0df79ebcde62d0bd90cc22aacd642fef46c183fefae28de4a9e3a1c969b89c18

Analysis

max time kernel
150s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 14:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/InstallHelper.exe
Size 697KB
Sample221014-r5vm5sdfe7
SHA256 d38fd2b5dca9e3a17bd00074a0e3469e8e15f9d75871e002542b98a41833ed95
MD5 f29187eecb19515e9a82fc203389f436
SHA1 8bede32673085b137ecdc744b9858d5dcbe4ad38
SHA512 252d835067511d395fa3e306be3b4cce023a4098c64ebd0b075ca0702eb5c2352fcbdd1bc5d4f4e7df59502a9f7b3837feb7479bc54f48ac0554933856fa1aaa
SSDEEP 12288:FDmlU/eF6rzs4ccQE5QcAESAQ2Vq7f2fDIGuiDHC67uHLSQSzBBB0UFjeqdtBacu:Nmk3dtBacj6GkSAV4lCZGo
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InstallHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InstallHelper.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3788	InstallHelper.exe
3788	InstallHelper.exe
3788	InstallHelper.exe
3788	InstallHelper.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	3788	InstallHelper.exe
Token: SeDebugPrivilege	3788	InstallHelper.exe
Token: SeChangeNotifyPrivilege	3788	InstallHelper.exe
Token: SeIncBasePriorityPrivilege	3788	InstallHelper.exe
Token: SeIncreaseQuotaPrivilege	3788	InstallHelper.exe
Token: SeProfSingleProcessPrivilege	3788	InstallHelper.exe

C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\InstallHelper.exe
"C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\InstallHelper.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads