738784ec87e5db87d43f95ee9f76f49999ee66b997872f5017359f368cb05b06

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.exe
Size 389KB
Sample261014-e2fzcsed96
SHA256 738784ec87e5db87d43f95ee9f76f49999ee66b997872f5017359f368cb05b06
MD5 2305ba371cfd7c743de0070b227501c1
SHA1 9374b7e92d2c47ef918630dd03d550536bd06301
SHA512 92d89194c9a9e22566cee3d1022f960a5994c4eb4731f1da1521999aaf7f6e2685cdd0c77587e3b999efeffafb921258ab12df0a0c3397beb325652b125c8b72
SSDEEP 12288:CQiGsCL8+iDNdRilKhC2Iqjzva6WXd55yGMB:CQi5i8DdIsItq
TLSH
T165841203A9E6497EE115AB751FAE9051AB3B7D0A0D39340839CD9EEC4F7B1C6D20D392
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution installer

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
defense_evasion

Software Discovery
T1518

Executes dropped EXE 1 IoCs

pid	Process
1728	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp

Loads dropped DLL 2 IoCs

pid	Process
1728	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp
1728	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp

Discovers running processes 1 TTPs 12 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
60	tasklist.exe
1164	tasklist.exe
4268	tasklist.exe
3228	tasklist.exe
1208	tasklist.exe
3844	tasklist.exe
116	tasklist.exe
1256	tasklist.exe
4860	tasklist.exe
2412	tasklist.exe
3068	tasklist.exe
3304	tasklist.exe

Executes a command shell one-liner 1 TTPs 23 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1152	cmd.exe
1360	cmd.exe
4608	cmd.exe
4240	cmd.exe
4616	cmd.exe
5000	cmd.exe
3264	cmd.exe
2100	cmd.exe
1556	cmd.exe
4892	cmd.exe
3876	cmd.exe
3424	cmd.exe
2216	cmd.exe
3292	cmd.exe
620	cmd.exe
4680	cmd.exe
868	cmd.exe
3296	cmd.exe
2560	cmd.exe
2612	cmd.exe
4076	cmd.exe
3124	cmd.exe
1364	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp

System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/3488-0-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral1/memory/3488-42-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3844	tasklist.exe
Token: SeDebugPrivilege	2412	tasklist.exe
Token: SeDebugPrivilege	3068	tasklist.exe
Token: SeDebugPrivilege	116	tasklist.exe
Token: SeDebugPrivilege	1256	tasklist.exe
Token: SeDebugPrivilege	3304	tasklist.exe
Token: SeDebugPrivilege	60	tasklist.exe
Token: SeDebugPrivilege	1164	tasklist.exe
Token: SeDebugPrivilege	4268	tasklist.exe
Token: SeDebugPrivilege	3228	tasklist.exe
Token: SeDebugPrivilege	1208	tasklist.exe
Token: SeDebugPrivilege	4860	tasklist.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 1728	3488	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.exe	85
PID 1728 wrote to memory of 3296	1728	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp	87
PID 3296 wrote to memory of 2560	3296	cmd.exe	90
PID 2560 wrote to memory of 3844	2560	cmd.exe	91
PID 1728 wrote to memory of 1152	1728	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp	94
PID 1152 wrote to memory of 4892	1152	cmd.exe	96
PID 4892 wrote to memory of 2412	4892	cmd.exe	97
PID 1728 wrote to memory of 3876	1728	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp	98
PID 3876 wrote to memory of 3424	3876	cmd.exe	100
PID 3424 wrote to memory of 3068	3424	cmd.exe	101
PID 1728 wrote to memory of 3264	1728	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp	102
PID 3264 wrote to memory of 2612	3264	cmd.exe	104
PID 2612 wrote to memory of 116	2612	cmd.exe	105
PID 1728 wrote to memory of 1360	1728	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp	106
PID 1360 wrote to memory of 2216	1360	cmd.exe	108
PID 2216 wrote to memory of 1256	2216	cmd.exe	109
PID 1728 wrote to memory of 4076	1728	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp	110
PID 4076 wrote to memory of 3292	4076	cmd.exe	112
PID 3292 wrote to memory of 3304	3292	cmd.exe	113
PID 1728 wrote to memory of 620	1728	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp	114
PID 620 wrote to memory of 60	620	cmd.exe	116
PID 620 wrote to memory of 688	620	cmd.exe	117
PID 1728 wrote to memory of 2100	1728	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp	118
PID 2100 wrote to memory of 4680	2100	cmd.exe	120
PID 4680 wrote to memory of 1164	4680	cmd.exe	121
PID 1728 wrote to memory of 868	1728	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp	122
PID 868 wrote to memory of 4608	868	cmd.exe	124
PID 4608 wrote to memory of 4268	4608	cmd.exe	127
PID 1728 wrote to memory of 4240	1728	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp	128
PID 4240 wrote to memory of 3124	4240	cmd.exe	130
PID 3124 wrote to memory of 3228	3124	cmd.exe	131
PID 1728 wrote to memory of 1364	1728	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp	132
PID 1364 wrote to memory of 1556	1364	cmd.exe	134
PID 1556 wrote to memory of 1208	1556	cmd.exe	135
PID 1728 wrote to memory of 4616	1728	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp	136
PID 4616 wrote to memory of 5000	4616	cmd.exe	138
PID 5000 wrote to memory of 4860	5000	cmd.exe	139

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Users\Admin\AppData\Local\Temp\is-O6BPO.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-O6BPO.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp" /SL5="$C010E,138429,56832,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3296
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq HMA! Pro VPN.exe" /FO CSV
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2560
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq HMA! Pro VPN.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3844
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Fiddler.exe" /FO CSV
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4892
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq Fiddler.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2412
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Wireshark.exe" /FO CSV
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3424
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq Wireshark.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3068
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3264
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Capsa.exe" /FO CSV
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2612
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq Capsa.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:116
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq ipscan.exe" /FO CSV
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2216
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq ipscan.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1256
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Procmon.exe" /FO CSV
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3292
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq Procmon.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3304
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c tasklist /FI "WINDOWTITLE eq Process Monitor*" |find "PID"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:620
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "WINDOWTITLE eq Process Monitor*"
      4⤵
      Discovers running processes
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:60
  - - C:\Windows\SysWOW64\find.exe
      find "PID"
      4⤵
      System Location Discovery: System Language Discovery
      PID:688
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq regedit.exe" /FO CSV
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4680
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq regedit.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1164
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:868
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Taskmgr.exe" /FO CSV
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4608
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq Taskmgr.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4268
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq OLLYDBG.exe" /FO CSV
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3124
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq OLLYDBG.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3228
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1364
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Regshot-x64-Unicode.exe" /FO CSV
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1556
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq Regshot-x64-Unicode.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1208
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Regshot-Unicode.exe" /FO CSV
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5000
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq Regshot-Unicode.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Process Discovery

Query Registry

Software Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-GK07T.tmp\CheckProc.cmd
Size 122B
SHA256 2a5b80a6a1522b75fda6e7f99ceb912bc7db1bd6be11995fdcbde1ab7d836dba
MD5 59a8010aab7eb203cd9fda8f6be1beca
SHA1 b9a07636b921183c88880320294e279c935cddd7
SHA512 26ae700f89e827f9d5f8d29c7f393eb3e5885d32266591d61b20ffd7ba1d08dfbc0e6e9368c94288185a01960cbd0a8ce96b063187396465e640e963e9b3666e
TLSH
T121B0926644A48B368F760A839489848A57C2C2550058A3EA3340021CF1FAA6D5AE87FA
MD5 SHA1 SHA512 TLSH

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-GK07T.tmp\CheckProc.cmd
Size 122B
SHA256 ff1f1293c860b0709d0244a8c6a29294543efdc698a70469e1cd388c0db84493
MD5 a59dd0f9883ea39c5119831b0eed46cc
SHA1 8c9354051f7d92310636f0f17e5770aede9d1ad3
SHA512 4a07eac5507fc174879eb960becf19b3a20b224232f74dfeb28d393bed3f181a0d4020efb9b656000d4ce756491c44f4f5a86dec184feca593c9bf6bd8700dac
TLSH
T1D1B0926044A08A274D7A1BC3968DC5E653C2C2974019A3DA3640025CF0EAA291AE8BFA
MD5 SHA1 SHA512 TLSH

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-GK07T.tmp\CheckProc.cmd
Size 122B
SHA256 39863141871b63880b4282066451321a902a7e6b97264c9ffdfd8128ac8293b8
MD5 32b997a9d994996a4369a580e6541b7d
SHA1 d61b48404dd6f6dd43d90858ffb7ddb967ecb1f1
SHA512 f3ff262b5986436671b4cf970d2ab4eb0dfd3d70651e7e84c8ae38788ef12032db825b81e6e1d8c4f20f0aa5a8067e6e7943b7e3e3c9817e97f0ab227f3fbe1f
TLSH
T16EB09B524464C9254D763D83944D868673C5C555401463D53140010FF5D9A1595EC7F5
MD5 SHA1 SHA512 TLSH

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-GK07T.tmp\CheckProc.cmd
Size 132B
SHA256 55b728e4cc0974b19641d1dc77df0f381f244b254d39e2566dcf525b9d106cd8
MD5 97cc4c6dda23b9631b8c9185859ad061
SHA1 5f912a6c094bd918afe5e9f0c70cd45b36dff722
SHA512 cf82517f44425d402305129821cff7668c5db27d5427b8a8886e99146a1a56ef43b8055e6c62929fbfdf293a88664a760e49443ac89453fa3163ed1ebfb8469e
TLSH
T11FC02B30006589314C320283C248819263C5C114012463EDB300050CF0DB61514F43FF
MD5 SHA1 SHA512 TLSH

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-GK07T.tmp\CheckProc.cmd
Size 146B
SHA256 176a95493ca3bbfc9a68b4283b53a291faef0f9a7c413b43e1bdad86834a820d
MD5 f0b99c1273d3787f7769feb4d56e6803
SHA1 6105232df9585072be8ca04712f8760812943cbf
SHA512 73b313c0046f6fcec974f2af64859c0af122e9f86503c7427519b7d2aaaf67e2f8cc68de17b93f24604aff815b843fce9a01571c1db48d3c12867e49daab0133
TLSH
T165C08CA1C461CE324EE21983894AC0C3B3D5CA000000A2E93D001A08E4FD6B509F83EF
MD5 SHA1 SHA512 TLSH

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-GK07T.tmp\CheckProc.cmd
Size 122B
SHA256 953998031a5ac3582232545f923b32f02587fb233791a0326b889f28af4cfabc
MD5 b921f2f9f97a642d513e1307f7685e0f
SHA1 3489b63a484a6114f1828100908bbbc622b07ed1
SHA512 1da42e0ed2dca9f2a559739c6a0c6b28a54e0d8d0617bec542729a362dd0f36f9287bcd4433c9cabd7db7430e7295f6879c7777a86035c4f3c86b3b05847ae0e
TLSH
T15BB09B5144658B394E7B0983944DC4D657C2C155002467D53340470CF0EA65595D4BF5
MD5 SHA1 SHA512 TLSH

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-GK07T.tmp\CheckProc.cmd
Size 138B
SHA256 cfe680c9896cade2f5163ee0a463a7f7dbae7ee4aadf8de15c6c119a1d582016
MD5 755c6764b8ecbb83798450705f51510f
SHA1 deb141c4fc3220f0ff5c16eabf1adf850bf55610
SHA512 a6292b9416cbbc4a407d143acd502b6a726abb5411309e292f6696a7e55ecb5b78b4bdc764dc3484e85a5a40f21d410018172544b00882759b251aa9dce5df89
TLSH
T191C08C9184608E324EA211838859C0C3F3D5CA020000A2E93900460CE4FD63509F83AF
MD5 SHA1 SHA512 TLSH

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-GK07T.tmp\CheckProc.cmd
Size 126B
SHA256 9b78165c2b44ba6675654f776e34815c19482a84c87e6a7dc9d1a68d3d5a5e53
MD5 b35e8ab65e7f8a4edb3663885f775681
SHA1 49b66b2e3cff64dd7d8315c53d852c19a46e8609
SHA512 3ec1fad817117f00f620103666b1caa2ece51b9cc1a9b3fb2142d57aedc745e9bc69608e0cb2a2eff1879c7ad6741b66751049020620bac8659598080404adcc
TLSH
T112B09BA054E48B278D760A83A55A889653C2C155001463DD3148010DF0DE61915D87F5
MD5 SHA1 SHA512 TLSH

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-GK07T.tmp\CheckProc.cmd
Size 118B
SHA256 a02aa2b143a8e126b1a044e1f036a912a0ac134e8e1f56836805b15819e43f6b
MD5 f1b6aae3dcd94b94aee326517e3dc583
SHA1 3418fdda1ad30df64d7bac068e1a0c4e305cfd75
SHA512 dae27c24d2ef685e4f968dcd91cda18bfa605fd924b1bf928307107630bd671d6623e78451d3f397dfc93cc4e1c0f74c25e962b5669e2350a79b72ec061ec1ba
TLSH
T105B0926444A18B2A4DB61A83949DC4869BC2E2954410A3DA3240020CF0EEAA619ECBFA
MD5 SHA1 SHA512 TLSH

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-GK07T.tmp\CheckProc.cmd
Size 120B
SHA256 c3fabcab01d67640320ce0a5354e4fc6a7832beebe2e9a7610f43614eefce32c
MD5 d93cc818d32f755945cddfc02b29fb89
SHA1 fc564e791326d269d005c894cfca674352dae814
SHA512 62c20691da188a45b59c468826706ed47ad285d9e23996b714c03b4c639d87d93b57e22f9e4504be42a742ee4c64657d87565f9ce65b677d05f66d0bbef0e0d5
TLSH
T19BB09B50456189255D762683E449848A5FCDC156C01163D53145111CF0DB61615D57FD
MD5 SHA1 SHA512 TLSH

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-GK07T.tmp\CheckProc.cmd
Size 122B
SHA256 e3c86ead8667eac8c9ea88e2ee5f5f14f0f0be59a54864f99cbee17d554f74e5
MD5 660d266764b1952b43431d6c7dc0dfa9
SHA1 809794738d6ca580d6ec14e77a717e831b0d0e5c
SHA512 6fc27ec6f453c2791aa9d0c38817128ed8e2fff26748fbe0cfee6411d8a120970494b3504078a3079c90d409434f22b35974efd5cbbaf14ce3657715fc18f4c3
TLSH
T197B0926086A09A278D7706839C8FC88653C2C7550013A3DA3360626CF0EAA2519E87FA
MD5 SHA1 SHA512 TLSH

Submit Download

itdownload.dll

Path C:\Users\Admin\AppData\Local\Temp\is-GK07T.tmp\itdownload.dll
Size 200KB
SHA256 b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
MD5 d82a429efd885ca0f324dd92afb6b7b8
SHA1 86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA512 5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
SSDEEP 3072:lfb9mvexZXivFFmLFam1BEsW61HgAIwSMaentFGTaIgBx9rs0NBGZZuey2E0QeqB:lfbueviGLVUyHgAIwSMaenTrNWcmE
TLSH
T183146C37B6C0CC73D1611ABCDC5FDADC642AFE102D38689B3AE85F4C4E396916929187
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-O6BPO.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Eorezo.gen.tmp
Size 690KB
SHA256 0e19765b89a1a29afee09810dcb3ec5cc7c66053947be8f1aebdbb7c801dfeaf
MD5 1305181de520f125aeabf85dc24a89d6
SHA1 98b7548fede3f1468ccbdee405abdc4e5d2ec671
SHA512 b0bfa9749a6a5a18c1926e6c5ebb4cdb156df1652cb822f067422a1cd21583340f32e4a1fc2f4c21a09343d73a55651972edbd2dec98ce44641a1097c16bc793
SSDEEP 12288:LTPcYn5c/rPx37/zHBA6a5UeYpChr1CERdSrNdyR6D3o1a+mxyF:PPcYn5c/rPx37/zHBA6pFpCZ1CEuD3ot
TLSH
T10AE47C32F2A0C837D4B31E789D5B82D55936BE103E38A59736E81F4C4F796817A272D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1728-15-0x0000000003960000-0x000000000399C000-memory.dmp

Download

memory/1728-6-0x0000000000640000-0x0000000000641000-memory.dmp

Download

memory/1728-40-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/1728-41-0x0000000003960000-0x000000000399C000-memory.dmp

Download

memory/3488-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3488-42-0x0000000000400000-0x0000000000414000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads