Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
15/10/2026, 22:39
General
- Target jaffacakes118_not-a-virus.AdWare.Win32.DealPly.auxxu.exe
- Size 1.2MB
- Sample261015-2le4fset9j
- SHA256 cb0c90f2409f948bd7a474cf9dc2b7b9165ba5220a661a791dda2f2667415378
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.AdWare.Win32.DealPly.auxxu.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.AdWare.Win32.DealPly.auxxu.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-4EBAD.tmp\jaffacakes118_not-a-virus.AdWare.Win32.DealPly.auxxu.tmp"C:\Users\Admin\AppData\Local\Temp\is-4EBAD.tmp\jaffacakes118_not-a-virus.AdWare.Win32.DealPly.auxxu.tmp" /SL5="$8005E,1027921,84480,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.AdWare.Win32.DealPly.auxxu.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
jaffacakes118_not-a-virus.AdWare.Win32.DealPly.auxxu.tmp
memory/1396-526-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/1396-525-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/1396-213-0x0000000000640000-0x0000000000641000-memory.dmp
memory/1396-212-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/1396-206-0x0000000000640000-0x0000000000641000-memory.dmp
memory/3640-118-0x0000000007EE0000-0x0000000007FBD000-memory.dmp
memory/3640-136-0x0000000008D10000-0x0000000008DED000-memory.dmp
memory/3640-34-0x0000000003DD0000-0x0000000003EAD000-memory.dmp
memory/3640-40-0x0000000004250000-0x000000000432D000-memory.dmp
memory/3640-46-0x00000000046D0000-0x00000000047AD000-memory.dmp
memory/3640-52-0x0000000004C00000-0x0000000004CDD000-memory.dmp
memory/3640-58-0x0000000005080000-0x000000000515D000-memory.dmp
memory/3640-64-0x0000000005500000-0x00000000055DD000-memory.dmp
memory/3640-71-0x0000000005980000-0x0000000005A5D000-memory.dmp
memory/3640-76-0x0000000005EB0000-0x0000000005F8D000-memory.dmp
memory/3640-82-0x0000000006330000-0x000000000640D000-memory.dmp
memory/3640-88-0x00000000067B0000-0x000000000688D000-memory.dmp
memory/3640-94-0x0000000006C30000-0x0000000006D0D000-memory.dmp
memory/3640-100-0x0000000007160000-0x000000000723D000-memory.dmp
memory/3640-106-0x00000000075E0000-0x00000000076BD000-memory.dmp
memory/3640-112-0x0000000007A60000-0x0000000007B3D000-memory.dmp
memory/3640-0-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3640-124-0x0000000008410000-0x00000000084ED000-memory.dmp
memory/3640-130-0x0000000008890000-0x000000000896D000-memory.dmp
memory/3640-28-0x0000000003950000-0x0000000003A2D000-memory.dmp
memory/3640-142-0x0000000009190000-0x000000000926D000-memory.dmp
memory/3640-148-0x00000000096C0000-0x000000000979D000-memory.dmp
memory/3640-154-0x0000000009B40000-0x0000000009C1D000-memory.dmp
memory/3640-160-0x0000000009FC0000-0x000000000A09D000-memory.dmp
memory/3640-166-0x000000000A440000-0x000000000A51D000-memory.dmp
memory/3640-172-0x000000000A970000-0x000000000AA4D000-memory.dmp
memory/3640-178-0x000000000ADF0000-0x000000000AECD000-memory.dmp
memory/3640-184-0x000000000B270000-0x000000000B34D000-memory.dmp
memory/3640-190-0x000000000B6F0000-0x000000000B7CD000-memory.dmp
memory/3640-196-0x000000000BC20000-0x000000000BCFD000-memory.dmp
memory/3640-22-0x00000000035B0000-0x000000000368D000-memory.dmp
memory/3640-16-0x0000000002FD0000-0x00000000030AD000-memory.dmp
memory/3640-211-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3640-10-0x0000000002B50000-0x0000000002C2D000-memory.dmp
memory/3640-2-0x0000000002300000-0x00000000023D7000-memory.dmp
memory/3640-5-0x00000000024C0000-0x000000000259D000-memory.dmp
memory/3640-3-0x00000000023E0000-0x00000000024B6000-memory.dmp
memory/3640-527-0x0000000000400000-0x000000000041B000-memory.dmp