2c06cc42de55794d876c6981b8b91d9d2884ab7cd35cf00ba38ef525f51f1833

Sharing

Copy URL Twitter E-mail

General

Target
processlassosetup64.exe
Size 2.7MB
Sample260704-txrbvsdw9k
SHA256 2c06cc42de55794d876c6981b8b91d9d2884ab7cd35cf00ba38ef525f51f1833
MD5 ef346a431adf4c9ef4900de490154c03
SHA1 9613623ba4d1b998f450fe7e6bd84fe0fedbb9d0
SHA512 22fce627dc25bcbc7adb37e90d5c0f6f27508b8ee6fee4eda941ac128486f84473feaf9141c7caec330f4888ef236b6efe76c1a58596d08fc020d51dfdf7747e
SSDEEP 49152:+6bcFWdwidZdVihvi5ic8pG1AmGpdsucyWKV9md8EoMM3TooUfyhowuA:+b0jZdVixm8pUANpdsujrm7oBDoX4oo
TLSH
T133D5F0D459BA8DACD460DEBC8AD1CDC9B0CF9E0C943E3A3A4678311C5FBCB9A5494C25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  processlassosetup64.exe
- Size 2.7MB
- SHA256 2c06cc42de55794d876c6981b8b91d9d2884ab7cd35cf00ba38ef525f51f1833
- MD5 ef346a431adf4c9ef4900de490154c03
- SHA1 9613623ba4d1b998f450fe7e6bd84fe0fedbb9d0
- SHA512 22fce627dc25bcbc7adb37e90d5c0f6f27508b8ee6fee4eda941ac128486f84473feaf9141c7caec330f4888ef236b6efe76c1a58596d08fc020d51dfdf7747e
- SSDEEP 49152:+6bcFWdwidZdVihvi5ic8pG1AmGpdsucyWKV9md8EoMM3TooUfyhowuA:+b0jZdVixm8pUANpdsujrm7oBDoX4oo
- TLSH
  T133D5F0D459BA8DACD460DEBC8AD1CDC9B0CF9E0C943E3A3A4678311C5FBCB9A5494C25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence adware ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/INetC.dll
- Size 24KB
- SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
- MD5 640bff73a5f8e37b202d911e4749b2e9
- SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
- SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
- SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
- TLSH
  T1F2B2E69157EA135EF7F19F347475EB2249BBBC214821C8CF5633268E19B2242E930727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
- MD5 68b287f4067ba013e34a1339afdb1ea8
- SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
- SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
- SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
- TLSH
  T16BC19474B3C248B9C491513768AB33D36612EE746784500F9F6711AA38209F7AD3EBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  CPUEater.exe
- Size 560KB
- SHA256 af15cdc1ba71989c9875e8ec7320471b3472a3a95fe70f548613b7b51d89b4bb
- MD5 da25073bd63fa6863a675552f05538fd
- SHA1 95120143c172d569693cc149defccd32f169b4c4
- SHA512 7134260ad7c5d74e8448675230182f7311ca8188cc4775917a8a3371154c8bbda8d27b17603bcee7e5f97d1c10ff4905f9b890732ed50f3af85e4ae01c80a980
- SSDEEP 6144:1FGEr5+MqOC/jCkYUevqlUpCOvwF4OkiUpmF9NUw7Ul11jPhbuP:XH5fqOC/WkNevqlup1jHmF9NUw4byP
- TLSH
  T167C47E94B2A442F5E1BBC235C9934416F9717C814735A9DF03E88AFA0F33AD54E3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Insights.exe
- Size 815KB
- SHA256 faba464b4a5d90532744692b8827bd2bcd3f2fe57cc4d23c5d0a066cbfb7fc39
- MD5 de12860243d025345f68d53974171595
- SHA1 03d3d00dd4b916cd08d6f50b19458037670d8eeb
- SHA512 fa8cb2d64f3a6b1e323ed4ada92bfeb73bec6f25e89416dfe6e82b499fa75d6e452e21440543cf414ec3b9e67cd8f6a76565de1017f27361363e734717bd7ce3
- SSDEEP 12288:d+sMy7Rb2uph566/D+xaUB1eYwIU02KGQCC:hyut66b+xaykYmQCC
- TLSH
  T13205A1D055BA49ACD066CD7C8A81CC9AB8EF7D0C473D39BB02B478581F3EB994674E21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  InstallHelper.exe
- Size 858KB
- SHA256 2383b58537b3677232e2801e05ccb9ee80c1200dedc3181a2a49546bba073b7a
- MD5 be5f8502649520c3a0f6e54e2d174519
- SHA1 fcf3e8bb8e17aab40b31bc77a32dc6a2406dd821
- SHA512 e4b2a2da148b80c20763dd43009bd57ad50dcb1410e99092a9d699c896e76ee7fa56367a17966b9b5d0811f01f4ded1eed5743894c8fe4aa88edd1e6305dd528
- SSDEEP 24576:LtTz2I/AmMI0bl4YrmDj8kUuZbPqxmLE:LtX2I/AmMI05rmvU1w
- TLSH
  T1FC15B2D056B649ACD076CD3C8A82CC9AB9EB7D0C463D7ABB0274345C1F3EB994674E21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

persistence
behavioral13 behavioral14
- Target
  LogViewer.exe
- Size 850KB
- SHA256 6163edb7b9810f8e1a92feaa5365ee21cdd49f2a90b5cb832d41cb881cbfa040
- MD5 af706a729d84efdc009c4feddeaeb415
- SHA1 6a24decd760cb682fc94b6e8c685c5033a45d6ed
- SHA512 7d713af1382aaf42db99b2d567779e1ff83b8c4028c1f04b48e80310ba1c24efe3c72cdc76d2daea35a15c8357147b0790afb680ea448439c6dbe5d6dd56a82a
- SSDEEP 6144:kT2opFZw3HV8YwLrgcOICFDs7r1UmlYix0Xky+vNAScOWWv7lGzipGKD4dGI9vzn:4Itcb6Cu70iEs1dzvRswFU7
- TLSH
  T1A0056C5DB29852F4E076D334BA824616EBB27C1577619ACB03A07B9B1F376E04F3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  ProcessGovernor.exe
- Size 1.3MB
- SHA256 d2ce55038814ca164cbda2c3e22bc7ddd6cab62b1ebb642da7370d3e78092f06
- MD5 5f646473b37fad590cdf06bfdc3c0ec9
- SHA1 b0fbdcb957fd0524571c933c280c7b9f38acf1be
- SHA512 f53193d98987c501d8ff467e0a5c546f76be5aa0b712a854de38b91be01f2c93a5de8387253295f3040e03323d74fa33f1c7584b9efab858965ef9ae6616f7ab
- SSDEEP 24576:xUyt6Yi/DMQ+RsPifRNWT4vKvjYy+pFmM/UUZkVTvkIYk:W2EDMQ+RsPifRDSvjYy+pgM/1Q8m
- TLSH
  T1225527D455B905ACE066D8BC8A91CC8AE5EB7C0C073D7AFB02B036591F3EBD50A79E11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  ProcessLasso.exe
- Size 2.4MB
- SHA256 bae42c6ba451adc2c206072d254416391f66429088da56b24cdcaa88f0ff2752
- MD5 46970484dfadc204770d12a774570459
- SHA1 149114c36427a3193a113cddc5f24612eb82a5f8
- SHA512 2dbf03a6803833a5f52d688a6086bea5ab4c3403439a9aca783e485db9e04eb188239528a3ccfc3fb4ef26b9964e771d43273c5fa030d226a9f20dcfd2cc3395
- SSDEEP 24576:7/1i2SnomRRPS5yrIOF3FcxtsD0ffOKo8XeDRiMa3R/i9y2L+VfxcscFAn5Hiyi/:7/1i20IOT6sDkOeJ38BO7hntiy
- TLSH
  T138C5399622B801A9E0B6C47C8945CC57E9FB7C0C173979FB0164B9591F3FAEA0A39F11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  ProcessLassoLauncher.exe
- Size 399KB
- SHA256 01101dbecda934a17ba9d429bda835ccf1e4466a6155d079756d9ef263b4b68e
- MD5 cbc552ce27110190fe4fb31edae35132
- SHA1 d1e33f7b579e755a041d110b83fe8550f357844b
- SHA512 0d41c62cca9d43e095520e466e1a58627487c1f43ae757afa75e607ffd8cb81862233db9808f4543d7e9eb575e8e43a2361bc0de4a4a447ee705b2d292f327ea
- SSDEEP 3072:Dja0CoxWjhPjO2pla3tLSkOnH1uwba0zAugVxYR2k7HoZ7WK7Tlpqs2n:D2lPjOF3pSRQucYR27WG/q7
- TLSH
  T1D5943BD11ABA8DACD061DE7C8AC1CCC9A6DF6E1C463D363A4278341C5F7CBDA58A4D24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral21 behavioral22
- Target
  QuickUpgrade.exe
- Size 486KB
- SHA256 f3033761b8fc87766f5f8b4db29712493c4eff674d8747721d84efb40ac0c1c4
- MD5 3ba5cf6e087d9f5a3f378755a631a157
- SHA1 b97240a7afde727b3c35aad5c6d7f3ebd3c692eb
