Analysis
-
max time kernel
150s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
14-10-2022 14:47
General
-
Target
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/InstallHelper.exe
-
Size
697KB
-
MD5
f29187eecb19515e9a82fc203389f436
-
SHA1
8bede32673085b137ecdc744b9858d5dcbe4ad38
-
SHA256
d38fd2b5dca9e3a17bd00074a0e3469e8e15f9d75871e002542b98a41833ed95
-
SHA512
252d835067511d395fa3e306be3b4cce023a4098c64ebd0b075ca0702eb5c2352fcbdd1bc5d4f4e7df59502a9f7b3837feb7479bc54f48ac0554933856fa1aaa
-
SSDEEP
12288:FDmlU/eF6rzs4ccQE5QcAESAQ2Vq7f2fDIGuiDHC67uHLSQSzBBB0UFjeqdtBacu:Nmk3dtBacj6GkSAV4lCZGo
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\InstallHelper.exe"C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\InstallHelper.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken