d01c9c808e5c30ff410020ea0cdb1e2a492d522f2977721d52d5597232743090

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 10:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ProcessGovernor.exe
Size

1.1MB
MD5

d7ce5134de8b9afd0871a2f710e9a5cb
SHA1

dd265e5c980da62ce2dc938cd797f9a5c869ee96
SHA256

195ae16677e43e3230317ac1a6eb09304bcbe2a59b708be84761c3f1b798176c
SHA512

5320b27940d2781f966ef185cc1c620a0a9cba25b119cb3692eede113a83627fd90c124553f4fd01a49ced8eab6d760d636c27a281d3058cb1a60736b9664071
SSDEEP

24576:CsQCO4bpQNOgc55oaDnC18SzBIgIwjnHMOmch2DlEap+:384bCIg3snC18SzBIg9nHMOmch26ap+

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ProcessGovernor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ProcessGovernor.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe
3932	ProcessGovernor.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3932	ProcessGovernor.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	3932	ProcessGovernor.exe
Token: SeDebugPrivilege	3932	ProcessGovernor.exe
Token: SeChangeNotifyPrivilege	3932	ProcessGovernor.exe
Token: SeIncBasePriorityPrivilege	3932	ProcessGovernor.exe
Token: SeIncreaseQuotaPrivilege	3932	ProcessGovernor.exe
Token: SeProfSingleProcessPrivilege	3932	ProcessGovernor.exe
Token: SeCreateGlobalPrivilege	3932	ProcessGovernor.exe
Token: SeBackupPrivilege	3932	ProcessGovernor.exe
Token: SeRestorePrivilege	3932	ProcessGovernor.exe

C:\Users\Admin\AppData\Local\Temp\ProcessGovernor.exe
"C:\Users\Admin\AppData\Local\Temp\ProcessGovernor.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ProcessLasso\logs\processlasso.log

Filesize
1KB

MD5
04bd6ea7af2a03a4a3e2b0ba0cfe2d59

SHA1
d0a2b7cdc6e507b9d647f182a114f93e0aa33507

SHA256
c2837387cb009cfce209072952661bd93e8ce4d18a607044098741f14b6f6f82

SHA512
d8cc5ffaed5faede112cb93826ce16e3b7375e8dcd1bb83726dcbefa14c87247db247e57488baadd7fed85928a41627278a772c5ee600c9fa9370b448eecb549

Download Submit