0df79ebcde62d0bd90cc22aacd642fef46c183fefae28de4a9e3a1c969b89c18

Analysis

max time kernel
150s
max time network
108s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
14/10/2022, 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/QuickUpgrade.exe
Size

417KB
MD5

3ade6ce6f8f78069dc7ff87479dfe053
SHA1

bfa609cdb358ff06c3cf52bcb315d9897c207a63
SHA256

065a173c0b589faf2189310a5aea41350209c21e70082994880ccc8542e0fc37
SHA512

f640cbdeac6f369f855d1f937983487a20b7aa3af39305f658da2bf73a59d8c4856ac9e8645d74ad146c3b144ecf1b29a1cee1924a295809af4461e5947c2d72
SSDEEP

6144:cuzwJBLznc3v09ngF+BZxwnrEkvu8Ha7WGmv7/0w2:cvJBP6v09ngFj1utKGm4w2

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
968	pl4sfx.exe
1264	PostUpdate.exe
964	processlasso.exe
1964	bitsumsessionagent.exe
1468	bitsumsessionagent.exe
1480	processgovernor.exe

Loads dropped DLL 20 IoCs

pid	Process
1300	QuickUpgrade.exe
1300	QuickUpgrade.exe
1300	QuickUpgrade.exe
1300	QuickUpgrade.exe
968	pl4sfx.exe
968	pl4sfx.exe
968	pl4sfx.exe
968	pl4sfx.exe
1264	PostUpdate.exe
1264	PostUpdate.exe
964	processlasso.exe
964	processlasso.exe
1480	processgovernor.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	PostUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	PostUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	processlasso.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	processlasso.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	processgovernor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	processgovernor.exe

Modifies system certificate store 2 TTPs 4 IoCs

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	QuickUpgrade.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	QuickUpgrade.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	QuickUpgrade.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	QuickUpgrade.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
1480	processgovernor.exe
1480	processgovernor.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
1480	processgovernor.exe
1480	processgovernor.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
1480	processgovernor.exe
1480	processgovernor.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
1480	processgovernor.exe
1480	processgovernor.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
1480	processgovernor.exe
1480	processgovernor.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
1480	processgovernor.exe
1480	processgovernor.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
1480	processgovernor.exe
1480	processgovernor.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
1480	processgovernor.exe
1480	processgovernor.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	964	processlasso.exe
Token: SeDebugPrivilege	964	processlasso.exe
Token: SeChangeNotifyPrivilege	964	processlasso.exe
Token: SeIncBasePriorityPrivilege	964	processlasso.exe
Token: SeIncreaseQuotaPrivilege	964	processlasso.exe
Token: SeCreateGlobalPrivilege	964	processlasso.exe
Token: SeProfSingleProcessPrivilege	964	processlasso.exe
Token: SeBackupPrivilege	964	processlasso.exe
Token: SeRestorePrivilege	964	processlasso.exe
Token: SeAssignPrimaryTokenPrivilege	1480	processgovernor.exe
Token: SeDebugPrivilege	1480	processgovernor.exe
Token: SeChangeNotifyPrivilege	1480	processgovernor.exe
Token: SeIncBasePriorityPrivilege	1480	processgovernor.exe
Token: SeIncreaseQuotaPrivilege	1480	processgovernor.exe
Token: SeProfSingleProcessPrivilege	1480	processgovernor.exe
Token: SeCreateGlobalPrivilege	1480	processgovernor.exe
Token: SeBackupPrivilege	1480	processgovernor.exe
Token: SeRestorePrivilege	1480	processgovernor.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe
964	processlasso.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1188	1300	QuickUpgrade.exe	27
PID 1300 wrote to memory of 1188	1300	QuickUpgrade.exe	27
PID 1300 wrote to memory of 1188	1300	QuickUpgrade.exe	27
PID 1300 wrote to memory of 1188	1300	QuickUpgrade.exe	27
PID 1300 wrote to memory of 968	1300	QuickUpgrade.exe	30
PID 1300 wrote to memory of 968	1300	QuickUpgrade.exe	30
PID 1300 wrote to memory of 968	1300	QuickUpgrade.exe	30
PID 1300 wrote to memory of 968	1300	QuickUpgrade.exe	30
PID 968 wrote to memory of 1264	968	pl4sfx.exe	31
PID 968 wrote to memory of 1264	968	pl4sfx.exe	31
PID 968 wrote to memory of 1264	968	pl4sfx.exe	31
PID 968 wrote to memory of 1264	968	pl4sfx.exe	31
PID 968 wrote to memory of 1264	968	pl4sfx.exe	31
PID 968 wrote to memory of 1264	968	pl4sfx.exe	31
PID 968 wrote to memory of 1264	968	pl4sfx.exe	31
PID 1264 wrote to memory of 964	1264	PostUpdate.exe	34
PID 1264 wrote to memory of 964	1264	PostUpdate.exe	34
PID 1264 wrote to memory of 964	1264	PostUpdate.exe	34
PID 1264 wrote to memory of 964	1264	PostUpdate.exe	34
PID 436 wrote to memory of 1964	436	taskeng.exe	35
PID 436 wrote to memory of 1964	436	taskeng.exe	35
PID 436 wrote to memory of 1964	436	taskeng.exe	35
PID 436 wrote to memory of 1964	436	taskeng.exe	35
PID 436 wrote to memory of 1468	436	taskeng.exe	36
PID 436 wrote to memory of 1468	436	taskeng.exe	36
PID 436 wrote to memory of 1468	436	taskeng.exe	36
PID 436 wrote to memory of 1468	436	taskeng.exe	36
PID 964 wrote to memory of 1480	964	processlasso.exe	37
PID 964 wrote to memory of 1480	964	processlasso.exe	37
PID 964 wrote to memory of 1480	964	processlasso.exe	37
PID 964 wrote to memory of 1480	964	processlasso.exe	37

C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\QuickUpgrade.exe
"C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\QuickUpgrade.exe"
1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumms.exe
  "C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumms.exe" /name:ProcessGovernor /stop
  2⤵
  PID:1188
- C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe
  "C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\PostUpdate.exe
    "C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\PostUpdate.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\processlasso.exe
      /postupdate
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:964
    - - C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\processgovernor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\processgovernor.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480

C:\Windows\system32\taskeng.exe
taskeng.exe {BC406279-55E5-4F06-95D3-01B861AFC191} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:436
- C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe
  "C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe" ----------------------------------------------------------------
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe
  "C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe" ----------------------------------------------------------------
  2⤵
  - Executes dropped EXE
  PID:1468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ProcessLasso\config\prolasso.ini

Filesize
7KB

MD5
736f41d2f35e6848cec5f81a083c32cf

SHA1
de983b61b0e002f0ae3d7a1e0fd1e7d66e287b15

SHA256
cc92b1ffc62962e1e8267a47df08f5817df148be90a20e984e87ccabf67b2ca9

SHA512
fd7ea4b7fd497d3052521bb20b92aed29c1317a33119f56627d37d3d29b9c016a66794893db22fe8952568dd98d58306734e5e03ccb5e88186d505b4098f2c92

Download Submit
C:\Users\Admin\AppData\Local\ProcessLasso\config\prolasso.ini

Filesize
7KB

MD5
736f41d2f35e6848cec5f81a083c32cf

SHA1
de983b61b0e002f0ae3d7a1e0fd1e7d66e287b15

SHA256
cc92b1ffc62962e1e8267a47df08f5817df148be90a20e984e87ccabf67b2ca9

SHA512
fd7ea4b7fd497d3052521bb20b92aed29c1317a33119f56627d37d3d29b9c016a66794893db22fe8952568dd98d58306734e5e03ccb5e88186d505b4098f2c92

Download Submit
C:\Users\Admin\AppData\Local\ProcessLasso\logs\processlasso.log

Filesize
1KB

MD5
528a54845add3c1167c59373e80bf0a4

SHA1
4604e6f4eebf2bb74dd56209d26f862345ec8b6e

SHA256
d2fce7cc3ed3587fa241874ba460e3450e64a73a70d156e774fccadbe44758e0

SHA512
4a0711801c16225be827bea38ef60b50ca3689c013b6bc1cc7b450bd102562bc0b0a6798813b02a84b92b12bc234b13768cfe9a16c7e41d2c016104b5fe3c24c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\PostUpdate.exe

Filesize
614KB

MD5
851b8131952c99028b9213fa92dabca7

SHA1
aa5c44bcb5da1e8379e75f434a1e9553df46607a

SHA256
f02d52565f06f592104062b0b9e8e86978709a1404a427546331e4bc108175a1

SHA512
89b9a2bb99775f5d6d67c14e46391599e512a1dec34615855ed53d2e5e542c5d340206ae8f41eaefd6896fbb722b5f497075bf3cecf3d0a94f61279a1f645003

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessGovernor.exe

Filesize
1.1MB

MD5
ff4c384a4b66fa0536eb8d0e73c59ed8

SHA1
6ec79d3d6025602bb7173c771e333c602fb8aff0

SHA256
a292bdf7caaaec6ba91380fb3b6b27d7a9e110b827159dabd4d9d431f652d228

SHA512
967a11e5d15186fd0849b4cae59abcce3672169968dd4f2572c518f74cf56da2494824746716d639cc61a9159de6e9f921895c92f9267f103b3945c7253a77fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessGovernor.exe

Filesize
1.1MB

MD5
ff4c384a4b66fa0536eb8d0e73c59ed8

SHA1
6ec79d3d6025602bb7173c771e333c602fb8aff0

SHA256
a292bdf7caaaec6ba91380fb3b6b27d7a9e110b827159dabd4d9d431f652d228

SHA512
967a11e5d15186fd0849b4cae59abcce3672169968dd4f2572c518f74cf56da2494824746716d639cc61a9159de6e9f921895c92f9267f103b3945c7253a77fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessLasso.exe

Filesize
1.5MB

MD5
ac52b39bfb26b97a956c9910ebcf9917

SHA1
079b23a8cd7dae505f50d2c03a27e885cc6fd841

SHA256
eb36e1727bc767f3981abb103d7e0b0237e02f2ebaab18eff4858f29337b430f

SHA512
a729fe3be9fb2d00cca0876695776ac394fd9153d31451b9fe40c749dc84c1150775fd3d9ed40c6f978233a8caaa15c4f4770c904d8cf7acd67a3fa869dbb775

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessLasso.exe

Filesize
1.5MB

MD5
ac52b39bfb26b97a956c9910ebcf9917

SHA1
079b23a8cd7dae505f50d2c03a27e885cc6fd841

SHA256
eb36e1727bc767f3981abb103d7e0b0237e02f2ebaab18eff4858f29337b430f

SHA512
a729fe3be9fb2d00cca0876695776ac394fd9153d31451b9fe40c749dc84c1150775fd3d9ed40c6f978233a8caaa15c4f4770c904d8cf7acd67a3fa869dbb775

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\QuickUpgrade.exe.Replacement

Filesize
417KB

MD5
3ade6ce6f8f78069dc7ff87479dfe053

SHA1
bfa609cdb358ff06c3cf52bcb315d9897c207a63

SHA256
065a173c0b589faf2189310a5aea41350209c21e70082994880ccc8542e0fc37

SHA512
f640cbdeac6f369f855d1f937983487a20b7aa3af39305f658da2bf73a59d8c4856ac9e8645d74ad146c3b144ecf1b29a1cee1924a295809af4461e5947c2d72

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe

Filesize
142KB

MD5
41314fe5516cdd22f6bfc16e9bdd8590

SHA1
74b976ef91e7fa854facaebc40a502470f052b1b

SHA256
d0e08bd4148e71c6baf63c64fdddc30372f2c7c5f5e50b71c6b868a3df865165

SHA512
02787d60703954b0f7d8f48086af881f3ee2536a3b42e63491a38f1b0eab1d09415abefdd244f9ce944dadd827f862e69c321c48c29c0593e516c4ac02f87be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe

Filesize
142KB

MD5
41314fe5516cdd22f6bfc16e9bdd8590

SHA1
74b976ef91e7fa854facaebc40a502470f052b1b

SHA256
d0e08bd4148e71c6baf63c64fdddc30372f2c7c5f5e50b71c6b868a3df865165

SHA512
02787d60703954b0f7d8f48086af881f3ee2536a3b42e63491a38f1b0eab1d09415abefdd244f9ce944dadd827f862e69c321c48c29c0593e516c4ac02f87be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe

Filesize
142KB

MD5
41314fe5516cdd22f6bfc16e9bdd8590

SHA1
74b976ef91e7fa854facaebc40a502470f052b1b

SHA256
d0e08bd4148e71c6baf63c64fdddc30372f2c7c5f5e50b71c6b868a3df865165

SHA512
02787d60703954b0f7d8f48086af881f3ee2536a3b42e63491a38f1b0eab1d09415abefdd244f9ce944dadd827f862e69c321c48c29c0593e516c4ac02f87be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_english.dll

Filesize
1.9MB

MD5
eddbad54c9fe01d1e36dcde714ed000f

SHA1
c6903a8554fa53ac3a32177644f4f11636fa3764

SHA256
3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2

SHA512
aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe

Filesize
2.6MB

MD5
41bb6a1e453341966c2d0ce8c2108e65

SHA1
ed507e400476ff7b5f4747fa67cefc40f651d2f8

SHA256
cad4bf4a6a75ba693cb10ccc4c514fbaa737abd02bc429082dc4bd0beaa974b8

SHA512
192f6da85b15411688119799b65f7a13ae4da4cfc8ff9b07f0d5f48121f5bac63c09976216f5910bafc90650f29951c5f020e7bb7e79e32288fcf2576b6800bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe

Filesize
2.6MB

MD5
41bb6a1e453341966c2d0ce8c2108e65

SHA1
ed507e400476ff7b5f4747fa67cefc40f651d2f8

SHA256
cad4bf4a6a75ba693cb10ccc4c514fbaa737abd02bc429082dc4bd0beaa974b8

SHA512
192f6da85b15411688119799b65f7a13ae4da4cfc8ff9b07f0d5f48121f5bac63c09976216f5910bafc90650f29951c5f020e7bb7e79e32288fcf2576b6800bc

Download Submit
\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\PostUpdate.exe

Filesize
614KB

MD5
851b8131952c99028b9213fa92dabca7

SHA1
aa5c44bcb5da1e8379e75f434a1e9553df46607a

SHA256
f02d52565f06f592104062b0b9e8e86978709a1404a427546331e4bc108175a1

SHA512
89b9a2bb99775f5d6d67c14e46391599e512a1dec34615855ed53d2e5e542c5d340206ae8f41eaefd6896fbb722b5f497075bf3cecf3d0a94f61279a1f645003

Download Submit
\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\PostUpdate.exe

Filesize
614KB

MD5
851b8131952c99028b9213fa92dabca7

SHA1
aa5c44bcb5da1e8379e75f434a1e9553df46607a

SHA256
f02d52565f06f592104062b0b9e8e86978709a1404a427546331e4bc108175a1

SHA512
89b9a2bb99775f5d6d67c14e46391599e512a1dec34615855ed53d2e5e542c5d340206ae8f41eaefd6896fbb722b5f497075bf3cecf3d0a94f61279a1f645003

Download Submit
\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\PostUpdate.exe

Filesize
614KB

MD5
851b8131952c99028b9213fa92dabca7

SHA1
aa5c44bcb5da1e8379e75f434a1e9553df46607a

SHA256
f02d52565f06f592104062b0b9e8e86978709a1404a427546331e4bc108175a1

SHA512
89b9a2bb99775f5d6d67c14e46391599e512a1dec34615855ed53d2e5e542c5d340206ae8f41eaefd6896fbb722b5f497075bf3cecf3d0a94f61279a1f645003

Download Submit
\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\PostUpdate.exe

Filesize
614KB

MD5
851b8131952c99028b9213fa92dabca7

SHA1
aa5c44bcb5da1e8379e75f434a1e9553df46607a

SHA256
f02d52565f06f592104062b0b9e8e86978709a1404a427546331e4bc108175a1

SHA512
89b9a2bb99775f5d6d67c14e46391599e512a1dec34615855ed53d2e5e542c5d340206ae8f41eaefd6896fbb722b5f497075bf3cecf3d0a94f61279a1f645003

Download Submit
\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessGovernor.exe

Filesize
1.1MB

MD5
ff4c384a4b66fa0536eb8d0e73c59ed8

SHA1
6ec79d3d6025602bb7173c771e333c602fb8aff0

SHA256
a292bdf7caaaec6ba91380fb3b6b27d7a9e110b827159dabd4d9d431f652d228

SHA512
967a11e5d15186fd0849b4cae59abcce3672169968dd4f2572c518f74cf56da2494824746716d639cc61a9159de6e9f921895c92f9267f103b3945c7253a77fc

Download Submit
\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessGovernor.exe

Filesize
1.1MB

MD5
ff4c384a4b66fa0536eb8d0e73c59ed8

SHA1
6ec79d3d6025602bb7173c771e333c602fb8aff0

SHA256
a292bdf7caaaec6ba91380fb3b6b27d7a9e110b827159dabd4d9d431f652d228

SHA512
967a11e5d15186fd0849b4cae59abcce3672169968dd4f2572c518f74cf56da2494824746716d639cc61a9159de6e9f921895c92f9267f103b3945c7253a77fc

Download Submit
\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessGovernor.exe

Filesize
1.1MB

MD5
ff4c384a4b66fa0536eb8d0e73c59ed8

SHA1
6ec79d3d6025602bb7173c771e333c602fb8aff0

SHA256
a292bdf7caaaec6ba91380fb3b6b27d7a9e110b827159dabd4d9d431f652d228

SHA512
967a11e5d15186fd0849b4cae59abcce3672169968dd4f2572c518f74cf56da2494824746716d639cc61a9159de6e9f921895c92f9267f103b3945c7253a77fc

Download Submit
\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessGovernor.exe

Filesize
1.1MB

MD5
ff4c384a4b66fa0536eb8d0e73c59ed8

SHA1
6ec79d3d6025602bb7173c771e333c602fb8aff0

SHA256
a292bdf7caaaec6ba91380fb3b6b27d7a9e110b827159dabd4d9d431f652d228

SHA512
967a11e5d15186fd0849b4cae59abcce3672169968dd4f2572c518f74cf56da2494824746716d639cc61a9159de6e9f921895c92f9267f103b3945c7253a77fc

Download Submit
\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessLasso.exe

Filesize
1.5MB

MD5
ac52b39bfb26b97a956c9910ebcf9917

SHA1
079b23a8cd7dae505f50d2c03a27e885cc6fd841

SHA256
eb36e1727bc767f3981abb103d7e0b0237e02f2ebaab18eff4858f29337b430f

SHA512
a729fe3be9fb2d00cca0876695776ac394fd9153d31451b9fe40c749dc84c1150775fd3d9ed40c6f978233a8caaa15c4f4770c904d8cf7acd67a3fa869dbb775

Download Submit
\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe

Filesize
142KB

MD5
41314fe5516cdd22f6bfc16e9bdd8590

SHA1
74b976ef91e7fa854facaebc40a502470f052b1b

SHA256
d0e08bd4148e71c6baf63c64fdddc30372f2c7c5f5e50b71c6b868a3df865165

SHA512
02787d60703954b0f7d8f48086af881f3ee2536a3b42e63491a38f1b0eab1d09415abefdd244f9ce944dadd827f862e69c321c48c29c0593e516c4ac02f87be8

Download Submit
\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe

Filesize
142KB

MD5
41314fe5516cdd22f6bfc16e9bdd8590

SHA1
74b976ef91e7fa854facaebc40a502470f052b1b

SHA256
d0e08bd4148e71c6baf63c64fdddc30372f2c7c5f5e50b71c6b868a3df865165

SHA512
02787d60703954b0f7d8f48086af881f3ee2536a3b42e63491a38f1b0eab1d09415abefdd244f9ce944dadd827f862e69c321c48c29c0593e516c4ac02f87be8

Download Submit
\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe

Filesize
142KB

MD5
41314fe5516cdd22f6bfc16e9bdd8590

SHA1
74b976ef91e7fa854facaebc40a502470f052b1b

SHA256
d0e08bd4148e71c6baf63c64fdddc30372f2c7c5f5e50b71c6b868a3df865165

SHA512
02787d60703954b0f7d8f48086af881f3ee2536a3b42e63491a38f1b0eab1d09415abefdd244f9ce944dadd827f862e69c321c48c29c0593e516c4ac02f87be8

Download Submit
\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe

Filesize
142KB

MD5
41314fe5516cdd22f6bfc16e9bdd8590

SHA1
74b976ef91e7fa854facaebc40a502470f052b1b

SHA256
d0e08bd4148e71c6baf63c64fdddc30372f2c7c5f5e50b71c6b868a3df865165

SHA512
02787d60703954b0f7d8f48086af881f3ee2536a3b42e63491a38f1b0eab1d09415abefdd244f9ce944dadd827f862e69c321c48c29c0593e516c4ac02f87be8

Download Submit
\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_english.dll

Filesize
1.9MB

MD5
eddbad54c9fe01d1e36dcde714ed000f

SHA1
c6903a8554fa53ac3a32177644f4f11636fa3764

SHA256
3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2

SHA512
aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6

Download Submit
\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_english.dll

Filesize
1.9MB

MD5
eddbad54c9fe01d1e36dcde714ed000f

SHA1
c6903a8554fa53ac3a32177644f4f11636fa3764

SHA256
3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2

SHA512
aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6

Download Submit
\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_english.dll

Filesize
1.9MB

MD5
eddbad54c9fe01d1e36dcde714ed000f

SHA1
c6903a8554fa53ac3a32177644f4f11636fa3764

SHA256
3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2

SHA512
aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6

Download Submit
\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_temp.dll

Filesize
1.9MB

MD5
eddbad54c9fe01d1e36dcde714ed000f

SHA1
c6903a8554fa53ac3a32177644f4f11636fa3764

SHA256
3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2

SHA512
aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6

Download Submit
\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe

Filesize
2.6MB

MD5
41bb6a1e453341966c2d0ce8c2108e65

SHA1
ed507e400476ff7b5f4747fa67cefc40f651d2f8

SHA256
cad4bf4a6a75ba693cb10ccc4c514fbaa737abd02bc429082dc4bd0beaa974b8

SHA512
192f6da85b15411688119799b65f7a13ae4da4cfc8ff9b07f0d5f48121f5bac63c09976216f5910bafc90650f29951c5f020e7bb7e79e32288fcf2576b6800bc

Download Submit
\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe

Filesize
2.6MB

MD5
41bb6a1e453341966c2d0ce8c2108e65

SHA1
ed507e400476ff7b5f4747fa67cefc40f651d2f8

SHA256
cad4bf4a6a75ba693cb10ccc4c514fbaa737abd02bc429082dc4bd0beaa974b8

SHA512
192f6da85b15411688119799b65f7a13ae4da4cfc8ff9b07f0d5f48121f5bac63c09976216f5910bafc90650f29951c5f020e7bb7e79e32288fcf2576b6800bc

Download Submit
\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe

Filesize
2.6MB

MD5
41bb6a1e453341966c2d0ce8c2108e65

SHA1
ed507e400476ff7b5f4747fa67cefc40f651d2f8

SHA256
cad4bf4a6a75ba693cb10ccc4c514fbaa737abd02bc429082dc4bd0beaa974b8

SHA512
192f6da85b15411688119799b65f7a13ae4da4cfc8ff9b07f0d5f48121f5bac63c09976216f5910bafc90650f29951c5f020e7bb7e79e32288fcf2576b6800bc

Download Submit
memory/1300-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download