Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10-04-2024 16:29
General
-
Target
ProcessLassoLauncher.exe
-
Size
400KB
-
MD5
f973441b81d5b645db790713ef82c2d9
-
SHA1
287d2785e17728b145ee16b1518498bb1479df71
-
SHA256
5fb894a3522b7ffc90bdb08e87bcd332b0bbf14bdf4590484001478b18ca56e4
-
SHA512
3a7746b4ed9cb4a9edc41aee9d4829b4789b368999a510f60c27fd3e33c0d47f512214673e69de758e028c4701a3c4508938d1c05ceae027e87cd214b8a67a1f
-
SSDEEP
3072:UVPAgBPrsmf3c4sSxGtHrxHb81dVEI7LRbc7Vu1LIk7HoZ7WK7TVrb:WHhrsmf3c2x8Ht8fVwk1k7WG9
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ProcessLassoLauncher.exe"C:\Users\Admin\AppData\Local\Temp\ProcessLassoLauncher.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ProcessLasso.exe"C:\Users\Admin\AppData\Local\Temp\ProcessLasso.exe" "C:\Users\Admin\AppData\Local\Temp\ProcessLassoLauncher.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-