Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2024, 23:39
Static task
static1
Behavioral task
behavioral1
Sample
in4.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
in4.exe
Resource
win10v2004-20240709-en
General
-
Target
in4.exe
-
Size
32KB
-
MD5
1186bb7e1df9e13bf138d9d729e067f2
-
SHA1
5aaf54b08c0b5355b5960b246bf1b886084246a4
-
SHA256
7138719c72f24985681569d1137ac7a636efe47b4a9514c73af585204f6c94d7
-
SHA512
a75a4af0a22f9e8fc863be95174b584bbcd83067ec00250bbf234ea078569e38944f2449c526f47e8fca0ed8d575332d80a475cb99956a6772f2e524e7d9f67d
-
SSDEEP
384:8vt7vYMOmlpjVnvkAyyx7rh6oo+X4lj/jmeGKn9NIwKAgN:03VfyU/h6op4ljrmBKuA
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 35 7976 Process not Found 37 7976 Process not Found -
Executes dropped EXE 64 IoCs
pid Process 2416 lass.exe 4632 lass.exe 4032 lass.exe 2328 lass.exe 3028 lass.exe 3208 lass.exe 3180 lass.exe 680 lass.exe 1880 lass.exe 2332 lass.exe 2276 lass.exe 2956 lass.exe 4580 lass.exe 2136 lass.exe 2748 lass.exe 2216 lass.exe 4272 lass.exe 3100 lass.exe 4796 lass.exe 3740 lass.exe 4640 lass.exe 4856 lass.exe 2312 lass.exe 2676 lass.exe 2912 lass.exe 3880 lass.exe 2040 lass.exe 3432 lass.exe 1424 lass.exe 3884 lass.exe 636 lass.exe 2448 lass.exe 2164 lass.exe 3484 lass.exe 3480 lass.exe 4076 lass.exe 4180 lass.exe 3672 lass.exe 3200 lass.exe 2864 lass.exe 2740 lass.exe 4024 lass.exe 4604 lass.exe 4156 lass.exe 1584 lass.exe 2088 lass.exe 216 lass.exe 4412 lass.exe 4988 lass.exe 888 lass.exe 1016 lass.exe 3460 lass.exe 3300 lass.exe 4740 lass.exe 1592 lass.exe 1620 lass.exe 4564 lass.exe 2200 lass.exe 2500 lass.exe 1936 lass.exe 3532 lass.exe 1232 lass.exe 5020 lass.exe 2604 lass.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe lass.exe File created C:\Windows\SysWOW64\lass.exe lass.exe File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe lass.exe File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe lass.exe File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe lass.exe File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe lass.exe File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe lass.exe File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe lass.exe File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe lass.exe File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe Process not Found File created C:\Windows\SysWOW64\lass.exe lass.exe File created C:\Windows\SysWOW64\lass.exe lass.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2416 lass.exe Token: SeIncBasePriorityPrivilege 4916 in4.exe Token: SeIncBasePriorityPrivilege 4632 lass.exe Token: SeIncBasePriorityPrivilege 2328 lass.exe Token: SeIncBasePriorityPrivilege 4032 lass.exe Token: SeIncBasePriorityPrivilege 3208 lass.exe Token: SeIncBasePriorityPrivilege 3028 lass.exe Token: SeIncBasePriorityPrivilege 3180 lass.exe Token: SeIncBasePriorityPrivilege 680 lass.exe Token: SeIncBasePriorityPrivilege 1880 lass.exe Token: SeIncBasePriorityPrivilege 2332 lass.exe Token: SeIncBasePriorityPrivilege 2276 lass.exe Token: SeIncBasePriorityPrivilege 2956 lass.exe Token: SeIncBasePriorityPrivilege 4580 lass.exe Token: SeIncBasePriorityPrivilege 2136 lass.exe Token: SeIncBasePriorityPrivilege 2216 lass.exe Token: SeIncBasePriorityPrivilege 2748 lass.exe Token: SeIncBasePriorityPrivilege 4272 lass.exe Token: SeIncBasePriorityPrivilege 4796 lass.exe Token: SeIncBasePriorityPrivilege 3100 lass.exe Token: SeIncBasePriorityPrivilege 3740 lass.exe Token: SeIncBasePriorityPrivilege 4640 lass.exe Token: SeIncBasePriorityPrivilege 4856 lass.exe Token: SeIncBasePriorityPrivilege 2676 lass.exe Token: SeIncBasePriorityPrivilege 2312 lass.exe Token: SeIncBasePriorityPrivilege 2912 lass.exe Token: SeIncBasePriorityPrivilege 3880 lass.exe Token: SeIncBasePriorityPrivilege 2040 lass.exe Token: SeIncBasePriorityPrivilege 3432 lass.exe Token: SeIncBasePriorityPrivilege 1424 lass.exe Token: SeIncBasePriorityPrivilege 3884 lass.exe Token: SeIncBasePriorityPrivilege 636 lass.exe Token: SeIncBasePriorityPrivilege 2448 lass.exe Token: SeIncBasePriorityPrivilege 2164 lass.exe Token: SeIncBasePriorityPrivilege 3484 lass.exe Token: SeIncBasePriorityPrivilege 3480 lass.exe Token: SeIncBasePriorityPrivilege 4076 lass.exe Token: SeIncBasePriorityPrivilege 3672 lass.exe Token: SeIncBasePriorityPrivilege 4180 lass.exe Token: SeIncBasePriorityPrivilege 3200 lass.exe Token: SeIncBasePriorityPrivilege 2864 lass.exe Token: SeIncBasePriorityPrivilege 2740 lass.exe Token: SeIncBasePriorityPrivilege 4024 lass.exe Token: SeIncBasePriorityPrivilege 4604 lass.exe Token: SeIncBasePriorityPrivilege 4156 lass.exe Token: SeIncBasePriorityPrivilege 1584 lass.exe Token: SeIncBasePriorityPrivilege 2088 lass.exe Token: SeIncBasePriorityPrivilege 216 lass.exe Token: SeIncBasePriorityPrivilege 4412 lass.exe Token: SeIncBasePriorityPrivilege 4988 lass.exe Token: SeIncBasePriorityPrivilege 1016 lass.exe Token: SeIncBasePriorityPrivilege 888 lass.exe Token: SeIncBasePriorityPrivilege 3460 lass.exe Token: SeIncBasePriorityPrivilege 3300 lass.exe Token: SeIncBasePriorityPrivilege 4740 lass.exe Token: SeIncBasePriorityPrivilege 1620 lass.exe Token: SeIncBasePriorityPrivilege 1592 lass.exe Token: SeIncBasePriorityPrivilege 4564 lass.exe Token: SeIncBasePriorityPrivilege 2500 lass.exe Token: SeIncBasePriorityPrivilege 2200 lass.exe Token: SeIncBasePriorityPrivilege 1936 lass.exe Token: SeIncBasePriorityPrivilege 3532 lass.exe Token: SeIncBasePriorityPrivilege 1232 lass.exe Token: SeIncBasePriorityPrivilege 5020 lass.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4916 wrote to memory of 2416 4916 in4.exe 84 PID 4916 wrote to memory of 2416 4916 in4.exe 84 PID 4916 wrote to memory of 2416 4916 in4.exe 84 PID 2416 wrote to memory of 4632 2416 lass.exe 85 PID 2416 wrote to memory of 4632 2416 lass.exe 85 PID 2416 wrote to memory of 4632 2416 lass.exe 85 PID 4632 wrote to memory of 4032 4632 lass.exe 86 PID 4632 wrote to memory of 4032 4632 lass.exe 86 PID 4632 wrote to memory of 4032 4632 lass.exe 86 PID 4032 wrote to memory of 2328 4032 lass.exe 87 PID 4032 wrote to memory of 2328 4032 lass.exe 87 PID 4032 wrote to memory of 2328 4032 lass.exe 87 PID 2328 wrote to memory of 3028 2328 lass.exe 88 PID 2328 wrote to memory of 3028 2328 lass.exe 88 PID 2328 wrote to memory of 3028 2328 lass.exe 88 PID 3028 wrote to memory of 3208 3028 lass.exe 89 PID 3028 wrote to memory of 3208 3028 lass.exe 89 PID 3028 wrote to memory of 3208 3028 lass.exe 89 PID 3208 wrote to memory of 3180 3208 lass.exe 90 PID 3208 wrote to memory of 3180 3208 lass.exe 90 PID 3208 wrote to memory of 3180 3208 lass.exe 90 PID 3180 wrote to memory of 680 3180 lass.exe 91 PID 3180 wrote to memory of 680 3180 lass.exe 91 PID 3180 wrote to memory of 680 3180 lass.exe 91 PID 680 wrote to memory of 1880 680 lass.exe 92 PID 680 wrote to memory of 1880 680 lass.exe 92 PID 680 wrote to memory of 1880 680 lass.exe 92 PID 1880 wrote to memory of 2332 1880 lass.exe 93 PID 1880 wrote to memory of 2332 1880 lass.exe 93 PID 1880 wrote to memory of 2332 1880 lass.exe 93 PID 2332 wrote to memory of 2276 2332 lass.exe 94 PID 2332 wrote to memory of 2276 2332 lass.exe 94 PID 2332 wrote to memory of 2276 2332 lass.exe 94 PID 2276 wrote to memory of 2956 2276 lass.exe 95 PID 2276 wrote to memory of 2956 2276 lass.exe 95 PID 2276 wrote to memory of 2956 2276 lass.exe 95 PID 2956 wrote to memory of 4580 2956 lass.exe 96 PID 2956 wrote to memory of 4580 2956 lass.exe 96 PID 2956 wrote to memory of 4580 2956 lass.exe 96 PID 4580 wrote to memory of 2136 4580 lass.exe 97 PID 4580 wrote to memory of 2136 4580 lass.exe 97 PID 4580 wrote to memory of 2136 4580 lass.exe 97 PID 2136 wrote to memory of 2748 2136 lass.exe 98 PID 2136 wrote to memory of 2748 2136 lass.exe 98 PID 2136 wrote to memory of 2748 2136 lass.exe 98 PID 2748 wrote to memory of 2216 2748 lass.exe 99 PID 2748 wrote to memory of 2216 2748 lass.exe 99 PID 2748 wrote to memory of 2216 2748 lass.exe 99 PID 2216 wrote to memory of 4272 2216 lass.exe 100 PID 2216 wrote to memory of 4272 2216 lass.exe 100 PID 2216 wrote to memory of 4272 2216 lass.exe 100 PID 4272 wrote to memory of 3100 4272 lass.exe 101 PID 4272 wrote to memory of 3100 4272 lass.exe 101 PID 4272 wrote to memory of 3100 4272 lass.exe 101 PID 3100 wrote to memory of 4796 3100 lass.exe 102 PID 3100 wrote to memory of 4796 3100 lass.exe 102 PID 3100 wrote to memory of 4796 3100 lass.exe 102 PID 4796 wrote to memory of 3740 4796 lass.exe 103 PID 4796 wrote to memory of 3740 4796 lass.exe 103 PID 4796 wrote to memory of 3740 4796 lass.exe 103 PID 3740 wrote to memory of 4640 3740 lass.exe 104 PID 3740 wrote to memory of 4640 3740 lass.exe 104 PID 3740 wrote to memory of 4640 3740 lass.exe 104 PID 4640 wrote to memory of 4856 4640 lass.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\in4.exe"C:\Users\Admin\AppData\Local\Temp\in4.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4856 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2312 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2676 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2912 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3880 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2040 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3432 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1424 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3884 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:636 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2448 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2164 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3484 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3480 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4076 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4180 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3672 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3200 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2864 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2740 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4024 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4604 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4156 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1584 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2088 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:216 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4412 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4988 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:888 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1016 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3460 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3300 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4740 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1592 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1620 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4564 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2200 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2500 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1936 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3532 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1232 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5020 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe65⤵
- Executes dropped EXE
PID:2604 -
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe66⤵PID:4592
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe67⤵PID:1388
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe68⤵PID:1216
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe69⤵PID:4544
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe70⤵PID:3588
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe71⤵PID:4972
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe72⤵PID:916
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe73⤵PID:1772
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe74⤵PID:3996
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe75⤵PID:2104
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe76⤵PID:4820
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe77⤵PID:5068
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe78⤵PID:3868
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe79⤵PID:400
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe80⤵PID:2408
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe81⤵PID:440
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe82⤵PID:4360
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe83⤵PID:4344
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe84⤵PID:3744
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe85⤵PID:3220
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe86⤵PID:3592
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe87⤵PID:4940
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe88⤵PID:5088
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe89⤵PID:2348
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe90⤵PID:1244
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe91⤵PID:4920
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe92⤵PID:2704
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe93⤵PID:792
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe94⤵PID:3968
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe95⤵PID:4588
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe96⤵PID:1448
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe97⤵PID:4924
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe98⤵PID:1984
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe99⤵PID:4608
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe100⤵PID:2944
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe101⤵PID:1580
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe102⤵PID:3696
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe103⤵PID:3280
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe104⤵PID:5124
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe105⤵PID:5144
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe106⤵PID:5156
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe107⤵PID:5176
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe108⤵PID:5192
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe109⤵PID:5208
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe110⤵PID:5220
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe111⤵PID:5240
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe112⤵PID:5264
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe113⤵PID:5284
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe114⤵PID:5304
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe115⤵PID:5320
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe116⤵PID:5336
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe117⤵PID:5356
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe118⤵PID:5372
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe119⤵PID:5388
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe120⤵PID:5400
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe121⤵PID:5420
-
C:\Windows\SysWOW64\lass.exeC:\Windows\system32\lass.exe122⤵PID:5436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-