Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - user interaction
yes - max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 16:18
Behavioral task
behavioral1
Sample
Process Lasso 18.3.0.34.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Process Lasso 18.3.0.34.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
Behavioral task
behavioral3
Sample
_Silent Install.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral4
Sample
_Silent Install.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
Behavioral task
behavioral5
Sample
_Unpack Portable.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target _Silent Install.cmd
- Size 1KB
- Sample260925-tr5bjavyht
- SHA256 6601cbe618dd90ef2daf02fb3fd41b492ea8b2afa2b234d3b7f483c432e4d78d
- MD5 1586fcb6353ba97337072ffc9a49e046
- SHA1 9e29a16a45b4a0a61e0c481ad20f5c278c3504d4
- SHA512 e36ef005c18bb0905d453afa3eb2eabd1c3552e72385fb1ba72992a0db440cedfc3f84ca1237c2479033e2ab1f81d18ec061941d046ff21704da66bd76ed4138
- TLSH T139115A773674E54C93B40F842D748522746122DB2DB20D50B57F403B87E46C8386CF5B
- MD5 SHA1 SHA512 TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 12 IoCs
pid Process 4016 Process Lasso 18.3.0.34.tmp 560 installHelper.exe 3480 installHelper.exe 2884 installHelper.exe 2260 installHelper.exe 2052 bitsumsessionagent.exe 2368 ProcessLasso.exe 2628 srvstub.exe 5344 bitsumsessionagent.exe 1924 srvstub.exe 876 processgovernor.exe 1616 ProcessLasso.exe - Loads dropped DLL 14 IoCs
pid Process 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 560 installHelper.exe 3480 installHelper.exe 2884 installHelper.exe 2260 installHelper.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 876 processgovernor.exe 876 processgovernor.exe 1616 ProcessLasso.exe 1616 ProcessLasso.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Process Lasso\QuickUpgrade.exe Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-FK9QO.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-M3KBA.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\ProcessLasso.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_japanese.dll Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\Insights.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\InstallHelper.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_slovenian.dll Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-6AQ29.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-975VS.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-RMML7.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-V6A9P.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-NT9CH.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-DFG4T.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_korean.dll Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\srvstub.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\vistammsc.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\TweakScheduler.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\CPUEater.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\LogViewer.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_french.dll Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-0N2HC.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-PUENJ.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-V0O1C.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_spanish.dll Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-05P75.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-1AI9P.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-K5M19.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_ptbr.dll Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_chinese.dll Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-I84C4.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-FMLT3.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-SLILV.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-TGUIL.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-QOFPI.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_italian.dll Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\testlasso.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_german.dll Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\unins000.dat Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-AI40D.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-3GNJ4.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-DU17H.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_polish.dll Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\ProcessGovernor.exe Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-V1MQ8.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-MMQNP.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_turkish.dll Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-D886Q.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-BHG0V.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-K935H.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-LL4I4.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_bulgarian.dll Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-4MUPJ.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-9RKQ7.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\bitsumsessionagent.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_english.dll Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_russian.dll Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_finnish.dll Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-M334M.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-61R9F.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\ProcessLassoLauncher.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\unins000.dat Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_chinese_traditional.dll Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\ThreadRacer.exe Process Lasso 18.3.0.34.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2812 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process Lasso 18.3.0.34.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process Lasso 18.3.0.34.tmp - Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
resource yara_rule behavioral3/memory/900-0-0x0000000000400000-0x0000000000416000-memory.dmp innosetup behavioral3/memory/900-177-0x0000000000400000-0x0000000000416000-memory.dmp innosetup - Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString installHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString installHelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 installHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString installHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ProcessLasso.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 processgovernor.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 installHelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 installHelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessLasso.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString processgovernor.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessLasso.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ProcessLasso.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString installHelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 installHelper.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\ProcessLasso\InstallerLanguageDWORD = "1033" processgovernor.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\ProcessLasso processgovernor.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\ProcessLasso\ProcessLasso = 09040000 processgovernor.exe Key created \REGISTRY\USER\.DEFAULT\Software\ProcessLasso processgovernor.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\ProcessLasso\Language = "1033" processgovernor.exe - Runs .reg file with regedit 1 IoCs
pid Process 1612 regedit.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp - Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 2368 ProcessLasso.exe 2052 bitsumsessionagent.exe 876 processgovernor.exe - Suspicious use of AdjustPrivilegeToken 57 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 560 installHelper.exe Token: SeDebugPrivilege 560 installHelper.exe Token: SeChangeNotifyPrivilege 560 installHelper.exe Token: SeIncBasePriorityPrivilege 560 installHelper.exe Token: SeIncreaseQuotaPrivilege 560 installHelper.exe Token: SeProfSingleProcessPrivilege 560 installHelper.exe Token: SeAssignPrimaryTokenPrivilege 3480 installHelper.exe Token: SeDebugPrivilege 3480 installHelper.exe Token: SeChangeNotifyPrivilege 3480 installHelper.exe Token: SeIncBasePriorityPrivilege 3480 installHelper.exe Token: SeIncreaseQuotaPrivilege 3480 installHelper.exe Token: SeProfSingleProcessPrivilege 3480 installHelper.exe Token: SeAssignPrimaryTokenPrivilege 2884 installHelper.exe Token: SeDebugPrivilege 2884 installHelper.exe Token: SeChangeNotifyPrivilege 2884 installHelper.exe Token: SeIncBasePriorityPrivilege 2884 installHelper.exe Token: SeIncreaseQuotaPrivilege 2884 installHelper.exe Token: SeProfSingleProcessPrivilege 2884 installHelper.exe Token: SeAssignPrimaryTokenPrivilege 2260 installHelper.exe Token: SeDebugPrivilege 2260 installHelper.exe Token: SeChangeNotifyPrivilege 2260 installHelper.exe Token: SeIncBasePriorityPrivilege 2260 installHelper.exe Token: SeIncreaseQuotaPrivilege 2260 installHelper.exe Token: SeProfSingleProcessPrivilege 2260 installHelper.exe Token: SeAssignPrimaryTokenPrivilege 2628 srvstub.exe Token: SeCreateGlobalPrivilege 2628 srvstub.exe Token: SeAssignPrimaryTokenPrivilege 2368 ProcessLasso.exe Token: SeDebugPrivilege 2368 ProcessLasso.exe Token: SeChangeNotifyPrivilege 2368 ProcessLasso.exe Token: SeIncBasePriorityPrivilege 2368 ProcessLasso.exe Token: SeIncreaseQuotaPrivilege 2368 ProcessLasso.exe Token: SeCreateGlobalPrivilege 2368 ProcessLasso.exe Token: SeProfSingleProcessPrivilege 2368 ProcessLasso.exe Token: SeBackupPrivilege 2368 ProcessLasso.exe Token: SeRestorePrivilege 2368 ProcessLasso.exe Token: SeShutdownPrivilege 2368 ProcessLasso.exe Token: SeAssignPrimaryTokenPrivilege 1924 srvstub.exe Token: SeCreateGlobalPrivilege 1924 srvstub.exe Token: SeAssignPrimaryTokenPrivilege 876 processgovernor.exe Token: SeDebugPrivilege 876 processgovernor.exe Token: SeChangeNotifyPrivilege 876 processgovernor.exe Token: SeIncBasePriorityPrivilege 876 processgovernor.exe Token: SeIncreaseQuotaPrivilege 876 processgovernor.exe Token: SeProfSingleProcessPrivilege 876 processgovernor.exe Token: SeCreateGlobalPrivilege 876 processgovernor.exe Token: SeBackupPrivilege 876 processgovernor.exe Token: SeRestorePrivilege 876 processgovernor.exe Token: SeAssignPrimaryTokenPrivilege 1616 ProcessLasso.exe Token: SeDebugPrivilege 1616 ProcessLasso.exe Token: SeChangeNotifyPrivilege 1616 ProcessLasso.exe Token: SeIncBasePriorityPrivilege 1616 ProcessLasso.exe Token: SeIncreaseQuotaPrivilege 1616 ProcessLasso.exe Token: SeCreateGlobalPrivilege 1616 ProcessLasso.exe Token: SeProfSingleProcessPrivilege 1616 ProcessLasso.exe Token: SeBackupPrivilege 1616 ProcessLasso.exe Token: SeRestorePrivilege 1616 ProcessLasso.exe Token: SeShutdownPrivilege 1616 ProcessLasso.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4016 Process Lasso 18.3.0.34.tmp 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe 2368 ProcessLasso.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp 4016 Process Lasso 18.3.0.34.tmp - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2812 wrote to memory of 900 2812 cmd.exe 89 PID 900 wrote to memory of 4016 900 Process Lasso 18.3.0.34.exe 90 PID 4016 wrote to memory of 1612 4016 Process Lasso 18.3.0.34.tmp 100 PID 4016 wrote to memory of 560 4016 Process Lasso 18.3.0.34.tmp 101 PID 4016 wrote to memory of 3480 4016 Process Lasso 18.3.0.34.tmp 102 PID 4016 wrote to memory of 2884 4016 Process Lasso 18.3.0.34.tmp 103 PID 4016 wrote to memory of 2260 4016 Process Lasso 18.3.0.34.tmp 104 PID 1924 wrote to memory of 876 1924 srvstub.exe 117 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_Silent Install.cmd"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\Process Lasso 18.3.0.34.exe"Process Lasso 18.3.0.34.exe" /SILENT2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\is-1IK5U.tmp\Process Lasso 18.3.0.34.tmp"C:\Users\Admin\AppData\Local\Temp\is-1IK5U.tmp\Process Lasso 18.3.0.34.tmp" /SL5="$E0112,5298690,60928,C:\Users\Admin\AppData\Local\Temp\Process Lasso 18.3.0.34.exe" /SILENT3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\regedit.exe"C:\Windows\regedit.exe" /S "C:\Users\Admin\AppData\Local\Temp\settings.reg"4⤵
- Runs .reg file with regedit
PID:1612
-
-
C:\Program Files\Process Lasso\installHelper.exe"C:\Program Files\Process Lasso\installHelper.exe" /firstinstall4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:560
-
-
C:\Program Files\Process Lasso\installHelper.exe"C:\Program Files\Process Lasso\installHelper.exe" /migrate4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3480
-
-
C:\Program Files\Process Lasso\installHelper.exe"C:\Program Files\Process Lasso\installHelper.exe" /powerinstall4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
C:\Program Files\Process Lasso\installHelper.exe"C:\Program Files\Process Lasso\installHelper.exe" /install4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2260
-
-
-
-
C:\Program Files\Process Lasso\ProcessLasso.exe"C:\Program Files\Process Lasso\processlasso.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2368
-
C:\Program Files\Process Lasso\bitsumsessionagent.exe"C:\Program Files\Process Lasso\bitsumsessionagent.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2052
-
C:\Program Files\Process Lasso\srvstub.exe"C:\Program Files\Process Lasso\srvstub.exe" "C:\Program Files\Process Lasso\processgovernor.exe" "ProcessGovernor" /exitevent:Global\ProcessGovernorExitEvent1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
C:\Program Files\Process Lasso\bitsumsessionagent.exe"C:\Program Files\Process Lasso\bitsumsessionagent.exe" ----------------------------------------------------------------1⤵
- Executes dropped EXE
PID:5344
-
C:\Program Files\Process Lasso\srvstub.exe"C:\Program Files\Process Lasso\srvstub.exe" "C:\Program Files\Process Lasso\processgovernor.exe" "ProcessGovernor" /exitevent:Global\ProcessGovernorExitEvent1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Program Files\Process Lasso\processgovernor.exe"C:\Program Files\Process Lasso\processgovernor.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:876
-
-
C:\Program Files\Process Lasso\ProcessLasso.exe"C:\Program Files\Process Lasso\ProcessLasso.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1616
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Process Lasso\InstallHelper.exe
- Size 875KB
- SHA256 9e1134a5cde9e5daad1d0a65f54667223991123de9d430b9f9093d04f504e388
- MD5 4e5e0104576f11e702ecabb30524909b
- SHA1 eef1379880bd681f3b6ad547ecafef96119e2e2d
- SHA512 bb496f86ced7fafb2ac70b10d56881c6776534f9dbe359ba6ad37239597349df0908508bc03f21f7f681237ad9a58a5bf8b4ae7c9289f31a26d3c5962a10197e
- SSDEEP 12288:kKt/OU7GH/C8rtN0JFfWeG86yeLWZJhBlRq9J19KGZa:kY/OFq8rtN0JFfWeG81UWnjG1fZa
- TLSH T12615B1D056B649ACD069CD3C8991CC9AF9EB7D0C463D7ABB027438580F3EB994A74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Lasso\ProcessGovernor.exe
- Size 1.3MB
- SHA256 a4bab6d10422bb53be17044a9a92a75c32deb944656eb0de1953845ddc33d549
- MD5 0bf29e819f9f89032e07c392ffcd9c12
- SHA1 ad6a8a9d9c54d1fea78aed3c620d3a339f1401e9
- SHA512 c1d04ce764f24747a28f0deb1337f0618a598a3e6cd8cdb1d5b7c7eabe3dac54b98024bf4987889d2471c385858263215df3b7cececd65a68629e96e413f3a19
- SSDEEP 24576:6sWvHbfaQWy/JVM4IQd4uEma5X5ZehTbGL+vldvk5HgAEWmGzs:6jrWylIQdhEma5veVbGsrVzT
- TLSH T1EC5528D416B905ACE066D97C8A81CC8AE5EB7C0D073D7AFB02B036591F3EBD50A79E11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Lasso\ProcessLasso.exe
- Size 2.5MB
- SHA256 4c64811bdca53b955d1d216e6a46598bcbb415d5874ab226cbc2b5b96dff7451
- MD5 2fc66b7449d68cb94ee4774bdf2cd656
- SHA1 0d5b7e39a81b5c9102d93b5ac73396c5c0df456e
- SHA512 0d14949c18d9eb2615d69499a64cfdb6d5b197a2d0e5a5366e471bc8a380d752b42f70872cbad354ddcb0ce68bcc23179e72505f9074b7256b74b222dd91730f
- SSDEEP 49152:nkIe/Smnix+rEPYZL4hRyAlScItq/hCW3EAmi:xDooyM/6Ev
- TLSH T11BC549A521B801ADE076C57C89858D5BE5FB7C0D173979FB0160B9581F3FBEA0A38E12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Lasso\bitsumsessionagent.exe
- Size 180KB
- SHA256 6425100982bf47c2ea13f03a5b14f0446af45184d119a5b507af5441787984c8
- MD5 28fde8a972a76670e7ccae1a164d1b6c
- SHA1 ca95499e75456bfebb71c4adbdd93c81aa22d979
- SHA512 5868a373e6f9fcde3da1d5013fc77302dfc1907e3ce8fd02f4b744c1ac9b22426821876471ef60be0034ecda39d8e2c5c9d99edf6258d1a855883f6d8478cc48
- SSDEEP 3072:gaNn5AwjVsJu3hE38kojLVJ6D4rXHnT5xH+HY2K:gaBWJuA23nD+PK
- TLSH T1B4045C5673E510F9E1778234C9A11A05F772B82207609BEF17B08376AF276D19E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Lasso\pl_rsrc_english.dll
- Size 1.9MB
- SHA256 b361eda89686f8a34b6165ee73a5dd46fe3a1af98e5110a0ea4f256b13188f5a
- MD5 ab593d45096d29c8559d5644e0f7996c
- SHA1 5e0fd59cfbb46a89696c2bac039dabb217927285
- SHA512 3378186a6f41e339eb11e5c145722f2ec6b54f5ddb80cabc33377c71ac5b4bc5a08c4e5a10ede0ee673580e726446a9557f4435f2f42a0c3fca4ccd3124ec66d
- SSDEEP 6144:1fFa9MmhuV2FFdq7qFrwnim0gsZEeV3dyvl22UjFC8fB4adLxp7WGCNE/Jt1icNY:1fcHoozFzLXKGh4ZJe6cwTqREewRDz
- TLSH T1829571CE12FADC58F179EE781DA04E5818D73C8DE838B13D3A31711E99786669828F53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Lasso\srvstub.exe
- Size 131KB
- SHA256 8d13b0bbf5fc71782d9cd7d355f69ec7316ce98ac447a68517e6d742ef259212
- MD5 41af51a0e0e2aeaadcb737907c991dfe
- SHA1 e57bfd6a880a78bf913a6058bd9321dbb2f3c35d
- SHA512 b72edc0446709c963d9cca596cde535d625cee2928e600e36c7b32d1a8fa5be08b763ccf7785575fc72177b56f64bb2fb07e0d715397395ec349b638703cdeaf
- SSDEEP 3072:TEYvuYeweXlgl3ku3f+p9J6BFsvJDT+wOCwPnvUOar2H:Y21eO3ku3WbJ6/nvp/H
- TLSH T1A0D36C57B3E530F8E1778579C4A1170AE772B8721BA09BDF03A046652F236D09E3EB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\ProcessLasso\config\prolasso.ini
- Size 9KB
- SHA256 a24dcc3a3cdac5ca52300478133b0439c454724724b0f34632c0a3eaa295f236
- MD5 2f53935f55639291466c0ce29be41f77
- SHA1 7a8d5aca0a3f036aa438d57775d1d31ca1e5d3dd
- SHA512 e13120bdde477e7586065853bfdda9f46f86988f8030e1feab343f4b8e94af47dd4f3ae216960d18509b6e3fd01b653d5ef512d58516a10f5accdc239c0c33fc
- SSDEEP 192:gCU8hjD6xebh7kFaMm3aIm6XKWYFcCZiONkMN6GWYsaEeAu2:g18hjD7t7zHaIm6XKWYFcKiONkMN6GWd
- TLSH T1B1227B9397F92008F2BB1F64EEB868B64BB7BC665E19C49D41D4010D05F1E90D9B23B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\ProcessLasso\logs\processlasso.log
- Size 783B
- SHA256 6791f84ace6ed9fa4858a9bd2ba2939dd22525b4c598bee8dbb70f579429b43e
- MD5 794616e9d1985d0061af902645be39d1
- SHA1 23e45d6be6057113fc31c898e960c5497323a100
- SHA512 053cb87213230269e6dbd19632e07b19f16a8535ff36cb220f9289a541836b72026b4fbbb9ec4907426be554f69661033af7b67e61343dcc2f015c4395c15ba0
- TLSH T139014D09E0DD8D0F80CD594133820E728CDAFA49C20A823D28AFCB577F0851E00C3A24
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-1IK5U.tmp\Process Lasso 18.3.0.34.tmp
- Size 907KB
- SHA256 2006b2b4d5eb64722f0bba35380057c9556a7e8bd4bf95b92cd68d84ba255be6
- MD5 3754a5eb2b26e9b6a89bd0690718351a
- SHA1 5356815f88cbcc512c74b401c5b1c89f8e950944
- SHA512 9ad991d58a60924650523f3e59a02389a7e729fbf73a0b20479c590375f40f041e0a7101604d7305ef8d7a8d57ba53e8823a75aa27441757881c604236ab0bec
- SSDEEP 24576:wkHgKPNrPA37hzHIA6/oR36vln6sYEubnhRgZtnTkDExlJr:w6frPA37hzHIA6/3UvjhRgZ9TZH
- TLSH T17D157C62F280C437C1A31E749E5786D5693BBE082E3879EB7BF91F4C4E3954139262D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-SO4SP.tmp\ISTask.dll
- Size 66KB
- SHA256 e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d
- MD5 86a1311d51c00b278cb7f27796ea442e
- SHA1 ac08ac9d08f8f5380e2a9a65f4117862aa861a19
- SHA512 129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec
- SSDEEP 1536:KVqiEnH9RGX9xXLUWB1GOlb3MvH4xK+RRlm9A:isGX3Vwwbc6Rlm9A
- TLSH T138635C07B6D08676E072AFBC5C39A214A63B7D353D35D0ADABB90D8D4E282C29D4C357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-SO4SP.tmp\VclStylesInno.dll
- Size 3.0MB
- SHA256 0e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
- MD5 b0ca93ceb050a2feff0b19e65072bbb5
- SHA1 7ebbbbe2d2acd8fd516f824338d254a33b69f08d
- SHA512 37242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2
- SSDEEP 49152:fvdCka90J5FJ8n2uRrH12SSSAt4VOZkT7LZc8/:fg65FOnRZAt4VObK
- TLSH T12EE56C27B2447A3EC0AB1B3D983BA294AD3FB71177179C5A5BF40C8C8E35580393A597
- MD5 SHA1 SHA512 SSDEEP TLSH