257f8251ab61b944b75deafc681030a20b6dd5ae03b8540d8f482a6c291efb96

Resubmissions

06-07-2024 22:02

240706-1x4eratgrl 7

06-07-2024 19:00

240706-xnn2xssgpc 10

Analysis

max time kernel
1756s
max time network
1143s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06-07-2024 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ProcessLassoLauncher.exe
Size

397KB
MD5

ffba9b08c6fb3394e03b57f2fb4cec9a
SHA1

21dfe7d8910159b769c248e56770a1dca9810b8c
SHA256

9048d95e30d8ebe36b248da25ac9df5104c231ec3b0ae83a72ac31b513c13061
SHA512

34fa80088b06566c660b19b4c1bbfcbce3dfbb50485bd9ede097577a2309c4f41afa5086541a87b25bda8b2e745336c135363b615782b84911334c959e921614
SSDEEP

3072:c1hBjA8ZOHWQ97VpEwYNY/SzoDlArk7HoZ7WK7Tl/x:ghhA8IHW2VWIAr7WGp

Score

5^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ProcessLassoLauncher.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	ProcessLassoLauncher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ProcessLasso.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ProcessLasso.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ProcessLasso.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

ProcessLasso.exe

description	pid	process
Token: SeAssignPrimaryTokenPrivilege	3344	ProcessLasso.exe
Token: SeDebugPrivilege	3344	ProcessLasso.exe
Token: SeChangeNotifyPrivilege	3344	ProcessLasso.exe
Token: SeIncBasePriorityPrivilege	3344	ProcessLasso.exe
Token: SeIncreaseQuotaPrivilege	3344	ProcessLasso.exe
Token: SeCreateGlobalPrivilege	3344	ProcessLasso.exe
Token: SeProfSingleProcessPrivilege	3344	ProcessLasso.exe
Token: SeBackupPrivilege	3344	ProcessLasso.exe
Token: SeRestorePrivilege	3344	ProcessLasso.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

ProcessLassoLauncher.exe

description	pid	process	target process
PID 1440 wrote to memory of 3344	1440	ProcessLassoLauncher.exe	ProcessLasso.exe
PID 1440 wrote to memory of 3344	1440	ProcessLassoLauncher.exe	ProcessLasso.exe

C:\Users\Admin\AppData\Local\Temp\ProcessLassoLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\ProcessLassoLauncher.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1440

C:\Users\Admin\AppData\Local\Temp\ProcessLasso.exe
"C:\Users\Admin\AppData\Local\Temp\ProcessLasso.exe" "C:\Users\Admin\AppData\Local\Temp\ProcessLassoLauncher.exe"
2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads