B5CC14D53F3692CB6FFA75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

core.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\LuaSocket\mime\core.dll
Size 52KB
SHA256 a1ffee9687ab4a23a78b3251888aff09e2896d76f8d16d713367b265f125188d
MD5 4a4845ba1666907f708c9c10a31ec227
SHA1 1ebf626adc84147e5114885ce779f92d6eb68f3a
SHA512 d009f5e2a2ecfbec5e5e788ade142d612846d0c99921774e4a11b060998dfb0680cf1e1a54604535d5560738093f9ae166866cb23eee5c7d9c4e5cc5a33e7464
SSDEEP 768:Hk1jtHTV0IuugoXCodH5LjciB9snJ1hTgZNno42L:HkhtHTeroXR3aL0toV
TLSH
T112339F22789340B3C6E8827851B45F2F99BEB5110BD158D38FB8754E7F219E2E13B70A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

core.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\LuaSocket\socket\core.dll
Size 80KB
SHA256 bfe8445c38ee71240e856f85d79e94123d7179bf43688de0e2a14e32e6ef21b0
MD5 4bf7db111acfa7c28ad36606107b3322
SHA1 6f20b9f6663ce0c309a2ce60e718d64ffb6c75b3
SHA512 0a5e66a65b80e15d8198f2934c58227ae17680f0fbea9865b2f44af82a29c53d4f95cf9616b4dfd75202420eb73b7d962cf2c84fdad6ce26afe1eb4bb978d0b6
SSDEEP 768:4pOz0XSP1hSt5+5lKfZyDy3TygCk749NRAa1YwqJlfp8iB9jDEu/s5RPOothtlRp:wOws14t5CeTygmNRA0IVh05IoN3
TLSH
T151839D3631A145B7E5E6447131690B37EB7D79301AE188D38FA449CA6D309F2EA3738B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LuaXml.lua

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\LuaXml.lua
Size 3KB
SHA256 6345b8a47f378416cbd31e543410fa5b03c914219ded2a51c2d3c858f281d6cd
MD5 a34eed4e795d1a7f8f26af91994b2785
SHA1 d950dbd4147b86e246fc19afbc12592aa0ee55b6
SHA512 0d3d92c6b5053469a2edfff0050672ff847135e5d1d08fb7b353df9690f8edcc32f443733bd0d70061f572e3f220769a64a0820918e4b51cf99d8bed30b4f3e1
TLSH
T17181CB55268572B6BFF1E731A80F9812D1774827161601B17A9CC0F23F64548A1FBFBE
MD5 SHA1 SHA512 TLSH

Submit Download

LuaXml_lib.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\LuaXml_lib.dll
Size 11KB
SHA256 90f1bb98e034fcf7bfddb8cb0a85b27a9c9ddb01b926b4e139e1e8fc53d41d09
MD5 7292b642bd958aeb7fd7cfd19e45b068
SHA1 19a800620d041634abae5b5d096cb0e87ce4c188
SHA512 bd758e0833454e0aa2af976ac94fde17c5401102c5991887cefbe8e337974381584c73e2d1e50e49263c55c3788e24dc7f8bd0b9d2a76a6cbe38e48dd9d6c44a
SSDEEP 192:YK/pDHjlL5Fv4k0CSigGpV8pVqVyoyhXnX1:N/L5FqCjpV8pVswXnX
TLSH
T19332D78B763238A6D81D253A218D5B70C73D701618DBD06ACF65CC599C3A1B8FE6D14F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua51.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\lua51.dll
Size 116KB
SHA256 2a4f510a75453fb49ceb2823756bdbcbfe1a026dcd27a76260229386776ddaad
MD5 bbc9ac3211f07e45510861ae429996c3
SHA1 0a0d7ea99c959cd4add3deb05e500af5fdf98510
SHA512 f3a4a726ffd7869d277e9ee09a833cc27e10f117c52dd2a2efcc96cf9280730f10dcb704ea78a6d6f16ac2d2db1b94ad6025dfabaf83fdaaca4f5fbb0db1e756
SSDEEP 3072:+RyHKGrwG4F9FBtzYyEqRi/0L/AZ4g3qq:+RGXrHOHAYi/7L3q
TLSH
T1A3C35C47F682C0B1F48125FA18A263B7CE3D5BF790B3D7179B91D861C866221F51A3CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luacom.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\luacom.dll
Size 287KB
SHA256 9dd5218bc2d12f4d07e268bc6ec01d6eefde4b99a07246d0a96d18477d331b5b
MD5 ed7f7857933b38e5d10daf828e79af19
SHA1 7f1445f87f7e2256efc33ef56da20c3b23a1e0f9
SHA512 ceaf9597d4cb725c4ec8b7af8d1090b38df102b52ca7606a24e9a094fc81f450f93ad22770c905db9115e271fa5fa4f5731caa7b1875e204edb10fb691741715
SSDEEP 6144:sdCVNGq2AcLGcmiuarKjKekqqBVq2Zq++++o++++++qjZfl8++O+yW+s+W+hZa+u:wCVT2nqciarKjKekqqBVq2Zq++++o+++
TLSH
T1D4546E11FA80CE33FAEB01B54676817D2A28EA611740A5C7B7C465698F363E17F3134B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DEFAULT_accept_button.png

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\skin\DEFAULT_accept_button.png
Size 2KB
SHA256 34e467c2857cacf610a3aa55c0ee6bca0d74b5cf26f6826abdcfb3b7b9863e32
MD5 f38db7d0ce184eceddd7de9809f73cc6
SHA1 efea9643f3105c8dcd52f1748708da80c23f787d
SHA512 65a9cb281404795c0b261681f7f732f3d320cb161d17267205c1574b288f545438cc18728ce0dfe12aa980ac0e3598b1f52ea72a7fcd42bce25c7475b168204b
TLSH
T1FC413AEA92490C0CFF9553C144F55408A033525E99ABB2E6BCD284E9B3EC5A0C0E1FEE
MD5 SHA1 SHA512 TLSH

Submit Download

DEFAULT_back_button.png

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\skin\DEFAULT_back_button.png
Size 2KB
SHA256 f883ae60af9a7d2c98b9802549bd05b27e21aa0d3014829e8520f841bd39124e
MD5 9dc457eb5062e884b148839926c00165
SHA1 3ab2cc5da71725112193968352d76fd4c6f0b7ca
SHA512 8020b2bd4d5c6f84e77a34632c1e54bdbd24a18bc5bddde92bd1bedfacd520a026b96f96dd15bfb4bcb4e821729ec51a39c2b9f484929ee6941cb766d1ea9ac0
TLSH
T187413C81BC70C8A117BD85EF864D15B3879BFCDD467FCBB682155140482645140BDD03
MD5 SHA1 SHA512 TLSH

Submit Download

DEFAULT_cancel_button.png

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\skin\DEFAULT_cancel_button.png
Size 2KB
SHA256 c9f68c484ab2f36280f1b5873cc7d94270fe1b377bcea76c934cf92159b537e7
MD5 fa5edd3277d1a64986cd87f459e4c653
SHA1 2892cccdf40c7d1cb4b7b20b3dad9b5b9211e39d
SHA512 51170abe385014d64f1c0a437e5504aa0d1ba70b80c96c06345b95ba315f9812a39322bef79b2a810ef59a729ee6eb1ab936cb2a5032495d1bae939d2a48fc28
TLSH
T1074129F8A9A0685E41E95571ECB7CB92D85B0A1F98DE323E4F3B30819B395FC04197C0
MD5 SHA1 SHA512 TLSH

Submit Download

DEFAULT_decline_button.png

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\skin\DEFAULT_decline_button.png
Size 2KB
SHA256 b91982aeb15bf2e47b2a0ebcbef21f98f1729924b7e00f1d3e4a92bc5e7b046f
MD5 824283b153194f25bc4fc13f8ff3d9fd
SHA1 663079695b22dfff8f1be26895404f81028a2d8a
SHA512 92dfc6886b1e7e91f92057e6751cc517b6ef90d9faa861ddffb112b0ffcbc9c5113d6cfbfb0c7089cafbcf66df31610d3adc6945b906ab4c14e147819e2e26b6
TLSH
T147413961E726D2742CDEE9813B270FA1F91F879E87E104D2708E24F47913D9885D0BD0
MD5 SHA1 SHA512 TLSH

Submit Download

winclose_button.png

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\skin\winclose_button.png
Size 1KB
SHA256 2cfcef01b952aefd15b335d3ab666aefe7767ae0c38703aba0a20b8434dee5aa
MD5 769d48272aa52d14f420532d62155e2a
SHA1 0ffb90f7ce0263f07279f8c745768f7da6528b4c
SHA512 fc72933268e800f723afa66cc15a93822189c433b014d74e9e2a924bf3a9687bff1cf40278b26f42fa47c17336be7044849c46b6deabb79cee05ee6c13862259
TLSH
T1EB21AAC5D002B91ED6949689219F5934A95ECCC40613CABB18FD5E2A37C5582DF3C3EC
MD5 SHA1 SHA512 TLSH

Submit Download

winmin_button.png

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\skin\winmin_button.png
Size 792B
SHA256 ead08cc8d9499b5d1bea1d96cbeef06c19b905c7f9c4c66900045996dac5cd48
MD5 26f9757a4966fb79d67da03d560c1a05
SHA1 e42bef8cbade36999f212ae1be60cc9d1cfa1491
SHA512 da4d50c44095b8832b3e97c406925c7861283038f128ff639faec16dfe3789ad9bb5f6d0719e6ade213f097797a880dfb5ca48dd659f2e08d5eccd40a27566ad
TLSH
T16B01CADC2550417B5DBF179723450C12A4014FE0466BE1670A139C2FA7F0631F5FC729
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3428-191-0x0000000002800000-0x0000000002809000-memory.dmp

Download

memory/3428-192-0x0000000000400000-0x0000000000826000-memory.dmp

Download

memory/3428-0-0x0000000000400000-0x0000000000826000-memory.dmp

Download

memory/3428-75-0x0000000002DD0000-0x0000000002E1E000-memory.dmp

Download

memory/3428-62-0x0000000002850000-0x000000000285E000-memory.dmp

Download

memory/3428-47-0x0000000002810000-0x0000000002826000-memory.dmp

Download

memory/3428-1-0x0000000000825000-0x0000000000826000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads