0df79ebcde62d0bd90cc22aacd642fef46c183fefae28de4a9e3a1c969b89c18

Analysis

max time kernel
221s
max time network
221s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/QuickUpgrade.exe
Size

417KB
MD5

3ade6ce6f8f78069dc7ff87479dfe053
SHA1

bfa609cdb358ff06c3cf52bcb315d9897c207a63
SHA256

065a173c0b589faf2189310a5aea41350209c21e70082994880ccc8542e0fc37
SHA512

f640cbdeac6f369f855d1f937983487a20b7aa3af39305f658da2bf73a59d8c4856ac9e8645d74ad146c3b144ecf1b29a1cee1924a295809af4461e5947c2d72
SSDEEP

6144:cuzwJBLznc3v09ngF+BZxwnrEkvu8Ha7WGmv7/0w2:cvJBP6v09ngFj1utKGm4w2

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
4104	pl4sfx.exe
1120	PostUpdate.exe
2276	bitsumsessionagent.exe
1528	processlasso.exe
2148	bitsumsessionagent.exe
3144	processgovernor.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	QuickUpgrade.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	pl4sfx.exe

Loads dropped DLL 8 IoCs

pid	Process
3928	QuickUpgrade.exe
3928	QuickUpgrade.exe
1120	PostUpdate.exe
1120	PostUpdate.exe
1528	processlasso.exe
1528	processlasso.exe
3144	processgovernor.exe
3144	processgovernor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	processgovernor.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	PostUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	PostUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	processlasso.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	processlasso.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	processgovernor.exe

Modifies system certificate store 2 TTPs 5 IoCs

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	QuickUpgrade.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	QuickUpgrade.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	QuickUpgrade.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	QuickUpgrade.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	QuickUpgrade.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
3144	processgovernor.exe
3144	processgovernor.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
3144	processgovernor.exe
3144	processgovernor.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
3144	processgovernor.exe
3144	processgovernor.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
3144	processgovernor.exe
3144	processgovernor.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
3144	processgovernor.exe
3144	processgovernor.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
3144	processgovernor.exe
3144	processgovernor.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
3144	processgovernor.exe
3144	processgovernor.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
3144	processgovernor.exe
3144	processgovernor.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
3144	processgovernor.exe
3144	processgovernor.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	1528	processlasso.exe
Token: SeDebugPrivilege	1528	processlasso.exe
Token: SeChangeNotifyPrivilege	1528	processlasso.exe
Token: SeIncBasePriorityPrivilege	1528	processlasso.exe
Token: SeIncreaseQuotaPrivilege	1528	processlasso.exe
Token: SeCreateGlobalPrivilege	1528	processlasso.exe
Token: SeProfSingleProcessPrivilege	1528	processlasso.exe
Token: SeBackupPrivilege	1528	processlasso.exe
Token: SeRestorePrivilege	1528	processlasso.exe
Token: SeAssignPrimaryTokenPrivilege	3144	processgovernor.exe
Token: SeDebugPrivilege	3144	processgovernor.exe
Token: SeChangeNotifyPrivilege	3144	processgovernor.exe
Token: SeIncBasePriorityPrivilege	3144	processgovernor.exe
Token: SeIncreaseQuotaPrivilege	3144	processgovernor.exe
Token: SeProfSingleProcessPrivilege	3144	processgovernor.exe
Token: SeCreateGlobalPrivilege	3144	processgovernor.exe
Token: SeBackupPrivilege	3144	processgovernor.exe
Token: SeRestorePrivilege	3144	processgovernor.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe

Suspicious use of SendNotifyMessage 37 IoCs

pid	Process
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe
1528	processlasso.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 2604	3928	QuickUpgrade.exe	79
PID 3928 wrote to memory of 2604	3928	QuickUpgrade.exe	79
PID 3928 wrote to memory of 2604	3928	QuickUpgrade.exe	79
PID 3928 wrote to memory of 4104	3928	QuickUpgrade.exe	86
PID 3928 wrote to memory of 4104	3928	QuickUpgrade.exe	86
PID 3928 wrote to memory of 4104	3928	QuickUpgrade.exe	86
PID 4104 wrote to memory of 1120	4104	pl4sfx.exe	88
PID 4104 wrote to memory of 1120	4104	pl4sfx.exe	88
PID 4104 wrote to memory of 1120	4104	pl4sfx.exe	88
PID 1120 wrote to memory of 1528	1120	PostUpdate.exe	91
PID 1120 wrote to memory of 1528	1120	PostUpdate.exe	91
PID 1120 wrote to memory of 1528	1120	PostUpdate.exe	91
PID 1528 wrote to memory of 3144	1528	processlasso.exe	93
PID 1528 wrote to memory of 3144	1528	processlasso.exe	93
PID 1528 wrote to memory of 3144	1528	processlasso.exe	93

C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\QuickUpgrade.exe
"C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\QuickUpgrade.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumms.exe
  "C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumms.exe" /name:ProcessGovernor /stop
  2⤵
  PID:2604
- C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe
  "C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\PostUpdate.exe
    "C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\PostUpdate.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\processlasso.exe
      /postupdate
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\processgovernor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\processgovernor.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3144

C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe
"C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe" ----------------------------------------------------------------
1⤵
- Executes dropped EXE
PID:2276

C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe
"C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe" ----------------------------------------------------------------
1⤵
- Executes dropped EXE
PID:2148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ProcessLasso\config\prolasso.ini

Filesize
7KB

MD5
736f41d2f35e6848cec5f81a083c32cf

SHA1
de983b61b0e002f0ae3d7a1e0fd1e7d66e287b15

SHA256
cc92b1ffc62962e1e8267a47df08f5817df148be90a20e984e87ccabf67b2ca9

SHA512
fd7ea4b7fd497d3052521bb20b92aed29c1317a33119f56627d37d3d29b9c016a66794893db22fe8952568dd98d58306734e5e03ccb5e88186d505b4098f2c92

Download Submit
C:\Users\Admin\AppData\Local\ProcessLasso\config\prolasso.ini

Filesize
7KB

MD5
736f41d2f35e6848cec5f81a083c32cf

SHA1
de983b61b0e002f0ae3d7a1e0fd1e7d66e287b15

SHA256
cc92b1ffc62962e1e8267a47df08f5817df148be90a20e984e87ccabf67b2ca9

SHA512
fd7ea4b7fd497d3052521bb20b92aed29c1317a33119f56627d37d3d29b9c016a66794893db22fe8952568dd98d58306734e5e03ccb5e88186d505b4098f2c92

Download Submit
C:\Users\Admin\AppData\Local\ProcessLasso\logs\processlasso.log

Filesize
1KB

MD5
cf98b79ca24a88e0297a0356c191f289

SHA1
1b303073442d07acc846fd8f5611400351fb1902

SHA256
03098a60e8415bdbacb079be3e9ce4cc73de20697162bee681056e849d3172ab

SHA512
5a9d70b21296b40b8da6a82e07321180f182e89720113d71565e0ae98a0b86c594e45d641e13928f8115048e3cccd96ec2363bad9a30f83c05bfbc7889866ed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\PostUpdate.exe

Filesize
614KB

MD5
851b8131952c99028b9213fa92dabca7

SHA1
aa5c44bcb5da1e8379e75f434a1e9553df46607a

SHA256
f02d52565f06f592104062b0b9e8e86978709a1404a427546331e4bc108175a1

SHA512
89b9a2bb99775f5d6d67c14e46391599e512a1dec34615855ed53d2e5e542c5d340206ae8f41eaefd6896fbb722b5f497075bf3cecf3d0a94f61279a1f645003

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\PostUpdate.exe

Filesize
614KB

MD5
851b8131952c99028b9213fa92dabca7

SHA1
aa5c44bcb5da1e8379e75f434a1e9553df46607a

SHA256
f02d52565f06f592104062b0b9e8e86978709a1404a427546331e4bc108175a1

SHA512
89b9a2bb99775f5d6d67c14e46391599e512a1dec34615855ed53d2e5e542c5d340206ae8f41eaefd6896fbb722b5f497075bf3cecf3d0a94f61279a1f645003

