ae0d9681cc81177d2fa976060a38ad7cc819b363da0192bca2620f6f285c47cc | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 09:43

Sharing

Report Analysis Logs

General

Target

_Start-ProcessLasso.bat
Size

119B
MD5

185077d189c98fb446268f11ddd67c80
SHA1

f909667122b3669971b42200673eeea9acc6abae
SHA256

01f21e44dad0a50f44e619c8856596cf09af674a0505012f9ed7f74128b01287
SHA512

18b894d91ede89f554ed6ad521252f44e7dbcbd4db24c7b717e5361f802b43bd5925b7cf1dcd36533da75f8c43b04afc6ac848dae5226e702e8a2e2e51c87904

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

ProcessGovernor.exe

description	pid	process
Token: SeAssignPrimaryTokenPrivilege	2308	ProcessGovernor.exe
Token: SeDebugPrivilege	2308	ProcessGovernor.exe
Token: SeChangeNotifyPrivilege	2308	ProcessGovernor.exe
Token: SeIncBasePriorityPrivilege	2308	ProcessGovernor.exe
Token: SeIncreaseQuotaPrivilege	2308	ProcessGovernor.exe
Token: SeProfSingleProcessPrivilege	2308	ProcessGovernor.exe
Token: SeCreateGlobalPrivilege	2308	ProcessGovernor.exe
Token: SeBackupPrivilege	2308	ProcessGovernor.exe
Token: SeRestorePrivilege	2308	ProcessGovernor.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2348 wrote to memory of 2308	2348	cmd.exe	ProcessGovernor.exe
PID 2348 wrote to memory of 2308	2348	cmd.exe	ProcessGovernor.exe
PID 2348 wrote to memory of 2308	2348	cmd.exe	ProcessGovernor.exe
PID 2348 wrote to memory of 2336	2348	cmd.exe	ProcessLasso.exe
PID 2348 wrote to memory of 2336	2348	cmd.exe	ProcessLasso.exe
PID 2348 wrote to memory of 2336	2348	cmd.exe	ProcessLasso.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\_Start-ProcessLasso.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348

C:\Users\Admin\AppData\Local\Temp\ProcessGovernor.exe
ProcessGovernor.exe "/logfolder=." "/configfolder=."
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2308

C:\Users\Admin\AppData\Local\Temp\ProcessLasso.exe
ProcessLasso.exe "/logfolder=." "/configfolder=."
2⤵
PID:2336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads