Analysis
-
max time kernel
1756s -
max time network
1143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
06-07-2024 19:00
General
-
Target
ProcessLassoLauncher.exe
-
Size
397KB
-
MD5
ffba9b08c6fb3394e03b57f2fb4cec9a
-
SHA1
21dfe7d8910159b769c248e56770a1dca9810b8c
-
SHA256
9048d95e30d8ebe36b248da25ac9df5104c231ec3b0ae83a72ac31b513c13061
-
SHA512
34fa80088b06566c660b19b4c1bbfcbce3dfbb50485bd9ede097577a2309c4f41afa5086541a87b25bda8b2e745336c135363b615782b84911334c959e921614
-
SSDEEP
3072:c1hBjA8ZOHWQ97VpEwYNY/SzoDlArk7HoZ7WK7Tl/x:ghhA8IHW2VWIAr7WGp
Score
5/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ProcessLassoLauncher.exe"C:\Users\Admin\AppData\Local\Temp\ProcessLassoLauncher.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ProcessLasso.exe"C:\Users\Admin\AppData\Local\Temp\ProcessLasso.exe" "C:\Users\Admin\AppData\Local\Temp\ProcessLassoLauncher.exe"2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-