49e0b3dd4c0b710ad0574352db2b2c46610bec86a02d9abc3f981d583f3acadf | Triage

Resubmissions

02-06-2024 09:49

240602-ltmv9sad69 3

02-06-2024 09:48

240602-lstx7ahe9v 3

Analysis

max time kernel
91s
max time network
125s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
02-06-2024 09:49

Sharing

Report Analysis Logs

General

Target

processlasso_portable_64/stop-governor.bat
Size

147B
MD5

1a263ccbabef24fd1c38acd624b87364
SHA1

36adffa76fe886c52603b829db479474ac6daf90
SHA256

6955fbc82489a90e8bf1812db7baf52e2bb7b4eb170f50445570aeecef09beb7
SHA512

90fb3d4e006edd3f95d853a466fb41ca7cb1a12270b988102817c3fd8f870024bdd250bb7e5905e0e371c877f2fd45894c104cf39ecc327e07c2ff56bac3744f

Score

1^/10

Malware Config

Signatures

Runs net.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

ProcessGovernor.exe

description	pid	process
Token: SeAssignPrimaryTokenPrivilege	5036	ProcessGovernor.exe
Token: SeDebugPrivilege	5036	ProcessGovernor.exe
Token: SeChangeNotifyPrivilege	5036	ProcessGovernor.exe
Token: SeIncBasePriorityPrivilege	5036	ProcessGovernor.exe
Token: SeIncreaseQuotaPrivilege	5036	ProcessGovernor.exe
Token: SeProfSingleProcessPrivilege	5036	ProcessGovernor.exe
Token: SeCreateGlobalPrivilege	5036	ProcessGovernor.exe
Token: SeBackupPrivilege	5036	ProcessGovernor.exe
Token: SeRestorePrivilege	5036	ProcessGovernor.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exenet.exe

description	pid	process	target process
PID 1456 wrote to memory of 4752	1456	cmd.exe	net.exe
PID 1456 wrote to memory of 4752	1456	cmd.exe	net.exe
PID 4752 wrote to memory of 3620	4752	net.exe	net1.exe
PID 4752 wrote to memory of 3620	4752	net.exe	net1.exe
PID 1456 wrote to memory of 5036	1456	cmd.exe	ProcessGovernor.exe
PID 1456 wrote to memory of 5036	1456	cmd.exe	ProcessGovernor.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\processlasso_portable_64\stop-governor.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\system32\net.exe
net stop ProcessGovernor
2⤵
- Suspicious use of WriteProcessMemory
PID:4752

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ProcessGovernor
3⤵
PID:3620

C:\Users\Admin\AppData\Local\Temp\processlasso_portable_64\ProcessGovernor.exe
ProcessGovernor.exe /manual /exit
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...