Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - user interaction
yes - max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 16:18
Behavioral task
behavioral1
Sample
Process Lasso 18.3.0.34.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Process Lasso 18.3.0.34.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
Behavioral task
behavioral3
Sample
_Silent Install.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral4
Sample
_Silent Install.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
Behavioral task
behavioral5
Sample
_Unpack Portable.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target Process Lasso 18.3.0.34.exe
- Size 5.4MB
- Sample260925-tr5bjavyht
- SHA256 a17a72a527f3a3789d153de27232f3cbf25f6a923611d167e0f7ed757f93e1d5
- MD5 3810ac63610f1b1e0fdbf1106bbd4953
- SHA1 3b03a8f4ab0e797cd59c15fbb53345c25b59ec2e
- SHA512 65bbe143f9228b174820034a90867357a6e50ce14393a5de703d55f04f5a14989f4406dc177471eb78cf08dbabb3f3657d600f87dc08adce2e173010c2607787
- SSDEEP 98304:P5sI+4xhhSnZw2+zx9O+rsy7ud1MYDZjPNm:eI+4Jm819TCDZrNm
- TLSH T1884633E39CA168B9F033DF705F691C42BED7274CA432B57E7DAA68009FE4721E625250
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 13 IoCs
pid Process 4852 Process Lasso 18.3.0.34.tmp 4068 installHelper.exe 1552 installHelper.exe 5212 installHelper.exe 3236 installHelper.exe 4272 syspin.exe 2384 srvstub.exe 4792 bitsumsessionagent.exe 2200 ProcessLasso.exe 4428 bitsumsessionagent.exe 5576 srvstub.exe 5044 processgovernor.exe 2052 ProcessLasso.exe - Loads dropped DLL 14 IoCs
pid Process 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4068 installHelper.exe 1552 installHelper.exe 5212 installHelper.exe 3236 installHelper.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 5044 processgovernor.exe 5044 processgovernor.exe 2052 ProcessLasso.exe 2052 ProcessLasso.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 40 IoCs
description ioc Process File opened for modification C:\Program Files\Process Lasso\ProcessLassoLauncher.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\ThreadRacer.exe Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\unins000.dat Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\TweakScheduler.exe Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-E975V.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-LJ32Q.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\bitsumsessionagent.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\CPUEater.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\Insights.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\testlasso.exe Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-5GSJR.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-RM55R.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-URM5B.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-8CJ0E.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\InstallHelper.exe Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-EP19F.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-5O35O.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-9KVJ7.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-JUC3R.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-N356S.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-D1L28.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\srvstub.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\vistammsc.exe Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-3DUQE.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-45JLC.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-4PH1M.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\ProcessGovernor.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\LogViewer.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_english.dll Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_russian.dll Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\ProcessLasso.exe Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-NMKCR.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-T1KJC.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\QuickUpgrade.exe Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-L84E4.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-JV7CS.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-8SP94.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-3EHEO.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-09T73.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\unins000.dat Process Lasso 18.3.0.34.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process Lasso 18.3.0.34.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process Lasso 18.3.0.34.tmp - Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/2484-1-0x0000000000400000-0x0000000000416000-memory.dmp innosetup behavioral2/memory/2484-96-0x0000000000400000-0x0000000000416000-memory.dmp innosetup - Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString installHelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 installHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString installHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString installHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ProcessLasso.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 processgovernor.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString processgovernor.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 installHelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 installHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString installHelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessLasso.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessLasso.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ProcessLasso.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 installHelper.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\ProcessLasso processgovernor.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\ProcessLasso\Language = "1033" processgovernor.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\ProcessLasso\InstallerLanguageDWORD = "1033" processgovernor.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\ProcessLasso processgovernor.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\ProcessLasso\ProcessLasso = 09040000 processgovernor.exe - Modifies registry class 6 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\NotificationData explorer.exe - Runs .reg file with regedit 1 IoCs
pid Process 1116 regedit.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4772 explorer.exe 2200 ProcessLasso.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4068 installHelper.exe Token: SeDebugPrivilege 4068 installHelper.exe Token: SeChangeNotifyPrivilege 4068 installHelper.exe Token: SeIncBasePriorityPrivilege 4068 installHelper.exe Token: SeIncreaseQuotaPrivilege 4068 installHelper.exe Token: SeProfSingleProcessPrivilege 4068 installHelper.exe Token: SeAssignPrimaryTokenPrivilege 1552 installHelper.exe Token: SeDebugPrivilege 1552 installHelper.exe Token: SeChangeNotifyPrivilege 1552 installHelper.exe Token: SeIncBasePriorityPrivilege 1552 installHelper.exe Token: SeIncreaseQuotaPrivilege 1552 installHelper.exe Token: SeProfSingleProcessPrivilege 1552 installHelper.exe Token: SeAssignPrimaryTokenPrivilege 5212 installHelper.exe Token: SeDebugPrivilege 5212 installHelper.exe Token: SeChangeNotifyPrivilege 5212 installHelper.exe Token: SeIncBasePriorityPrivilege 5212 installHelper.exe Token: SeIncreaseQuotaPrivilege 5212 installHelper.exe Token: SeProfSingleProcessPrivilege 5212 installHelper.exe Token: SeAssignPrimaryTokenPrivilege 3236 installHelper.exe Token: SeDebugPrivilege 3236 installHelper.exe Token: SeChangeNotifyPrivilege 3236 installHelper.exe Token: SeIncBasePriorityPrivilege 3236 installHelper.exe Token: SeIncreaseQuotaPrivilege 3236 installHelper.exe Token: SeProfSingleProcessPrivilege 3236 installHelper.exe Token: SeShutdownPrivilege 4772 explorer.exe Token: SeCreatePagefilePrivilege 4772 explorer.exe Token: SeAssignPrimaryTokenPrivilege 2384 srvstub.exe Token: SeCreateGlobalPrivilege 2384 srvstub.exe Token: SeShutdownPrivilege 4772 explorer.exe Token: SeCreatePagefilePrivilege 4772 explorer.exe Token: SeShutdownPrivilege 4772 explorer.exe Token: SeCreatePagefilePrivilege 4772 explorer.exe Token: SeShutdownPrivilege 4772 explorer.exe Token: SeCreatePagefilePrivilege 4772 explorer.exe Token: SeAssignPrimaryTokenPrivilege 2200 ProcessLasso.exe Token: SeDebugPrivilege 2200 ProcessLasso.exe Token: SeChangeNotifyPrivilege 2200 ProcessLasso.exe Token: SeIncBasePriorityPrivilege 2200 ProcessLasso.exe Token: SeIncreaseQuotaPrivilege 2200 ProcessLasso.exe Token: SeCreateGlobalPrivilege 2200 ProcessLasso.exe Token: SeProfSingleProcessPrivilege 2200 ProcessLasso.exe Token: SeBackupPrivilege 2200 ProcessLasso.exe Token: SeRestorePrivilege 2200 ProcessLasso.exe Token: SeShutdownPrivilege 2200 ProcessLasso.exe Token: SeShutdownPrivilege 4772 explorer.exe Token: SeCreatePagefilePrivilege 4772 explorer.exe Token: SeShutdownPrivilege 4772 explorer.exe Token: SeCreatePagefilePrivilege 4772 explorer.exe Token: SeShutdownPrivilege 4772 explorer.exe Token: SeCreatePagefilePrivilege 4772 explorer.exe Token: SeShutdownPrivilege 4772 explorer.exe Token: SeCreatePagefilePrivilege 4772 explorer.exe Token: SeShutdownPrivilege 4772 explorer.exe Token: SeCreatePagefilePrivilege 4772 explorer.exe Token: SeShutdownPrivilege 4772 explorer.exe Token: SeCreatePagefilePrivilege 4772 explorer.exe Token: SeShutdownPrivilege 4772 explorer.exe Token: SeCreatePagefilePrivilege 4772 explorer.exe Token: SeShutdownPrivilege 4772 explorer.exe Token: SeCreatePagefilePrivilege 4772 explorer.exe Token: SeShutdownPrivilege 4772 explorer.exe Token: SeCreatePagefilePrivilege 4772 explorer.exe Token: SeShutdownPrivilege 4772 explorer.exe Token: SeCreatePagefilePrivilege 4772 explorer.exe - Suspicious use of FindShellTrayWindow 46 IoCs
pid Process 4852 Process Lasso 18.3.0.34.tmp 4772 explorer.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe - Suspicious use of SendNotifyMessage 63 IoCs
pid Process 4772 explorer.exe 4772 explorer.exe 4772 explorer.exe 4772 explorer.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 4772 explorer.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 4772 explorer.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 4772 explorer.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 4772 explorer.exe 4772 explorer.exe 4772 explorer.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 4772 explorer.exe 4772 explorer.exe 4772 explorer.exe 4772 explorer.exe 4772 explorer.exe 4772 explorer.exe 4772 explorer.exe 4772 explorer.exe 4772 explorer.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe 2200 ProcessLasso.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4852 Process Lasso 18.3.0.34.tmp 4772 explorer.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2484 wrote to memory of 4852 2484 Process Lasso 18.3.0.34.exe 89 PID 4852 wrote to memory of 1116 4852 Process Lasso 18.3.0.34.tmp 90 PID 4852 wrote to memory of 4068 4852 Process Lasso 18.3.0.34.tmp 91 PID 4852 wrote to memory of 1552 4852 Process Lasso 18.3.0.34.tmp 92 PID 4852 wrote to memory of 5212 4852 Process Lasso 18.3.0.34.tmp 93 PID 4852 wrote to memory of 3236 4852 Process Lasso 18.3.0.34.tmp 94 PID 4852 wrote to memory of 4272 4852 Process Lasso 18.3.0.34.tmp 95 PID 4272 wrote to memory of 4772 4272 syspin.exe 81 PID 4272 wrote to memory of 4772 4272 syspin.exe 81 PID 4772 wrote to memory of 2404 4772 explorer.exe PID 4772 wrote to memory of 1528 4772 explorer.exe PID 4772 wrote to memory of 4624 4772 explorer.exe PID 5576 wrote to memory of 5044 5576 srvstub.exe 106 PID 4772 wrote to memory of 2052 4772 explorer.exe 107 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\Process Lasso 18.3.0.34.exe"C:\Users\Admin\AppData\Local\Temp\Process Lasso 18.3.0.34.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\is-HQHI5.tmp\Process Lasso 18.3.0.34.tmp"C:\Users\Admin\AppData\Local\Temp\is-HQHI5.tmp\Process Lasso 18.3.0.34.tmp" /SL5="$80214,5298690,60928,C:\Users\Admin\AppData\Local\Temp\Process Lasso 18.3.0.34.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\regedit.exe"C:\Windows\regedit.exe" /S "C:\Users\Admin\AppData\Local\Temp\settings.reg"4⤵
- Runs .reg file with regedit
PID:1116
-
-
C:\Program Files\Process Lasso\installHelper.exe"C:\Program Files\Process Lasso\installHelper.exe" /firstinstall4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4068
-
-
C:\Program Files\Process Lasso\installHelper.exe"C:\Program Files\Process Lasso\installHelper.exe" /migrate4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1552
-
-
C:\Program Files\Process Lasso\installHelper.exe"C:\Program Files\Process Lasso\installHelper.exe" /powerinstall4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5212
-
-
C:\Program Files\Process Lasso\installHelper.exe"C:\Program Files\Process Lasso\installHelper.exe" /install4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3236
-
-
C:\Users\Admin\AppData\Local\Temp\is-BCIGJ.tmp\syspin.exe"C:\Users\Admin\AppData\Local\Temp\is-BCIGJ.tmp\syspin.exe" "C:\Program Files\Process Lasso\ProcessLasso.exe" c:53864⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272
-
-
-
-
C:\Program Files\Process Lasso\ProcessLasso.exe"C:\Program Files\Process Lasso\ProcessLasso.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:2052
-
-
C:\Program Files\Process Lasso\srvstub.exe"C:\Program Files\Process Lasso\srvstub.exe" "C:\Program Files\Process Lasso\processgovernor.exe" "ProcessGovernor" /exitevent:Global\ProcessGovernorExitEvent1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2384
-
C:\Program Files\Process Lasso\bitsumsessionagent.exe"C:\Program Files\Process Lasso\bitsumsessionagent.exe"1⤵
- Executes dropped EXE
PID:4792
-
C:\Program Files\Process Lasso\ProcessLasso.exe"C:\Program Files\Process Lasso\processlasso.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2200
-
C:\Program Files\Process Lasso\bitsumsessionagent.exe"C:\Program Files\Process Lasso\bitsumsessionagent.exe" ----------------------------------------------------------------1⤵
- Executes dropped EXE
PID:4428
-
C:\Program Files\Process Lasso\srvstub.exe"C:\Program Files\Process Lasso\srvstub.exe" "C:\Program Files\Process Lasso\processgovernor.exe" "ProcessGovernor" /exitevent:Global\ProcessGovernorExitEvent1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Program Files\Process Lasso\processgovernor.exe"C:\Program Files\Process Lasso\processgovernor.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:5044
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Process Lasso\InstallHelper.exe
- Size 875KB
- SHA256 9e1134a5cde9e5daad1d0a65f54667223991123de9d430b9f9093d04f504e388
- MD5 4e5e0104576f11e702ecabb30524909b
- SHA1 eef1379880bd681f3b6ad547ecafef96119e2e2d
- SHA512 bb496f86ced7fafb2ac70b10d56881c6776534f9dbe359ba6ad37239597349df0908508bc03f21f7f681237ad9a58a5bf8b4ae7c9289f31a26d3c5962a10197e
- SSDEEP 12288:kKt/OU7GH/C8rtN0JFfWeG86yeLWZJhBlRq9J19KGZa:kY/OFq8rtN0JFfWeG81UWnjG1fZa
- TLSH T12615B1D056B649ACD069CD3C8991CC9AF9EB7D0C463D7ABB027438580F3EB994A74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Lasso\ProcessGovernor.exe
- Size 1.3MB
- SHA256 a4bab6d10422bb53be17044a9a92a75c32deb944656eb0de1953845ddc33d549
- MD5 0bf29e819f9f89032e07c392ffcd9c12
- SHA1 ad6a8a9d9c54d1fea78aed3c620d3a339f1401e9
- SHA512 c1d04ce764f24747a28f0deb1337f0618a598a3e6cd8cdb1d5b7c7eabe3dac54b98024bf4987889d2471c385858263215df3b7cececd65a68629e96e413f3a19
- SSDEEP 24576:6sWvHbfaQWy/JVM4IQd4uEma5X5ZehTbGL+vldvk5HgAEWmGzs:6jrWylIQdhEma5veVbGsrVzT
- TLSH T1EC5528D416B905ACE066D97C8A81CC8AE5EB7C0D073D7AFB02B036591F3EBD50A79E11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Lasso\ProcessLasso.exe
- Size 2.5MB
- SHA256 4c64811bdca53b955d1d216e6a46598bcbb415d5874ab226cbc2b5b96dff7451
- MD5 2fc66b7449d68cb94ee4774bdf2cd656
- SHA1 0d5b7e39a81b5c9102d93b5ac73396c5c0df456e
- SHA512 0d14949c18d9eb2615d69499a64cfdb6d5b197a2d0e5a5366e471bc8a380d752b42f70872cbad354ddcb0ce68bcc23179e72505f9074b7256b74b222dd91730f
- SSDEEP 49152:nkIe/Smnix+rEPYZL4hRyAlScItq/hCW3EAmi:xDooyM/6Ev
- TLSH T11BC549A521B801ADE076C57C89858D5BE5FB7C0D173979FB0160B9581F3FBEA0A38E12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Lasso\bitsumsessionagent.exe
- Size 180KB
- SHA256 6425100982bf47c2ea13f03a5b14f0446af45184d119a5b507af5441787984c8
- MD5 28fde8a972a76670e7ccae1a164d1b6c
- SHA1 ca95499e75456bfebb71c4adbdd93c81aa22d979
- SHA512 5868a373e6f9fcde3da1d5013fc77302dfc1907e3ce8fd02f4b744c1ac9b22426821876471ef60be0034ecda39d8e2c5c9d99edf6258d1a855883f6d8478cc48
- SSDEEP 3072:gaNn5AwjVsJu3hE38kojLVJ6D4rXHnT5xH+HY2K:gaBWJuA23nD+PK
- TLSH T1B4045C5673E510F9E1778234C9A11A05F772B82207609BEF17B08376AF276D19E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Lasso\pl_rsrc_english.dll
- Size 1.9MB
- SHA256 b361eda89686f8a34b6165ee73a5dd46fe3a1af98e5110a0ea4f256b13188f5a
- MD5 ab593d45096d29c8559d5644e0f7996c
- SHA1 5e0fd59cfbb46a89696c2bac039dabb217927285
- SHA512 3378186a6f41e339eb11e5c145722f2ec6b54f5ddb80cabc33377c71ac5b4bc5a08c4e5a10ede0ee673580e726446a9557f4435f2f42a0c3fca4ccd3124ec66d
- SSDEEP 6144:1fFa9MmhuV2FFdq7qFrwnim0gsZEeV3dyvl22UjFC8fB4adLxp7WGCNE/Jt1icNY:1fcHoozFzLXKGh4ZJe6cwTqREewRDz
- TLSH T1829571CE12FADC58F179EE781DA04E5818D73C8DE838B13D3A31711E99786669828F53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Lasso\srvstub.exe
- Size 131KB
- SHA256 8d13b0bbf5fc71782d9cd7d355f69ec7316ce98ac447a68517e6d742ef259212
- MD5 41af51a0e0e2aeaadcb737907c991dfe
- SHA1 e57bfd6a880a78bf913a6058bd9321dbb2f3c35d
- SHA512 b72edc0446709c963d9cca596cde535d625cee2928e600e36c7b32d1a8fa5be08b763ccf7785575fc72177b56f64bb2fb07e0d715397395ec349b638703cdeaf
- SSDEEP 3072:TEYvuYeweXlgl3ku3f+p9J6BFsvJDT+wOCwPnvUOar2H:Y21eO3ku3WbJ6/nvp/H
- TLSH T1A0D36C57B3E530F8E1778579C4A1170AE772B8721BA09BDF03A046652F236D09E3EB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Process Lasso\Process Lasso.lnk
- Size 933B
- SHA256 87f53f314e6758d5e4871239bd7c3df553ad42c5bf80233ae5cdcde088e3e814
- MD5 237033efca557d81467051263ac10082
- SHA1 911a5ca6d1eb3e100e961482cd20a2e90f9aa208
- SHA512 02e1b87015f213228d8272e02fc7d187eabab26e6f2aec2b68f35639d9f73b0745eb55c6485536beaad07ad64495249404ee9449811c9f609f42d6390ba2965b
- TLSH T1A811891543F62795F27A8C321A7926738BB3F801CFA50B2E118A429649B4160CD78F9B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Process Lasso\Uninstall.lnk
- Size 937B
- SHA256 3f26d5bf3617962465f1f187cd21e5ffc9d060bdc7e36331f97dd13faf8f7c2d
- MD5 d5056cf1e75f274ecaabe87115e9d6a1
- SHA1 22090e601da8c99eb5f22c4603b90d1eac0116d8
- SHA512 e7cfe069f69771dc18d4b7a091dfca0a976cc97a6c9ad76d0a3c6ddd2690314e3a4813a0a4a99686a9b58b5751f4509db38c5d418df37749542f4dd3b8252251
- TLSH T19911B11547E32B44E27289321EB16BB34B77FC008F75072E49C5578348A5140C97CFAA
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ProcessLasso\config\prolasso.ini
- Size 9KB
- SHA256 a24dcc3a3cdac5ca52300478133b0439c454724724b0f34632c0a3eaa295f236
- MD5 2f53935f55639291466c0ce29be41f77
- SHA1 7a8d5aca0a3f036aa438d57775d1d31ca1e5d3dd
- SHA512 e13120bdde477e7586065853bfdda9f46f86988f8030e1feab343f4b8e94af47dd4f3ae216960d18509b6e3fd01b653d5ef512d58516a10f5accdc239c0c33fc
- SSDEEP 192:gCU8hjD6xebh7kFaMm3aIm6XKWYFcCZiONkMN6GWYsaEeAu2:g18hjD7t7zHaIm6XKWYFcKiONkMN6GWd
- TLSH T1B1227B9397F92008F2BB1F64EEB868B64BB7BC665E19C49D41D4010D05F1E90D9B23B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\ProcessLasso\logs\processlasso.log
- Size 786B
- SHA256 05d6f4926a0c5449c974af95e4d1426577b618787daa64541d169db88ca5ad1c
- MD5 7b0d5d673371502bd5bcab614f8d0846
- SHA1 72d84d718297e92f898787e20ea2fdaadf403840
- SHA512 672cb1facc8aeffa465ebe2fbe9bd402da710141c24eaefe1af6d73e016fdcbdc6385a8851d9097a0e3cfafdec4a8a8796bd4c3630c349afd3571572103ed659
- TLSH T16201F11DD0AF6D4299CE5A9133951D6B8CABF604814F8EBD21EBDB2F7B5840D0087915
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-BCIGJ.tmp\ISTask.dll
- Size 66KB
- SHA256 e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d
- MD5 86a1311d51c00b278cb7f27796ea442e
- SHA1 ac08ac9d08f8f5380e2a9a65f4117862aa861a19
- SHA512 129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec
- SSDEEP 1536:KVqiEnH9RGX9xXLUWB1GOlb3MvH4xK+RRlm9A:isGX3Vwwbc6Rlm9A
- TLSH T138635C07B6D08676E072AFBC5C39A214A63B7D353D35D0ADABB90D8D4E282C29D4C357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-BCIGJ.tmp\VclStylesInno.dll
- Size 3.0MB
- SHA256 0e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
- MD5 b0ca93ceb050a2feff0b19e65072bbb5
- SHA1 7ebbbbe2d2acd8fd516f824338d254a33b69f08d
- SHA512 37242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2
- SSDEEP 49152:fvdCka90J5FJ8n2uRrH12SSSAt4VOZkT7LZc8/:fg65FOnRZAt4VObK
- TLSH T12EE56C27B2447A3EC0AB1B3D983BA294AD3FB71177179C5A5BF40C8C8E35580393A597
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-BCIGJ.tmp\syspin.exe
- Size 19KB
- SHA256 a6967e7a3c2251812dd6b3fa0265fb7b61aadc568f562a98c50c345908c6e827
- MD5 44b878919f79e365120f1c960434870b
- SHA1 c8131976421b07782a1c913eb5996581a277e047
- SHA512 e9fd65eb9e01ec40d67b558e3a4be4ae24766436ed8f60b62e75cef07f2f983b3df4d7963f23d23007acee12f151359d7d3861663348ef2b360e14a84bf3d2ee
- SSDEEP 384:2nxXQUwHGV3NeGDVx9JB2zM2tTiB3pB8uRP:2nxXVwHwxD39JB2zyZ3d
- TLSH T1CA924B64A7A94921E5BA1E789951442383393944883A470F370CDEDF3FB3291ADA4F37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-HQHI5.tmp\Process Lasso 18.3.0.34.tmp
- Size 907KB
- SHA256 2006b2b4d5eb64722f0bba35380057c9556a7e8bd4bf95b92cd68d84ba255be6
- MD5 3754a5eb2b26e9b6a89bd0690718351a
- SHA1 5356815f88cbcc512c74b401c5b1c89f8e950944
- SHA512 9ad991d58a60924650523f3e59a02389a7e729fbf73a0b20479c590375f40f041e0a7101604d7305ef8d7a8d57ba53e8823a75aa27441757881c604236ab0bec
- SSDEEP 24576:wkHgKPNrPA37hzHIA6/oR36vln6sYEubnhRgZtnTkDExlJr:w6frPA37hzHIA6/3UvjhRgZ9TZH
- TLSH T17D157C62F280C437C1A31E749E5786D5693BBE082E3879EB7BF91F4C4E3954139262D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Process Lasso.lnk
- Size 1KB
- SHA256 30571ed43f46a22a727c4e7dd6f7a823159e3b531a4dbfa429f64327817048d6
- MD5 58c7853c453a3755b933bd28ac77167b
- SHA1 f732a58c4e74dacd5010df1b159c1ad8fd70bbd5
- SHA512 2611c1058665516e876b349485e9fef72ae6b14a886a702c75296d214b658c782a3d2096bf07be422406b472911af5f1328b13e56dd29a4712dd7e24a74fc7f8
- TLSH T13621ED2843E22755E2368C355A7522738BB3BC01EFA40F3F01C6429718B4151D8B8F4F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\Process Lasso.lnk
- Size 943B
- SHA256 2570d71ff42c92b266ddfbe15c9dc270704d61a83b84ce846e202a40a153e466
- MD5 e6e86c5190004c55be521b8a5b93fe60
- SHA1 2f888aaccb538d9eb11923430ce3c57f714b111b
- SHA512 55a1c7054c6ce7c8dd47f0d834b4976135301c0d5037dc09533f6914787f0fff9adb6db2f5a0b9a028fd83aefe6b2ebfd4c3d8c7ecfe1a2554983f85000fb050
- TLSH T12F11892083F62295F17A4C321A792AB38BF3F4018F69073F418A426749B0560CD78F9B
- MD5 SHA1 SHA512 TLSH