- SHA512 78308e1849760d20a93b6068fd90fd0b4bb817a2054210a497c60b0b35325429801fdf1576a95e8475b826837ac33371b1d62022c76152581ad28927c48df02b
- SSDEEP 6144:Ifbrou5SBF4aUk0fUBEzYtR2T28WqG7WGirgG:ooBBF4BQBqYL2T4qGKGirP
- TLSH
  T145B46ED11ABA8CACE461CE7C8A81CCC9A5DF6D0C463D7A7B0278341C5F7EBDA5864D21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  ThreadRacer.exe
- Size 303KB
- SHA256 b280e50b154966203bea0ac9895cb8e1498794cb2e70f74ec695e0c5aea453a5
- MD5 455d29cb11e3aab97aeb0637123603db
- SHA1 76c279ec293b0100c84026d51b8b64dbd54d9097
- SHA512 8f5c46de849a109b70d374e58f385b7a6d600ce5aebbf1c792cb6b1f0763d4346d297a0c41ecbe8215b7bcc2e44c2bc4ab5d526371aa2ac48750e99204176a84
- SSDEEP 3072:+bMbNKLdv4NWhGTCK0pqFI29FObOwDm0xGsJuWMVZwPmk/rim46ZdM8U/ePqBTxk:+bLLdv4NWITCRn26JLzMViTtFUbbsz
- TLSH
  T16C641816A6A108E4F8F680398592553BF67E78550364DBFB02934E562F23AFC9D3EF10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  TweakScheduler.exe
- Size 202KB
- SHA256 aed56d03607044d30e6a2f92bb0fed1846008f191f0543b1d16555025814d235
- MD5 45a12d083b841153dc6cb2a090dbdf66
- SHA1 28aa9be740d8dbc55859473a859e933a6d795e4e
- SHA512 94ca0f9fb3f3c18a2d401a4261216ce60fb214def457f55aa3c04bdd1978876538a72c19a920aa5f3d605d5744e58095b37bf0052001c42922ccd12ca457e651
- SSDEEP 3072:Jxu2TTd8qIjOzyXWexqJULPMAyqRxMST5029y7e9j+2:ju2TOqMOzyHjPtKexp
- TLSH
  T1B1145C5673E510F9E1778238C9A14A16F77378664B609BDF03A0837A9F236D09D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  bitsumsessionagent.exe
- Size 180KB
- SHA256 ce0d1360254dc72b49830fcdf118569b8d5e65b52758250f50222978d607a221
- MD5 2708601240008e5d40d1ecb7e28c1bc2
- SHA1 12919f194ba69cf777bbb76ecaf69107a6af9096
- SHA512 4e61322195746761e84613826447b13162c3ec72e4a3eb202198e07cc769779f6ff19cca9a43803d62bdf3a3db4c66b5af90583c1a86dba6f684f68c13d88fe1
- SSDEEP 3072:0aNn5AwjVsJu3hE38kojLVJ6DYr3HnT5xH+ng2H:0aBWJuA2XnD+nH
- TLSH
  T142046C5673E510F9E1778234C9A11A05F772B82207609BEF17B08376AF276D19E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  pl-update.cmd
- Size 40B
- SHA256 ab965ed0402b4c474fe6c988afee9957c5494c687745114fc80d1fb70fb071bb
- MD5 cd60ccd708d428df44ca1d454ad0d68e
- SHA1 83e3fb9ef19c7d3faabc0b391f96803652fda425
- SHA512 b400530473683de0f7cba3f206b38ba1a0a4d3156a06168c3db0391eb33be1cb6fa65e736c746067aac394d538fc35de8764c30978734bcf4e84392b3294c10c
- MD5 SHA1 SHA512
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Checks computer location settings

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32