8f80684a8bb4903d94ab74bd54e1cdb89cd70a7072fdf51f23200f44510cce0c

Analysis

max time kernel
131s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Process Lasso 14.2.0.32.exe
Size

4.9MB
MD5

315fe6eb3b3e3e0f0567e0c6b6d3b9ea
SHA1

65323656903c05c2866556080beee6a3511e8c40
SHA256

80c9bd5849e8dbbb38568978b995ae785b8bbfc5de218d938568e7281260789d
SHA512

d11d428de015ffc5744fd5c3b7c3ddb4bcbb0681691ff683f217d8ec9e427301cf76a1754e9f18164a933cd5a2af03eedc13609e7a695b208b04ba9cc5112bc8
SSDEEP

98304:PnsI+4x8J/GDtYR7VPf4R6fjEwOBRbIK9hnb9mm:EI+4K/Gt6fjjOdb0m

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
572	Process Lasso 14.2.0.32.tmp
772	installHelper.exe
1696	installHelper.exe
2244	installHelper.exe
2204	installHelper.exe
2344	ProcessLasso.exe
476	Process not Found
964	srvstub.exe
1628	bitsumsessionagent.exe
2124	processgovernor.exe
1160	Process not Found
2308	ProcessLasso.exe

Loads dropped DLL 32 IoCs

pid	Process
2608	Process Lasso 14.2.0.32.exe
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
772	installHelper.exe
1696	installHelper.exe
2244	installHelper.exe
2204	installHelper.exe
572	Process Lasso 14.2.0.32.tmp
2344	ProcessLasso.exe
2332	taskeng.exe
476	Process not Found
964	srvstub.exe
2124	processgovernor.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
1160	Process not Found
1160	Process not Found
2308	ProcessLasso.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Process Lasso\CPUEater.exe	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-D7D34.tmp	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-FDHMK.tmp	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_english.dll	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-FMOPF.tmp	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-FP50F.tmp	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\unins000.dat	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\bitsumsessionagent.exe	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\testlasso.exe	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-1DDH9.tmp	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_slovenian.dll	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\QuickUpgrade.exe	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_finnish.dll	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-3VCNH.tmp	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-H8S5Q.tmp	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_french.dll	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-4Q29O.tmp	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-GTRCV.tmp	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_italian.dll	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_spanish.dll	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-OGP9I.tmp	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-2OI0T.tmp	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-8EGKC.tmp	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\vistammsc.exe	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_polish.dll	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_german.dll	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-CS1FS.tmp	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-KI9HC.tmp	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-BE0O1.tmp	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\ProcessLassoLauncher.exe	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\TweakScheduler.exe	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-8P9KT.tmp	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-9IK7J.tmp	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-GLTNJ.tmp	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_chinese_traditional.dll	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-1DHMH.tmp	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-80J41.tmp	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_bulgarian.dll	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_korean.dll	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-GR2A7.tmp	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-LFLOO.tmp	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-234M7.tmp	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\LogViewer.exe	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-E6373.tmp	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-1ACPJ.tmp	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-03MTE.tmp	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\ProcessGovernor.exe	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\ProcessLasso.exe	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\InstallHelper.exe	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\unins000.dat	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-CHPPP.tmp	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_ptbr.dll	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-2UJHF.tmp	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\srvstub.exe	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_japanese.dll	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-EMI5V.tmp	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-4D3RA.tmp	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-R07MF.tmp	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-6GS3F.tmp	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\Insights.exe	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_chinese.dll	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-43DI9.tmp	Process Lasso 14.2.0.32.tmp
File created	C:\Program Files\Process Lasso\is-HDPIN.tmp	Process Lasso 14.2.0.32.tmp
File opened for modification	C:\Program Files\Process Lasso\ThreadRacer.exe	Process Lasso 14.2.0.32.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	installHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	processgovernor.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	installHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	installHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	installHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ProcessLasso.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	installHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	installHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	processgovernor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ProcessLasso.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	installHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	installHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ProcessLasso.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ProcessLasso.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\ProcessLasso	processgovernor.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\ProcessLasso\Language = "1033"	processgovernor.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\ProcessLasso\InstallerLanguageDWORD = "1033"	processgovernor.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\ProcessLasso	processgovernor.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\ProcessLasso\ProcessLasso = 09040000	processgovernor.exe

Runs .reg file with regedit 1 IoCs

pid	Process
332	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2124	processgovernor.exe
2124	processgovernor.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2124	processgovernor.exe
2124	processgovernor.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1628	bitsumsessionagent.exe
2124	processgovernor.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	772	installHelper.exe
Token: SeDebugPrivilege	772	installHelper.exe
Token: SeChangeNotifyPrivilege	772	installHelper.exe
Token: SeIncBasePriorityPrivilege	772	installHelper.exe
Token: SeIncreaseQuotaPrivilege	772	installHelper.exe
Token: SeProfSingleProcessPrivilege	772	installHelper.exe
Token: SeAssignPrimaryTokenPrivilege	1696	installHelper.exe
Token: SeDebugPrivilege	1696	installHelper.exe
Token: SeChangeNotifyPrivilege	1696	installHelper.exe
Token: SeIncBasePriorityPrivilege	1696	installHelper.exe
Token: SeIncreaseQuotaPrivilege	1696	installHelper.exe
Token: SeProfSingleProcessPrivilege	1696	installHelper.exe
Token: SeAssignPrimaryTokenPrivilege	2244	installHelper.exe
Token: SeDebugPrivilege	2244	installHelper.exe
Token: SeChangeNotifyPrivilege	2244	installHelper.exe
Token: SeIncBasePriorityPrivilege	2244	installHelper.exe
Token: SeIncreaseQuotaPrivilege	2244	installHelper.exe
Token: SeProfSingleProcessPrivilege	2244	installHelper.exe
Token: SeAssignPrimaryTokenPrivilege	2204	installHelper.exe
Token: SeDebugPrivilege	2204	installHelper.exe
Token: SeChangeNotifyPrivilege	2204	installHelper.exe
Token: SeIncBasePriorityPrivilege	2204	installHelper.exe
Token: SeIncreaseQuotaPrivilege	2204	installHelper.exe
Token: SeProfSingleProcessPrivilege	2204	installHelper.exe
Token: SeAssignPrimaryTokenPrivilege	2344	ProcessLasso.exe
Token: SeDebugPrivilege	2344	ProcessLasso.exe
Token: SeChangeNotifyPrivilege	2344	ProcessLasso.exe
Token: SeIncBasePriorityPrivilege	2344	ProcessLasso.exe
Token: SeIncreaseQuotaPrivilege	2344	ProcessLasso.exe
Token: SeCreateGlobalPrivilege	2344	ProcessLasso.exe
Token: SeProfSingleProcessPrivilege	2344	ProcessLasso.exe
Token: SeBackupPrivilege	2344	ProcessLasso.exe
Token: SeRestorePrivilege	2344	ProcessLasso.exe
Token: SeAssignPrimaryTokenPrivilege	964	srvstub.exe
Token: SeCreateGlobalPrivilege	964	srvstub.exe
Token: SeAssignPrimaryTokenPrivilege	2124	processgovernor.exe
Token: SeDebugPrivilege	2124	processgovernor.exe
Token: SeChangeNotifyPrivilege	2124	processgovernor.exe
Token: SeIncBasePriorityPrivilege	2124	processgovernor.exe
Token: SeIncreaseQuotaPrivilege	2124	processgovernor.exe
Token: SeProfSingleProcessPrivilege	2124	processgovernor.exe
Token: SeCreateGlobalPrivilege	2124	processgovernor.exe
Token: SeBackupPrivilege	2124	processgovernor.exe
Token: SeRestorePrivilege	2124	processgovernor.exe
Token: SeAssignPrimaryTokenPrivilege	2308	ProcessLasso.exe
Token: SeDebugPrivilege	2308	ProcessLasso.exe
Token: SeChangeNotifyPrivilege	2308	ProcessLasso.exe
Token: SeIncBasePriorityPrivilege	2308	ProcessLasso.exe
Token: SeIncreaseQuotaPrivilege	2308	ProcessLasso.exe
Token: SeCreateGlobalPrivilege	2308	ProcessLasso.exe
Token: SeProfSingleProcessPrivilege	2308	ProcessLasso.exe
Token: SeBackupPrivilege	2308	ProcessLasso.exe
Token: SeRestorePrivilege	2308	ProcessLasso.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
572	Process Lasso 14.2.0.32.tmp
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe
2344	ProcessLasso.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp
572	Process Lasso 14.2.0.32.tmp

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 572	2608	Process Lasso 14.2.0.32.exe	31
PID 2608 wrote to memory of 572	2608	Process Lasso 14.2.0.32.exe	31
PID 2608 wrote to memory of 572	2608	Process Lasso 14.2.0.32.exe	31
PID 2608 wrote to memory of 572	2608	Process Lasso 14.2.0.32.exe	31
PID 2608 wrote to memory of 572	2608	Process Lasso 14.2.0.32.exe	31
PID 2608 wrote to memory of 572	2608	Process Lasso 14.2.0.32.exe	31
PID 2608 wrote to memory of 572	2608	Process Lasso 14.2.0.32.exe	31
PID 572 wrote to memory of 332	572	Process Lasso 14.2.0.32.tmp	32
PID 572 wrote to memory of 332	572	Process Lasso 14.2.0.32.tmp	32
PID 572 wrote to memory of 332	572	Process Lasso 14.2.0.32.tmp	32
PID 572 wrote to memory of 332	572	Process Lasso 14.2.0.32.tmp	32
PID 572 wrote to memory of 772	572	Process Lasso 14.2.0.32.tmp	33
PID 572 wrote to memory of 772	572	Process Lasso 14.2.0.32.tmp	33
PID 572 wrote to memory of 772	572	Process Lasso 14.2.0.32.tmp	33
PID 572 wrote to memory of 772	572	Process Lasso 14.2.0.32.tmp	33
PID 572 wrote to memory of 1696	572	Process Lasso 14.2.0.32.tmp	34
PID 572 wrote to memory of 1696	572	Process Lasso 14.2.0.32.tmp	34
PID 572 wrote to memory of 1696	572	Process Lasso 14.2.0.32.tmp	34
PID 572 wrote to memory of 1696	572	Process Lasso 14.2.0.32.tmp	34
PID 572 wrote to memory of 2244	572	Process Lasso 14.2.0.32.tmp	35
PID 572 wrote to memory of 2244	572	Process Lasso 14.2.0.32.tmp	35
PID 572 wrote to memory of 2244	572	Process Lasso 14.2.0.32.tmp	35
PID 572 wrote to memory of 2244	572	Process Lasso 14.2.0.32.tmp	35
PID 572 wrote to memory of 2204	572	Process Lasso 14.2.0.32.tmp	36
PID 572 wrote to memory of 2204	572	Process Lasso 14.2.0.32.tmp	36
PID 572 wrote to memory of 2204	572	Process Lasso 14.2.0.32.tmp	36
PID 572 wrote to memory of 2204	572	Process Lasso 14.2.0.32.tmp	36
PID 572 wrote to memory of 2344	572	Process Lasso 14.2.0.32.tmp	37
PID 572 wrote to memory of 2344	572	Process Lasso 14.2.0.32.tmp	37
PID 572 wrote to memory of 2344	572	Process Lasso 14.2.0.32.tmp	37
PID 572 wrote to memory of 2344	572	Process Lasso 14.2.0.32.tmp	37
PID 2332 wrote to memory of 1628	2332	taskeng.exe	39
PID 2332 wrote to memory of 1628	2332	taskeng.exe	39
PID 2332 wrote to memory of 1628	2332	taskeng.exe	39
PID 964 wrote to memory of 2124	964	srvstub.exe	41
PID 964 wrote to memory of 2124	964	srvstub.exe	41
PID 964 wrote to memory of 2124	964	srvstub.exe	41

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Process Lasso 14.2.0.32.exe
"C:\Users\Admin\AppData\Local\Temp\Process Lasso 14.2.0.32.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Users\Admin\AppData\Local\Temp\is-IA9QG.tmp\Process Lasso 14.2.0.32.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-IA9QG.tmp\Process Lasso 14.2.0.32.tmp" /SL5="$5014E,4754140,60928,C:\Users\Admin\AppData\Local\Temp\Process Lasso 14.2.0.32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:572
- - C:\Windows\regedit.exe
    "C:\Windows\regedit.exe" /S "C:\Users\Admin\AppData\Local\Temp\settings.reg"
    3⤵
    - Runs .reg file with regedit
    PID:332
- - C:\Program Files\Process Lasso\installHelper.exe
    "C:\Program Files\Process Lasso\installHelper.exe" /firstinstall
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:772
- - C:\Program Files\Process Lasso\installHelper.exe
    "C:\Program Files\Process Lasso\installHelper.exe" /migrate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:1696
- - C:\Program Files\Process Lasso\installHelper.exe
    "C:\Program Files\Process Lasso\installHelper.exe" /powerinstall
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:2244
- - C:\Program Files\Process Lasso\installHelper.exe
    "C:\Program Files\Process Lasso\installHelper.exe" /install
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:2204
- - C:\Program Files\Process Lasso\ProcessLasso.exe
    "C:\Program Files\Process Lasso\ProcessLasso.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2344

C:\Windows\system32\taskeng.exe
taskeng.exe {A6DB5AA4-C813-48AC-9945-9F3ABB1FA588} S-1-5-21-3450744190-3404161390-554719085-1000:PDIZKVQX\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files\Process Lasso\bitsumsessionagent.exe
  "C:\Program Files\Process Lasso\bitsumsessionagent.exe" ----------------------------------------------------------------
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1628

C:\Program Files\Process Lasso\srvstub.exe
"C:\Program Files\Process Lasso\srvstub.exe" "C:\Program Files\Process Lasso\processgovernor.exe" "ProcessGovernor" /exitevent:Global\ProcessGovernorExitEvent
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964
- C:\Program Files\Process Lasso\processgovernor.exe
  "C:\Program Files\Process Lasso\processgovernor.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2124

C:\Program Files\Process Lasso\ProcessLasso.exe
"C:\Program Files\Process Lasso\ProcessLasso.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Process Lasso\pl_rsrc_english.dll

Filesize
1.9MB

MD5
40d2b640a737039f0ae3bea77470cdfd

SHA1
f22c0a3ed620659ec76b1dc499b9965e4b6b3a2b

SHA256
be8a66f9560f0f3d2dcb12a3608deeae7a64e87340462c0f409c640580c514f8

SHA512
17b8d4c47875b909e4a70373033dd28cde2f2805509845eaf0ac264c85ddeec657d17276b38f37211d4102de87a8b0c91c646d17826b18c2f4f3f9badc4d3b29

Download Submit
C:\ProgramData\ProcessLasso\config\prolasso.ini

Filesize
8KB

MD5
a91fcce51037e12725d092b8467a7f72

SHA1
692bb6fb77ea87a221ce081d3db2e15a24609fc1

SHA256
f2f106fa5e59ea783318e813e45c0881f495d910fbeccb8cab38f20ab2546730

SHA512
156c4e0cae289291ca8f7b223e5246b80613e4338ba8bbba6d4b5400f59d6f4330d678b2c8751c35f72ae95a5275aa87e0cd11213c02f584b79aeeead1ae0446

Download Submit
C:\ProgramData\ProcessLasso\logs\processlasso.log

Filesize
786B

MD5
d2c23e5fa15df217b7aa0bf8fe129552

SHA1
15e862729d8c0770bc7c2367e76ea2b61addd63b

SHA256
6eaccc369aac1d2d3edb1516b25a57efe7b3b55a5b9b9995605c89c59ea5ad30

SHA512
9fc97d2155a578ab77dd3531e188499804e956bd297a41a1b37cb703000b5f2dd3a6e4c5974c7672424b9f7ffbc7608be0f2803b8a8d1f8fd4b44608d2db84e6

Download Submit
\Program Files\Process Lasso\InstallHelper.exe

Filesize
765KB

MD5
5e39c1cb5b265ec880da4d0c64454a15

SHA1
f0cb07ce3241210cf8b1ed5c9998ce10d00262b1

SHA256
ed4dfa63d77507d0403f9c749060a510540d116670f00bfa340c5d1e6d1ea9ef

SHA512
e56c13ed401fbaf5c425c7ff1ccc4cf0ccb1ad3a52864bcb1689bb52e610d15438a6936fc7dd4fbd7aee78853711745606bf391cf5f1b4b4b772fdc0fefd52b6

Download Submit
\Program Files\Process Lasso\ProcessGovernor.exe

Filesize
1.2MB

MD5
1656969c2c886b797a88a54da90067af

SHA1
3e2663d555f9fa6b98ad0a5045148a8aeaeaa9b8

SHA256
19ac1e6b66feb45b3db2d4a70724f600463206305ca47a63a2c6742301938548

SHA512
e3cf0775cdf05919556c581dbf0001c9a4a2b8bce91920811320327cfe37fc4ff482c8a10eb224b07de2c89cab1ebc4d6d101c8ca4bb8592b4d83945c5266c13

Download Submit
\Program Files\Process Lasso\ProcessLasso.exe

Filesize
1.8MB

MD5
2c363d84d7ccfea690465a02853f28e7

SHA1
ed70de6b66b112df2725ab21265eec00b54e479a

SHA256
93d27b7a79708ea7704e3e3184203623572ab7d1ca30efdad7ae5b695f5e54d6

SHA512
76cf03de429cdaf179ed12485eca5fac20013d23a7c7c2eb302180aa3bff8d7b6beaf2a029772303a3d5613c2f6f3e70eb4554f5d5ebba565b9abef806d8315e

Download Submit
\Program Files\Process Lasso\bitsumsessionagent.exe

Filesize
177KB

MD5
7f55918ca6706935ebf3000e277ec7f3

SHA1
725b09394b76ccc066ac4fbc00357fbbb2a60f34

SHA256
7592cdd84b1085851f3a6ef03bc386a381117cdb884c720be1bd8dcf62a296ea

SHA512
fe218d72e4e17097143860b57f22de32ecac1b5cbcb93e856404bed7884ce2b389d39f3ed654a1d8bdc5f08847ebfd3fdf9ba0f1f1efd32e55fe6bf250f9afc9

Download Submit
\Program Files\Process Lasso\srvstub.exe

Filesize
133KB

MD5
0e5a9b9dc9735ae5c4893074ba229212

SHA1
47bbc9707bb66752382eec1f2e1dc58b7726f830

SHA256
d7cb65cb2e9829275453abf3bf2eb9cf085ee64d44decd158d51750bfa9597ef

SHA512
73b853a648391b0a36efac4ef35e1ff5e1c7633cfb1cb554445b7381fe9b6b21083c269d7bcfc15e996107cbada45317da703d3c05b0f81a5854b9d447be061f

Download Submit
\Program Files\Process Lasso\unins000.exe

Filesize
918KB

MD5
b7aeb9c7198525a33627fb37bb27e697

SHA1
7dfe2e758a018325cc537536f66490b0e029b975

SHA256
423178479b5763d412b2aa93643768782ca19d7b7a1c6d20e453b07c1a07967c

SHA512
d3310c1883f6eb44c4260e532065de139c881663b37fc45bb12c611777dc1b6355d2ea0b6341374578b8e39b8799c5e46504f87c73c631c97cbe6cc8e3ea8ca8

Download Submit
\Users\Admin\AppData\Local\Temp\is-GMQ24.tmp\ISTask.dll

Filesize
66KB

MD5
86a1311d51c00b278cb7f27796ea442e

SHA1
ac08ac9d08f8f5380e2a9a65f4117862aa861a19

SHA256
e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d

SHA512
129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec

Download Submit
\Users\Admin\AppData\Local\Temp\is-GMQ24.tmp\VclStylesInno.dll

Filesize
3.0MB

MD5
b0ca93ceb050a2feff0b19e65072bbb5

SHA1
7ebbbbe2d2acd8fd516f824338d254a33b69f08d

SHA256
0e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246

SHA512
37242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2

Download Submit
\Users\Admin\AppData\Local\Temp\is-GMQ24.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-IA9QG.tmp\Process Lasso 14.2.0.32.tmp

Filesize
907KB

MD5
3754a5eb2b26e9b6a89bd0690718351a

SHA1
5356815f88cbcc512c74b401c5b1c89f8e950944

SHA256
2006b2b4d5eb64722f0bba35380057c9556a7e8bd4bf95b92cd68d84ba255be6

SHA512
9ad991d58a60924650523f3e59a02389a7e729fbf73a0b20479c590375f40f041e0a7101604d7305ef8d7a8d57ba53e8823a75aa27441757881c604236ab0bec

Download Submit
memory/572-50-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-40-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/572-79-0x0000000007600000-0x0000000007601000-memory.dmp

Filesize
4KB

Download
memory/572-77-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-75-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-74-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-73-0x00000000075E0000-0x00000000075E1000-memory.dmp

Filesize
4KB

Download
memory/572-72-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-71-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-70-0x00000000075D0000-0x00000000075D1000-memory.dmp

Filesize
4KB

Download
memory/572-69-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-68-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-67-0x00000000075C0000-0x00000000075C1000-memory.dmp

Filesize
4KB

Download
memory/572-65-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-64-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/572-63-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-62-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-61-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/572-60-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-59-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-58-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/572-57-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-56-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-55-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/572-53-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-52-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/572-51-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-81-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-48-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-47-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-46-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/572-45-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-44-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-43-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/572-41-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-80-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-39-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-38-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-37-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/572-36-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-35-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-34-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/572-33-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-32-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-31-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download
memory/572-30-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-78-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-76-0x00000000075F0000-0x00000000075F1000-memory.dmp

Filesize
4KB

Download
memory/572-66-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-54-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-29-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-28-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/572-27-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-26-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-25-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/572-87-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/572-88-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/572-82-0x0000000007610000-0x0000000007611000-memory.dmp

Filesize
4KB

Download
memory/572-89-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/572-172-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/572-83-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-84-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-49-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/572-42-0x0000000007480000-0x00000000075C0000-memory.dmp

Filesize
1.2MB

Download
memory/572-23-0x0000000007160000-0x000000000747A000-memory.dmp

Filesize
3.1MB

Download
memory/572-19-0x00000000003A0000-0x00000000003B6000-memory.dmp

Filesize
88KB

Download
memory/572-231-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/572-11-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2608-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2608-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download