Overview
overview
8Static
static
Process La...er.exe
windows7-x64
1Process La...er.exe
windows10-2004-x64
1Process La...ts.exe
windows7-x64
1Process La...ts.exe
windows10-2004-x64
1Process La...er.exe
windows7-x64
1Process La...er.exe
windows10-2004-x64
1Process La...er.exe
windows7-x64
1Process La...er.exe
windows10-2004-x64
1Process La...or.exe
windows7-x64
1Process La...or.exe
windows10-2004-x64
1Process La...so.exe
windows7-x64
3Process La...so.exe
windows10-2004-x64
3Process La...er.exe
windows7-x64
3Process La...er.exe
windows10-2004-x64
7Process La...de.exe
windows7-x64
8Process La...de.exe
windows10-2004-x64
8Process La...er.exe
windows7-x64
1Process La...er.exe
windows10-2004-x64
1Process La...er.exe
windows7-x64
1Process La...er.exe
windows10-2004-x64
1Process La...ms.exe
windows7-x64
1Process La...ms.exe
windows10-2004-x64
1Process La...nt.exe
windows7-x64
1Process La...nt.exe
windows10-2004-x64
1Process La...pl.cmd
windows7-x64
8Process La...pl.cmd
windows10-2004-x64
8Process La...an.dll
windows7-x64
1Process La...an.dll
windows10-2004-x64
1Process La...se.dll
windows7-x64
1Process La...se.dll
windows10-2004-x64
1Process La...al.dll
windows7-x64
1Process La...al.dll
windows10-2004-x64
1Analysis
- max time kernel
221s - max time network
221s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
14/10/2022, 14:47
Static task
static1
Behavioral task
behavioral1
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/CPUEater.exe
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/CPUEater.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/Insights.exe
Resource
win7-20220812-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/Insights.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/InstallHelper.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/InstallHelper.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/LogViewer.exe
Resource
win7-20220812-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/LogViewer.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ProcessGovernor.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ProcessGovernor.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ProcessLasso.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral12
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ProcessLasso.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral13
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ProcessLassoLauncher.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral14
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ProcessLassoLauncher.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral15
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/QuickUpgrade.exe
Resource
win7-20220901-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral16
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/QuickUpgrade.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral17
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ThreadRacer.exe
Resource
win7-20220812-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ThreadRacer.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/TweakScheduler.exe
Resource
win7-20220812-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/TweakScheduler.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/bitsumms.exe
Resource
win7-20220812-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/bitsumms.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/bitsumsessionagent.exe
Resource
win7-20220812-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/bitsumsessionagent.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl.cmd
Resource
win7-20220901-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral26
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl.cmd
Resource
win10v2004-20220901-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral27
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl_rsrc_bulgarian.dll
Resource
win7-20220901-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl_rsrc_bulgarian.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl_rsrc_chinese.dll
Resource
win7-20220812-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl_rsrc_chinese.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl_rsrc_chinese_traditional.dll
Resource
win7-20220812-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl_rsrc_chinese_traditional.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/QuickUpgrade.exe
- Size 417KB
- Sample221014-r5vm5sdfe7
- SHA256 065a173c0b589faf2189310a5aea41350209c21e70082994880ccc8542e0fc37
- MD5 3ade6ce6f8f78069dc7ff87479dfe053
- SHA1 bfa609cdb358ff06c3cf52bcb315d9897c207a63
- SHA512 f640cbdeac6f369f855d1f937983487a20b7aa3af39305f658da2bf73a59d8c4856ac9e8645d74ad146c3b144ecf1b29a1cee1924a295809af4461e5947c2d72
- SSDEEP 6144:cuzwJBLznc3v09ngF+BZxwnrEkvu8Ha7WGmv7/0w2:cvJBP6v09ngFj1utKGm4w2
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file
- Executes dropped EXE 6 IoCs
pid Process 4104 pl4sfx.exe 1120 PostUpdate.exe 2276 bitsumsessionagent.exe 1528 processlasso.exe 2148 bitsumsessionagent.exe 3144 processgovernor.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation QuickUpgrade.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation pl4sfx.exe - Loads dropped DLL 8 IoCs
pid Process 3928 QuickUpgrade.exe 3928 QuickUpgrade.exe 1120 PostUpdate.exe 1120 PostUpdate.exe 1528 processlasso.exe 1528 processlasso.exe 3144 processgovernor.exe 3144 processgovernor.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString processgovernor.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 PostUpdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString PostUpdate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 processlasso.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString processlasso.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 processgovernor.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 QuickUpgrade.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 QuickUpgrade.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 QuickUpgrade.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 QuickUpgrade.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 QuickUpgrade.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 3144 processgovernor.exe 3144 processgovernor.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 3144 processgovernor.exe 3144 processgovernor.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 3144 processgovernor.exe 3144 processgovernor.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 3144 processgovernor.exe 3144 processgovernor.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 3144 processgovernor.exe 3144 processgovernor.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 3144 processgovernor.exe 3144 processgovernor.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 3144 processgovernor.exe 3144 processgovernor.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 3144 processgovernor.exe 3144 processgovernor.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 3144 processgovernor.exe 3144 processgovernor.exe - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1528 processlasso.exe Token: SeDebugPrivilege 1528 processlasso.exe Token: SeChangeNotifyPrivilege 1528 processlasso.exe Token: SeIncBasePriorityPrivilege 1528 processlasso.exe Token: SeIncreaseQuotaPrivilege 1528 processlasso.exe Token: SeCreateGlobalPrivilege 1528 processlasso.exe Token: SeProfSingleProcessPrivilege 1528 processlasso.exe Token: SeBackupPrivilege 1528 processlasso.exe Token: SeRestorePrivilege 1528 processlasso.exe Token: SeAssignPrimaryTokenPrivilege 3144 processgovernor.exe Token: SeDebugPrivilege 3144 processgovernor.exe Token: SeChangeNotifyPrivilege 3144 processgovernor.exe Token: SeIncBasePriorityPrivilege 3144 processgovernor.exe Token: SeIncreaseQuotaPrivilege 3144 processgovernor.exe Token: SeProfSingleProcessPrivilege 3144 processgovernor.exe Token: SeCreateGlobalPrivilege 3144 processgovernor.exe Token: SeBackupPrivilege 3144 processgovernor.exe Token: SeRestorePrivilege 3144 processgovernor.exe - Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe - Suspicious use of SendNotifyMessage 37 IoCs
pid Process 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe 1528 processlasso.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3928 wrote to memory of 2604 3928 QuickUpgrade.exe 79 PID 3928 wrote to memory of 2604 3928 QuickUpgrade.exe 79 PID 3928 wrote to memory of 2604 3928 QuickUpgrade.exe 79 PID 3928 wrote to memory of 4104 3928 QuickUpgrade.exe 86 PID 3928 wrote to memory of 4104 3928 QuickUpgrade.exe 86 PID 3928 wrote to memory of 4104 3928 QuickUpgrade.exe 86 PID 4104 wrote to memory of 1120 4104 pl4sfx.exe 88 PID 4104 wrote to memory of 1120 4104 pl4sfx.exe 88 PID 4104 wrote to memory of 1120 4104 pl4sfx.exe 88 PID 1120 wrote to memory of 1528 1120 PostUpdate.exe 91 PID 1120 wrote to memory of 1528 1120 PostUpdate.exe 91 PID 1120 wrote to memory of 1528 1120 PostUpdate.exe 91 PID 1528 wrote to memory of 3144 1528 processlasso.exe 93 PID 1528 wrote to memory of 3144 1528 processlasso.exe 93 PID 1528 wrote to memory of 3144 1528 processlasso.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\QuickUpgrade.exe"C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\QuickUpgrade.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumms.exe"C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumms.exe" /name:ProcessGovernor /stop2⤵PID:2604
-
-
C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe"C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\PostUpdate.exe"C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\PostUpdate.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\processlasso.exe/postupdate4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\processgovernor.exe"C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\processgovernor.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3144
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe"C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe" ----------------------------------------------------------------1⤵
- Executes dropped EXE
PID:2276
-
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe"C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe" ----------------------------------------------------------------1⤵
- Executes dropped EXE
PID:2148
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\ProcessLasso\config\prolasso.ini
- Size 7KB
- SHA256 cc92b1ffc62962e1e8267a47df08f5817df148be90a20e984e87ccabf67b2ca9
- MD5 736f41d2f35e6848cec5f81a083c32cf
- SHA1 de983b61b0e002f0ae3d7a1e0fd1e7d66e287b15
- SHA512 fd7ea4b7fd497d3052521bb20b92aed29c1317a33119f56627d37d3d29b9c016a66794893db22fe8952568dd98d58306734e5e03ccb5e88186d505b4098f2c92
- SSDEEP 192:tCFchoD6xeEh7Ja5m+zam8ZrWYF/CZiONkM6HiaE9xum:tEchoD7C7Upzam8ZrWYF/KiONkM6HfEd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\ProcessLasso\config\prolasso.ini
- Size 7KB
- SHA256 cc92b1ffc62962e1e8267a47df08f5817df148be90a20e984e87ccabf67b2ca9
- MD5 736f41d2f35e6848cec5f81a083c32cf
- SHA1 de983b61b0e002f0ae3d7a1e0fd1e7d66e287b15
- SHA512 fd7ea4b7fd497d3052521bb20b92aed29c1317a33119f56627d37d3d29b9c016a66794893db22fe8952568dd98d58306734e5e03ccb5e88186d505b4098f2c92
- SSDEEP 192:tCFchoD6xeEh7Ja5m+zam8ZrWYF/CZiONkM6HiaE9xum:tEchoD7C7Upzam8ZrWYF/KiONkM6HfEd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\ProcessLasso\logs\processlasso.log
- Size 1KB
- SHA256 03098a60e8415bdbacb079be3e9ce4cc73de20697162bee681056e849d3172ab
- MD5 cf98b79ca24a88e0297a0356c191f289
- SHA1 1b303073442d07acc846fd8f5611400351fb1902
- SHA512 5a9d70b21296b40b8da6a82e07321180f182e89720113d71565e0ae98a0b86c594e45d641e13928f8115048e3cccd96ec2363bad9a30f83c05bfbc7889866ed0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\PostUpdate.exe
- Size 614KB
- SHA256 f02d52565f06f592104062b0b9e8e86978709a1404a427546331e4bc108175a1
- MD5 851b8131952c99028b9213fa92dabca7
- SHA1 aa5c44bcb5da1e8379e75f434a1e9553df46607a
- SHA512 89b9a2bb99775f5d6d67c14e46391599e512a1dec34615855ed53d2e5e542c5d340206ae8f41eaefd6896fbb722b5f497075bf3cecf3d0a94f61279a1f645003
- SSDEEP 12288:bqUe7KyBXPzwaYhAAa4lAaLGKG331M0Km:bYXPEtiS/Q3ltKm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\PostUpdate.exe
- Size 614KB
- SHA256 f02d52565f06f592104062b0b9e8e86978709a1404a427546331e4bc108175a1
- MD5 851b8131952c99028b9213fa92dabca7
- SHA1 aa5c44bcb5da1e8379e75f434a1e9553df46607a
- SHA512 89b9a2bb99775f5d6d67c14e46391599e512a1dec34615855ed53d2e5e542c5d340206ae8f41eaefd6896fbb722b5f497075bf3cecf3d0a94f61279a1f645003
- SSDEEP 12288:bqUe7KyBXPzwaYhAAa4lAaLGKG331M0Km:bYXPEtiS/Q3ltKm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessGovernor.exe
- Size 1.1MB
- SHA256 a292bdf7caaaec6ba91380fb3b6b27d7a9e110b827159dabd4d9d431f652d228
- MD5 ff4c384a4b66fa0536eb8d0e73c59ed8
- SHA1 6ec79d3d6025602bb7173c771e333c602fb8aff0
- SHA512 967a11e5d15186fd0849b4cae59abcce3672169968dd4f2572c518f74cf56da2494824746716d639cc61a9159de6e9f921895c92f9267f103b3945c7253a77fc
- SSDEEP 24576:ujJncDKbHpgrVg0cJnsG7ULDCnDqjDqifGc7MTfGRt4:6bbHp8+JsG7ULDEDqKifGmMDGRm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessLasso.exe
- Size 1.5MB
- SHA256 eb36e1727bc767f3981abb103d7e0b0237e02f2ebaab18eff4858f29337b430f
- MD5 ac52b39bfb26b97a956c9910ebcf9917
- SHA1 079b23a8cd7dae505f50d2c03a27e885cc6fd841
- SHA512 a729fe3be9fb2d00cca0876695776ac394fd9153d31451b9fe40c749dc84c1150775fd3d9ed40c6f978233a8caaa15c4f4770c904d8cf7acd67a3fa869dbb775
- SSDEEP 49152:XXS5A4iJaoc2KMphMB1avC1r6wo2tAAWUc0g1D:nS5A4Yc2KMVC1r612ty
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\QuickUpgrade.exe.Replacement
- Size 417KB
- SHA256 065a173c0b589faf2189310a5aea41350209c21e70082994880ccc8542e0fc37
- MD5 3ade6ce6f8f78069dc7ff87479dfe053
- SHA1 bfa609cdb358ff06c3cf52bcb315d9897c207a63
- SHA512 f640cbdeac6f369f855d1f937983487a20b7aa3af39305f658da2bf73a59d8c4856ac9e8645d74ad146c3b144ecf1b29a1cee1924a295809af4461e5947c2d72
- SSDEEP 6144:cuzwJBLznc3v09ngF+BZxwnrEkvu8Ha7WGmv7/0w2:cvJBP6v09ngFj1utKGm4w2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe
- Size 142KB
- SHA256 d0e08bd4148e71c6baf63c64fdddc30372f2c7c5f5e50b71c6b868a3df865165
- MD5 41314fe5516cdd22f6bfc16e9bdd8590
- SHA1 74b976ef91e7fa854facaebc40a502470f052b1b
- SHA512 02787d60703954b0f7d8f48086af881f3ee2536a3b42e63491a38f1b0eab1d09415abefdd244f9ce944dadd827f862e69c321c48c29c0593e516c4ac02f87be8
- SSDEEP 3072:5gqXWg0wfwWkcfKQK52uFZ0iNKhPq2HzvjmY4Oix7O:5gmW9wvkUuD0igbCbO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe
- Size 142KB
- SHA256 d0e08bd4148e71c6baf63c64fdddc30372f2c7c5f5e50b71c6b868a3df865165
- MD5 41314fe5516cdd22f6bfc16e9bdd8590
- SHA1 74b976ef91e7fa854facaebc40a502470f052b1b
- SHA512 02787d60703954b0f7d8f48086af881f3ee2536a3b42e63491a38f1b0eab1d09415abefdd244f9ce944dadd827f862e69c321c48c29c0593e516c4ac02f87be8
- SSDEEP 3072:5gqXWg0wfwWkcfKQK52uFZ0iNKhPq2HzvjmY4Oix7O:5gmW9wvkUuD0igbCbO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe
- Size 142KB
- SHA256 d0e08bd4148e71c6baf63c64fdddc30372f2c7c5f5e50b71c6b868a3df865165
- MD5 41314fe5516cdd22f6bfc16e9bdd8590
- SHA1 74b976ef91e7fa854facaebc40a502470f052b1b
- SHA512 02787d60703954b0f7d8f48086af881f3ee2536a3b42e63491a38f1b0eab1d09415abefdd244f9ce944dadd827f862e69c321c48c29c0593e516c4ac02f87be8
- SSDEEP 3072:5gqXWg0wfwWkcfKQK52uFZ0iNKhPq2HzvjmY4Oix7O:5gmW9wvkUuD0igbCbO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_english.dll
- Size 1.9MB
- SHA256 3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2
- MD5 eddbad54c9fe01d1e36dcde714ed000f
- SHA1 c6903a8554fa53ac3a32177644f4f11636fa3764
- SHA512 aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6
- SSDEEP 6144:tfFa9MmhuV2FFdq7qFrwnim0gsZEeV3dngUGBajFC8fB4adLxp7WGCNE/Jt1icNR:tfcH9iBgFzLXKGh4ZJe6cwTqREewyce
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_english.dll
- Size 1.9MB
- SHA256 3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2
- MD5 eddbad54c9fe01d1e36dcde714ed000f
- SHA1 c6903a8554fa53ac3a32177644f4f11636fa3764
- SHA512 aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6
- SSDEEP 6144:tfFa9MmhuV2FFdq7qFrwnim0gsZEeV3dngUGBajFC8fB4adLxp7WGCNE/Jt1icNR:tfcH9iBgFzLXKGh4ZJe6cwTqREewyce
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_english.dll
- Size 1.9MB
- SHA256 3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2
- MD5 eddbad54c9fe01d1e36dcde714ed000f
- SHA1 c6903a8554fa53ac3a32177644f4f11636fa3764
- SHA512 aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6
- SSDEEP 6144:tfFa9MmhuV2FFdq7qFrwnim0gsZEeV3dngUGBajFC8fB4adLxp7WGCNE/Jt1icNR:tfcH9iBgFzLXKGh4ZJe6cwTqREewyce
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_english.dll
- Size 1.9MB
- SHA256 3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2
- MD5 eddbad54c9fe01d1e36dcde714ed000f
- SHA1 c6903a8554fa53ac3a32177644f4f11636fa3764
- SHA512 aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6
- SSDEEP 6144:tfFa9MmhuV2FFdq7qFrwnim0gsZEeV3dngUGBajFC8fB4adLxp7WGCNE/Jt1icNR:tfcH9iBgFzLXKGh4ZJe6cwTqREewyce
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_english.dll
- Size 1.9MB
- SHA256 3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2
- MD5 eddbad54c9fe01d1e36dcde714ed000f
- SHA1 c6903a8554fa53ac3a32177644f4f11636fa3764
- SHA512 aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6
- SSDEEP 6144:tfFa9MmhuV2FFdq7qFrwnim0gsZEeV3dngUGBajFC8fB4adLxp7WGCNE/Jt1icNR:tfcH9iBgFzLXKGh4ZJe6cwTqREewyce
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_english.dll
- Size 1.9MB
- SHA256 3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2
- MD5 eddbad54c9fe01d1e36dcde714ed000f
- SHA1 c6903a8554fa53ac3a32177644f4f11636fa3764
- SHA512 aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6
- SSDEEP 6144:tfFa9MmhuV2FFdq7qFrwnim0gsZEeV3dngUGBajFC8fB4adLxp7WGCNE/Jt1icNR:tfcH9iBgFzLXKGh4ZJe6cwTqREewyce
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_english.dll
- Size 1.9MB
- SHA256 3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2
- MD5 eddbad54c9fe01d1e36dcde714ed000f
- SHA1 c6903a8554fa53ac3a32177644f4f11636fa3764
- SHA512 aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6
- SSDEEP 6144:tfFa9MmhuV2FFdq7qFrwnim0gsZEeV3dngUGBajFC8fB4adLxp7WGCNE/Jt1icNR:tfcH9iBgFzLXKGh4ZJe6cwTqREewyce
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_temp.dll
- Size 1.9MB
- SHA256 3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2
- MD5 eddbad54c9fe01d1e36dcde714ed000f
- SHA1 c6903a8554fa53ac3a32177644f4f11636fa3764
- SHA512 aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6
- SSDEEP 6144:tfFa9MmhuV2FFdq7qFrwnim0gsZEeV3dngUGBajFC8fB4adLxp7WGCNE/Jt1icNR:tfcH9iBgFzLXKGh4ZJe6cwTqREewyce
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_temp.dll
- Size 1.9MB
- SHA256 3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2
- MD5 eddbad54c9fe01d1e36dcde714ed000f
- SHA1 c6903a8554fa53ac3a32177644f4f11636fa3764
- SHA512 aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6
- SSDEEP 6144:tfFa9MmhuV2FFdq7qFrwnim0gsZEeV3dngUGBajFC8fB4adLxp7WGCNE/Jt1icNR:tfcH9iBgFzLXKGh4ZJe6cwTqREewyce
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\processgovernor.exe
- Size 1.1MB
- SHA256 a292bdf7caaaec6ba91380fb3b6b27d7a9e110b827159dabd4d9d431f652d228
- MD5 ff4c384a4b66fa0536eb8d0e73c59ed8
- SHA1 6ec79d3d6025602bb7173c771e333c602fb8aff0
- SHA512 967a11e5d15186fd0849b4cae59abcce3672169968dd4f2572c518f74cf56da2494824746716d639cc61a9159de6e9f921895c92f9267f103b3945c7253a77fc
- SSDEEP 24576:ujJncDKbHpgrVg0cJnsG7ULDCnDqjDqifGc7MTfGRt4:6bbHp8+JsG7ULDEDqKifGmMDGRm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\processlasso.exe
- Size 1.5MB
- SHA256 eb36e1727bc767f3981abb103d7e0b0237e02f2ebaab18eff4858f29337b430f
- MD5 ac52b39bfb26b97a956c9910ebcf9917
- SHA1 079b23a8cd7dae505f50d2c03a27e885cc6fd841
- SHA512 a729fe3be9fb2d00cca0876695776ac394fd9153d31451b9fe40c749dc84c1150775fd3d9ed40c6f978233a8caaa15c4f4770c904d8cf7acd67a3fa869dbb775
- SSDEEP 49152:XXS5A4iJaoc2KMphMB1avC1r6wo2tAAWUc0g1D:nS5A4Yc2KMVC1r612ty
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe
- Size 2.6MB
- SHA256 cad4bf4a6a75ba693cb10ccc4c514fbaa737abd02bc429082dc4bd0beaa974b8
- MD5 41bb6a1e453341966c2d0ce8c2108e65
- SHA1 ed507e400476ff7b5f4747fa67cefc40f651d2f8
- SHA512 192f6da85b15411688119799b65f7a13ae4da4cfc8ff9b07f0d5f48121f5bac63c09976216f5910bafc90650f29951c5f020e7bb7e79e32288fcf2576b6800bc
- SSDEEP 49152:jBJGzypOCPuGhkuKOKZcfZ8JIYb5PbaOV4JBOokp0pWvjVBOTdoDp7z2Y4:dkGfTKZcfyJI0PLOzmsWb3DYY4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe
- Size 2.6MB
- SHA256 cad4bf4a6a75ba693cb10ccc4c514fbaa737abd02bc429082dc4bd0beaa974b8
- MD5 41bb6a1e453341966c2d0ce8c2108e65
- SHA1 ed507e400476ff7b5f4747fa67cefc40f651d2f8
- SHA512 192f6da85b15411688119799b65f7a13ae4da4cfc8ff9b07f0d5f48121f5bac63c09976216f5910bafc90650f29951c5f020e7bb7e79e32288fcf2576b6800bc
- SSDEEP 49152:jBJGzypOCPuGhkuKOKZcfZ8JIYb5PbaOV4JBOokp0pWvjVBOTdoDp7z2Y4:dkGfTKZcfyJI0PLOzmsWb3DYY4
- MD5 SHA1 SHA512 SSDEEP