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessGovernor.exe

Filesize
1.1MB

MD5
ff4c384a4b66fa0536eb8d0e73c59ed8

SHA1
6ec79d3d6025602bb7173c771e333c602fb8aff0

SHA256
a292bdf7caaaec6ba91380fb3b6b27d7a9e110b827159dabd4d9d431f652d228

SHA512
967a11e5d15186fd0849b4cae59abcce3672169968dd4f2572c518f74cf56da2494824746716d639cc61a9159de6e9f921895c92f9267f103b3945c7253a77fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessLasso.exe

Filesize
1.5MB

MD5
ac52b39bfb26b97a956c9910ebcf9917

SHA1
079b23a8cd7dae505f50d2c03a27e885cc6fd841

SHA256
eb36e1727bc767f3981abb103d7e0b0237e02f2ebaab18eff4858f29337b430f

SHA512
a729fe3be9fb2d00cca0876695776ac394fd9153d31451b9fe40c749dc84c1150775fd3d9ed40c6f978233a8caaa15c4f4770c904d8cf7acd67a3fa869dbb775

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\QuickUpgrade.exe.Replacement

Filesize
417KB

MD5
3ade6ce6f8f78069dc7ff87479dfe053

SHA1
bfa609cdb358ff06c3cf52bcb315d9897c207a63

SHA256
065a173c0b589faf2189310a5aea41350209c21e70082994880ccc8542e0fc37

SHA512
f640cbdeac6f369f855d1f937983487a20b7aa3af39305f658da2bf73a59d8c4856ac9e8645d74ad146c3b144ecf1b29a1cee1924a295809af4461e5947c2d72

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe

Filesize
142KB

MD5
41314fe5516cdd22f6bfc16e9bdd8590

SHA1
74b976ef91e7fa854facaebc40a502470f052b1b

SHA256
d0e08bd4148e71c6baf63c64fdddc30372f2c7c5f5e50b71c6b868a3df865165

SHA512
02787d60703954b0f7d8f48086af881f3ee2536a3b42e63491a38f1b0eab1d09415abefdd244f9ce944dadd827f862e69c321c48c29c0593e516c4ac02f87be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe

Filesize
142KB

MD5
41314fe5516cdd22f6bfc16e9bdd8590

SHA1
74b976ef91e7fa854facaebc40a502470f052b1b

SHA256
d0e08bd4148e71c6baf63c64fdddc30372f2c7c5f5e50b71c6b868a3df865165

SHA512
02787d60703954b0f7d8f48086af881f3ee2536a3b42e63491a38f1b0eab1d09415abefdd244f9ce944dadd827f862e69c321c48c29c0593e516c4ac02f87be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumsessionagent.exe

Filesize
142KB

MD5
41314fe5516cdd22f6bfc16e9bdd8590

SHA1
74b976ef91e7fa854facaebc40a502470f052b1b

SHA256
d0e08bd4148e71c6baf63c64fdddc30372f2c7c5f5e50b71c6b868a3df865165

SHA512
02787d60703954b0f7d8f48086af881f3ee2536a3b42e63491a38f1b0eab1d09415abefdd244f9ce944dadd827f862e69c321c48c29c0593e516c4ac02f87be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_english.dll

Filesize
1.9MB

MD5
eddbad54c9fe01d1e36dcde714ed000f

SHA1
c6903a8554fa53ac3a32177644f4f11636fa3764

SHA256
3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2

SHA512
aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_english.dll

Filesize
1.9MB

MD5
eddbad54c9fe01d1e36dcde714ed000f

SHA1
c6903a8554fa53ac3a32177644f4f11636fa3764

SHA256
3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2

SHA512
aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_english.dll

Filesize
1.9MB

MD5
eddbad54c9fe01d1e36dcde714ed000f

SHA1
c6903a8554fa53ac3a32177644f4f11636fa3764

SHA256
3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2

SHA512
aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_english.dll

Filesize
1.9MB

MD5
eddbad54c9fe01d1e36dcde714ed000f

SHA1
c6903a8554fa53ac3a32177644f4f11636fa3764

SHA256
3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2

SHA512
aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_english.dll

Filesize
1.9MB

MD5
eddbad54c9fe01d1e36dcde714ed000f

SHA1
c6903a8554fa53ac3a32177644f4f11636fa3764

SHA256
3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2

SHA512
aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_english.dll

Filesize
1.9MB

MD5
eddbad54c9fe01d1e36dcde714ed000f

SHA1
c6903a8554fa53ac3a32177644f4f11636fa3764

SHA256
3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2

SHA512
aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_english.dll

Filesize
1.9MB

MD5
eddbad54c9fe01d1e36dcde714ed000f

SHA1
c6903a8554fa53ac3a32177644f4f11636fa3764

SHA256
3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2

SHA512
aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_temp.dll

Filesize
1.9MB

MD5
eddbad54c9fe01d1e36dcde714ed000f

SHA1
c6903a8554fa53ac3a32177644f4f11636fa3764

SHA256
3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2

SHA512
aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl_rsrc_temp.dll

Filesize
1.9MB

MD5
eddbad54c9fe01d1e36dcde714ed000f

SHA1
c6903a8554fa53ac3a32177644f4f11636fa3764

SHA256
3d1d3c2754d05573e81247c62a29c01bdadc72d7da2a665d823c93d752a727e2

SHA512
aaab6c7c334a7c0a4af18088dc0a5eeaedf7f5d38100b2fc1d5518468a66a345bf71b0310ef40eda5ee9d9cfd656a46983ed07d2743644d41fad737e9faf06e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\processgovernor.exe

Filesize
1.1MB

MD5
ff4c384a4b66fa0536eb8d0e73c59ed8

SHA1
6ec79d3d6025602bb7173c771e333c602fb8aff0

SHA256
a292bdf7caaaec6ba91380fb3b6b27d7a9e110b827159dabd4d9d431f652d228

SHA512
967a11e5d15186fd0849b4cae59abcce3672169968dd4f2572c518f74cf56da2494824746716d639cc61a9159de6e9f921895c92f9267f103b3945c7253a77fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\processlasso.exe

Filesize
1.5MB

MD5
ac52b39bfb26b97a956c9910ebcf9917

SHA1
079b23a8cd7dae505f50d2c03a27e885cc6fd841

SHA256
eb36e1727bc767f3981abb103d7e0b0237e02f2ebaab18eff4858f29337b430f

SHA512
a729fe3be9fb2d00cca0876695776ac394fd9153d31451b9fe40c749dc84c1150775fd3d9ed40c6f978233a8caaa15c4f4770c904d8cf7acd67a3fa869dbb775

Download Submit
C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe

Filesize
2.6MB

MD5
41bb6a1e453341966c2d0ce8c2108e65

SHA1
ed507e400476ff7b5f4747fa67cefc40f651d2f8

SHA256
cad4bf4a6a75ba693cb10ccc4c514fbaa737abd02bc429082dc4bd0beaa974b8

SHA512
192f6da85b15411688119799b65f7a13ae4da4cfc8ff9b07f0d5f48121f5bac63c09976216f5910bafc90650f29951c5f020e7bb7e79e32288fcf2576b6800bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe

Filesize
2.6MB

MD5
41bb6a1e453341966c2d0ce8c2108e65

SHA1
ed507e400476ff7b5f4747fa67cefc40f651d2f8

SHA256
cad4bf4a6a75ba693cb10ccc4c514fbaa737abd02bc429082dc4bd0beaa974b8

SHA512
192f6da85b15411688119799b65f7a13ae4da4cfc8ff9b07f0d5f48121f5bac63c09976216f5910bafc90650f29951c5f020e7bb7e79e32288fcf2576b6800bc

Download Submit