d01c9c808e5c30ff410020ea0cdb1e2a492d522f2977721d52d5597232743090

Analysis

max time kernel
141s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 10:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ProcessLassoLauncher.exe
Size

361KB
MD5

04117562efa101ced10f4ddba4122df4
SHA1

d8c0768cebc6fec78732b246df0ceadd3e9b76f8
SHA256

56b63335c96f6ad0dc3da39984a238897584e568b1a92db026930aaf7ade57ca
SHA512

c3b3591710c27246b0c2802b954477d765fe8eec17c10c4ed435276f63c931fddee5808c81c312e1f29d1495b399b8a45f293e2593ff12e4ba05caf96dd239ee
SSDEEP

3072:UFF74XiPuaAHP6cNEaQMD2YoEnGoQDCKDZab+k7HoZ7WK7T1YdUATm:cFEwRw6cB/Dvko+7WGa26m

Score

5^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	ProcessLassoLauncher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ProcessLasso.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ProcessLasso.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	4212	ProcessLasso.exe
Token: SeDebugPrivilege	4212	ProcessLasso.exe
Token: SeChangeNotifyPrivilege	4212	ProcessLasso.exe
Token: SeIncBasePriorityPrivilege	4212	ProcessLasso.exe
Token: SeIncreaseQuotaPrivilege	4212	ProcessLasso.exe
Token: SeCreateGlobalPrivilege	4212	ProcessLasso.exe
Token: SeProfSingleProcessPrivilege	4212	ProcessLasso.exe
Token: SeBackupPrivilege	4212	ProcessLasso.exe
Token: SeRestorePrivilege	4212	ProcessLasso.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 4212	4760	ProcessLassoLauncher.exe	87
PID 4760 wrote to memory of 4212	4760	ProcessLassoLauncher.exe	87
PID 4760 wrote to memory of 4212	4760	ProcessLassoLauncher.exe	87

C:\Users\Admin\AppData\Local\Temp\ProcessLassoLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\ProcessLassoLauncher.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Users\Admin\AppData\Local\Temp\ProcessLasso.exe
  "C:\Users\Admin\AppData\Local\Temp\ProcessLasso.exe" "C:\Users\Admin\AppData\Local\Temp\ProcessLassoLauncher.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:4212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads