d01c9c808e5c30ff410020ea0cdb1e2a492d522f2977721d52d5597232743090

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 10:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ProcessLassoLauncher.exe
Size

361KB
MD5

04117562efa101ced10f4ddba4122df4
SHA1

d8c0768cebc6fec78732b246df0ceadd3e9b76f8
SHA256

56b63335c96f6ad0dc3da39984a238897584e568b1a92db026930aaf7ade57ca
SHA512

c3b3591710c27246b0c2802b954477d765fe8eec17c10c4ed435276f63c931fddee5808c81c312e1f29d1495b399b8a45f293e2593ff12e4ba05caf96dd239ee
SSDEEP

3072:UFF74XiPuaAHP6cNEaQMD2YoEnGoQDCKDZab+k7HoZ7WK7T1YdUATm:cFEwRw6cB/Dvko+7WGa26m

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ProcessLasso.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ProcessLasso.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2848	ProcessLasso.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	2848	ProcessLasso.exe
Token: SeDebugPrivilege	2848	ProcessLasso.exe
Token: SeChangeNotifyPrivilege	2848	ProcessLasso.exe
Token: SeIncBasePriorityPrivilege	2848	ProcessLasso.exe
Token: SeIncreaseQuotaPrivilege	2848	ProcessLasso.exe
Token: SeCreateGlobalPrivilege	2848	ProcessLasso.exe
Token: SeProfSingleProcessPrivilege	2848	ProcessLasso.exe
Token: SeBackupPrivilege	2848	ProcessLasso.exe
Token: SeRestorePrivilege	2848	ProcessLasso.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2848	2652	ProcessLassoLauncher.exe	30
PID 2652 wrote to memory of 2848	2652	ProcessLassoLauncher.exe	30
PID 2652 wrote to memory of 2848	2652	ProcessLassoLauncher.exe	30
PID 2652 wrote to memory of 2848	2652	ProcessLassoLauncher.exe	30
PID 2652 wrote to memory of 2848	2652	ProcessLassoLauncher.exe	30
PID 2652 wrote to memory of 2848	2652	ProcessLassoLauncher.exe	30
PID 2652 wrote to memory of 2848	2652	ProcessLassoLauncher.exe	30

C:\Users\Admin\AppData\Local\Temp\ProcessLassoLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\ProcessLassoLauncher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Users\Admin\AppData\Local\Temp\ProcessLasso.exe
  "C:\Users\Admin\AppData\Local\Temp\ProcessLasso.exe" "C:\Users\Admin\AppData\Local\Temp\ProcessLassoLauncher.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads