Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06/09/2024, 21:30
General
-
Target
ProcessLassoLauncher.exe
-
Size
397KB
-
MD5
0271f3b6fcb68f9d2d02957feecbab39
-
SHA1
c1bee1c29b2058a4c98c8057370c4beb93372233
-
SHA256
046e04a71622e7cd87e6c34259c48dc36f173f864c3986cd9059709a7d746b41
-
SHA512
040b423649a7356b2664132dc791d5e63dcba4ed72d2423237714544a435e523cc9b33c0c9e3bdd6c7fcdf8149560f48441102748b85e302b4a7d56545dfb80f
-
SSDEEP
3072:q1hBjA8ZOHWQ97VpEwYNY/SooDlArk7HoZ7WK7T1YP:OhhA8IHW2VWnAr7WGa
Score
5/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ProcessLassoLauncher.exe"C:\Users\Admin\AppData\Local\Temp\ProcessLassoLauncher.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ProcessLasso.exe"C:\Users\Admin\AppData\Local\Temp\ProcessLasso.exe" "C:\Users\Admin\AppData\Local\Temp\ProcessLassoLauncher.exe"2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-