8f80684a8bb4903d94ab74bd54e1cdb89cd70a7072fdf51f23200f44510cce0c

Analysis

max time kernel
142s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_Unpack Portable.cmd
Size

1KB
MD5

11bb19b34ae3d7efb2f2896416bdecfd
SHA1

76749fa742a58c585c7a9e6044d798776fc35d00
SHA256

7256488f34caa5538294556b0b728e291cbe635f8d3cc6cd8195ad4bef1f782d
SHA512

8ced83bb80ca73c583890bacee3c2306c347e84c33bf883dd4589139b8d830d01131f6d8e3c6ea7a29b9bea59c40be447d5d2968a3d78bee2fb11d4116996377

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1916	Process Lasso 14.2.0.32.tmp

Loads dropped DLL 4 IoCs

pid	Process
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1916	Process Lasso 14.2.0.32.tmp

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp
1916	Process Lasso 14.2.0.32.tmp

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 4416	4716	cmd.exe	85
PID 4716 wrote to memory of 4416	4716	cmd.exe	85
PID 4716 wrote to memory of 4416	4716	cmd.exe	85
PID 4416 wrote to memory of 1916	4416	Process Lasso 14.2.0.32.exe	86
PID 4416 wrote to memory of 1916	4416	Process Lasso 14.2.0.32.exe	86
PID 4416 wrote to memory of 1916	4416	Process Lasso 14.2.0.32.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_Unpack Portable.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Users\Admin\AppData\Local\Temp\Process Lasso 14.2.0.32.exe
  "Process Lasso 14.2.0.32.exe" /SILENT /PORTABLE=1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Users\Admin\AppData\Local\Temp\is-NGGDS.tmp\Process Lasso 14.2.0.32.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-NGGDS.tmp\Process Lasso 14.2.0.32.tmp" /SL5="$F003E,4754140,60928,C:\Users\Admin\AppData\Local\Temp\Process Lasso 14.2.0.32.exe" /SILENT /PORTABLE=1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-JDKSS.tmp\ISTask.dll

Filesize
66KB

MD5
86a1311d51c00b278cb7f27796ea442e

SHA1
ac08ac9d08f8f5380e2a9a65f4117862aa861a19

SHA256
e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d

SHA512
129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JDKSS.tmp\VclStylesInno.dll

Filesize
3.0MB

MD5
b0ca93ceb050a2feff0b19e65072bbb5

SHA1
7ebbbbe2d2acd8fd516f824338d254a33b69f08d

SHA256
0e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246

SHA512
37242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-NGGDS.tmp\Process Lasso 14.2.0.32.tmp

Filesize
907KB

MD5
3754a5eb2b26e9b6a89bd0690718351a

SHA1
5356815f88cbcc512c74b401c5b1c89f8e950944

SHA256
2006b2b4d5eb64722f0bba35380057c9556a7e8bd4bf95b92cd68d84ba255be6

SHA512
9ad991d58a60924650523f3e59a02389a7e729fbf73a0b20479c590375f40f041e0a7101604d7305ef8d7a8d57ba53e8823a75aa27441757881c604236ab0bec

Download Submit
memory/1916-11-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/1916-17-0x0000000007270000-0x0000000007286000-memory.dmp

Filesize
88KB

Download
memory/1916-23-0x00000000074A0000-0x00000000077BA000-memory.dmp

Filesize
3.1MB

Download
memory/1916-30-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-34-0x0000000007940000-0x0000000007941000-memory.dmp

Filesize
4KB

Download
memory/1916-37-0x0000000007950000-0x0000000007951000-memory.dmp

Filesize
4KB

Download
memory/1916-36-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-35-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-33-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-32-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-31-0x0000000007930000-0x0000000007931000-memory.dmp

Filesize
4KB

Download
memory/1916-29-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-28-0x0000000007920000-0x0000000007921000-memory.dmp

Filesize
4KB

Download
memory/1916-27-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-26-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-25-0x0000000007910000-0x0000000007911000-memory.dmp

Filesize
4KB

Download
memory/1916-42-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-49-0x0000000007990000-0x0000000007991000-memory.dmp

Filesize
4KB

Download
memory/1916-84-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-83-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-82-0x0000000007A40000-0x0000000007A41000-memory.dmp

Filesize
4KB

Download
memory/1916-81-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-80-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-79-0x0000000007A30000-0x0000000007A31000-memory.dmp

Filesize
4KB

Download
memory/1916-78-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-77-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-76-0x0000000007A20000-0x0000000007A21000-memory.dmp

Filesize
4KB

Download
memory/1916-75-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-74-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-73-0x0000000007A10000-0x0000000007A11000-memory.dmp

Filesize
4KB

Download
memory/1916-72-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-71-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-70-0x0000000007A00000-0x0000000007A01000-memory.dmp

Filesize
4KB

Download
memory/1916-69-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-68-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-67-0x00000000079F0000-0x00000000079F1000-memory.dmp

Filesize
4KB

Download
memory/1916-66-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-65-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-64-0x00000000079E0000-0x00000000079E1000-memory.dmp

Filesize
4KB

Download
memory/1916-63-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-62-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-61-0x00000000079D0000-0x00000000079D1000-memory.dmp

Filesize
4KB

Download
memory/1916-60-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-59-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-58-0x00000000079C0000-0x00000000079C1000-memory.dmp

Filesize
4KB

Download
memory/1916-57-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-56-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-55-0x00000000079B0000-0x00000000079B1000-memory.dmp

Filesize
4KB

Download
memory/1916-54-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-53-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-52-0x00000000079A0000-0x00000000079A1000-memory.dmp

Filesize
4KB

Download
memory/1916-50-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-48-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-47-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-46-0x0000000007980000-0x0000000007981000-memory.dmp

Filesize
4KB

Download
memory/1916-45-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-44-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-43-0x0000000007970000-0x0000000007971000-memory.dmp

Filesize
4KB

Download
memory/1916-51-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-40-0x0000000007960000-0x0000000007961000-memory.dmp

Filesize
4KB

Download
memory/1916-39-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-38-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-41-0x00000000077C0000-0x0000000007900000-memory.dmp

Filesize
1.2MB

Download
memory/1916-88-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/1916-87-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/1916-89-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/1916-90-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/1916-229-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/1916-262-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/4416-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4416-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download