Analysis
- geolocation tags
cacanadananorth-americatoronto - max time kernel
149s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 16:18
Behavioral task
behavioral1
Sample
Process Lasso 18.3.0.34.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Process Lasso 18.3.0.34.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
Behavioral task
behavioral3
Sample
_Silent Install.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral4
Sample
_Silent Install.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
Behavioral task
behavioral5
Sample
_Unpack Portable.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target _Silent Install.cmd
- Size 1KB
- Sample260925-tr5bjavyht
- SHA256 6601cbe618dd90ef2daf02fb3fd41b492ea8b2afa2b234d3b7f483c432e4d78d
- MD5 1586fcb6353ba97337072ffc9a49e046
- SHA1 9e29a16a45b4a0a61e0c481ad20f5c278c3504d4
- SHA512 e36ef005c18bb0905d453afa3eb2eabd1c3552e72385fb1ba72992a0db440cedfc3f84ca1237c2479033e2ab1f81d18ec061941d046ff21704da66bd76ed4138
- TLSH T139115A773674E54C93B40F842D748522746122DB2DB20D50B57F403B87E46C8386CF5B
- MD5 SHA1 SHA512 TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 2292 Process Lasso 18.3.0.34.tmp 3116 installHelper.exe 1068 installHelper.exe 5452 installHelper.exe 4264 installHelper.exe 1304 bitsumsessionagent.exe 3772 srvstub.exe 2564 ProcessLasso.exe 3140 bitsumsessionagent.exe 1300 srvstub.exe 1136 processgovernor.exe - Loads dropped DLL 12 IoCs
pid Process 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 3116 installHelper.exe 1068 installHelper.exe 5452 installHelper.exe 4264 installHelper.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 1136 processgovernor.exe 1136 processgovernor.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Process Lasso\pl_rsrc_english.dll Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_ptbr.dll Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-G6ALH.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-J8L1P.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-GKQNN.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_russian.dll Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_japanese.dll Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-0SN61.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-STF4R.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_bulgarian.dll Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\ThreadRacer.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\ProcessLasso.exe Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-TKA4Q.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-35HLR.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\CPUEater.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_korean.dll Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_polish.dll Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-9QIM7.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\vistammsc.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\testlasso.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_chinese.dll Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-PTEGP.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-GMO2R.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-BDKQ5.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\bitsumsessionagent.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\ProcessGovernor.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\srvstub.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_finnish.dll Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_turkish.dll Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-K8LQ4.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-PJNJF.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_french.dll Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-C33AN.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-1QA8H.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-H7DOK.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-PR2LM.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\Insights.exe Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-SG6OC.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-5Q6G7.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\LogViewer.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\ProcessLassoLauncher.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_italian.dll Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_spanish.dll Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\unins000.dat Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-SGU7C.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-PNG24.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-76JDB.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\QuickUpgrade.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\TweakScheduler.exe Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_german.dll Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_slovenian.dll Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-UB1O5.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-1CNHT.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-NC8P9.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-6UALS.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-2U7MN.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-VPPVV.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-I5M40.tmp Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\unins000.dat Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\pl_rsrc_chinese_traditional.dll Process Lasso 18.3.0.34.tmp File opened for modification C:\Program Files\Process Lasso\InstallHelper.exe Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-6D5I9.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-K9DP2.tmp Process Lasso 18.3.0.34.tmp File created C:\Program Files\Process Lasso\is-G265N.tmp Process Lasso 18.3.0.34.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4328 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process Lasso 18.3.0.34.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process Lasso 18.3.0.34.tmp - Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
resource yara_rule behavioral4/memory/704-0-0x0000000000400000-0x0000000000416000-memory.dmp innosetup - Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString installHelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessLasso.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ProcessLasso.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 processgovernor.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString processgovernor.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString installHelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 installHelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 installHelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 installHelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 installHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString installHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString installHelper.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\ProcessLasso\InstallerLanguageDWORD = "1033" processgovernor.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\ProcessLasso processgovernor.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\ProcessLasso\ProcessLasso = 09040000 processgovernor.exe Key created \REGISTRY\USER\.DEFAULT\Software\ProcessLasso processgovernor.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\ProcessLasso\Language = "1033" processgovernor.exe - Runs .reg file with regedit 1 IoCs
pid Process 5072 regedit.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1304 bitsumsessionagent.exe 1136 processgovernor.exe - Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 3116 installHelper.exe Token: SeDebugPrivilege 3116 installHelper.exe Token: SeChangeNotifyPrivilege 3116 installHelper.exe Token: SeIncBasePriorityPrivilege 3116 installHelper.exe Token: SeIncreaseQuotaPrivilege 3116 installHelper.exe Token: SeProfSingleProcessPrivilege 3116 installHelper.exe Token: SeAssignPrimaryTokenPrivilege 1068 installHelper.exe Token: SeDebugPrivilege 1068 installHelper.exe Token: SeChangeNotifyPrivilege 1068 installHelper.exe Token: SeIncBasePriorityPrivilege 1068 installHelper.exe Token: SeIncreaseQuotaPrivilege 1068 installHelper.exe Token: SeProfSingleProcessPrivilege 1068 installHelper.exe Token: SeAssignPrimaryTokenPrivilege 5452 installHelper.exe Token: SeDebugPrivilege 5452 installHelper.exe Token: SeChangeNotifyPrivilege 5452 installHelper.exe Token: SeIncBasePriorityPrivilege 5452 installHelper.exe Token: SeIncreaseQuotaPrivilege 5452 installHelper.exe Token: SeProfSingleProcessPrivilege 5452 installHelper.exe Token: SeAssignPrimaryTokenPrivilege 4264 installHelper.exe Token: SeDebugPrivilege 4264 installHelper.exe Token: SeChangeNotifyPrivilege 4264 installHelper.exe Token: SeIncBasePriorityPrivilege 4264 installHelper.exe Token: SeIncreaseQuotaPrivilege 4264 installHelper.exe Token: SeProfSingleProcessPrivilege 4264 installHelper.exe Token: SeAssignPrimaryTokenPrivilege 3772 srvstub.exe Token: SeCreateGlobalPrivilege 3772 srvstub.exe Token: SeAssignPrimaryTokenPrivilege 2564 ProcessLasso.exe Token: SeDebugPrivilege 2564 ProcessLasso.exe Token: SeChangeNotifyPrivilege 2564 ProcessLasso.exe Token: SeIncBasePriorityPrivilege 2564 ProcessLasso.exe Token: SeIncreaseQuotaPrivilege 2564 ProcessLasso.exe Token: SeCreateGlobalPrivilege 2564 ProcessLasso.exe Token: SeProfSingleProcessPrivilege 2564 ProcessLasso.exe Token: SeBackupPrivilege 2564 ProcessLasso.exe Token: SeRestorePrivilege 2564 ProcessLasso.exe Token: SeShutdownPrivilege 2564 ProcessLasso.exe Token: SeAssignPrimaryTokenPrivilege 1300 srvstub.exe Token: SeCreateGlobalPrivilege 1300 srvstub.exe Token: SeAssignPrimaryTokenPrivilege 1136 processgovernor.exe Token: SeDebugPrivilege 1136 processgovernor.exe Token: SeChangeNotifyPrivilege 1136 processgovernor.exe Token: SeIncBasePriorityPrivilege 1136 processgovernor.exe Token: SeIncreaseQuotaPrivilege 1136 processgovernor.exe Token: SeProfSingleProcessPrivilege 1136 processgovernor.exe Token: SeCreateGlobalPrivilege 1136 processgovernor.exe Token: SeBackupPrivilege 1136 processgovernor.exe Token: SeRestorePrivilege 1136 processgovernor.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2292 Process Lasso 18.3.0.34.tmp 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe 2564 ProcessLasso.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp 2292 Process Lasso 18.3.0.34.tmp - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4328 wrote to memory of 704 4328 cmd.exe 90 PID 704 wrote to memory of 2292 704 Process Lasso 18.3.0.34.exe 91 PID 2292 wrote to memory of 5072 2292 Process Lasso 18.3.0.34.tmp 92 PID 2292 wrote to memory of 3116 2292 Process Lasso 18.3.0.34.tmp 93 PID 2292 wrote to memory of 1068 2292 Process Lasso 18.3.0.34.tmp 94 PID 2292 wrote to memory of 5452 2292 Process Lasso 18.3.0.34.tmp 95 PID 2292 wrote to memory of 4264 2292 Process Lasso 18.3.0.34.tmp 96 PID 1300 wrote to memory of 1136 1300 srvstub.exe 105 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_Silent Install.cmd"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\Process Lasso 18.3.0.34.exe"Process Lasso 18.3.0.34.exe" /SILENT2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\is-D6893.tmp\Process Lasso 18.3.0.34.tmp"C:\Users\Admin\AppData\Local\Temp\is-D6893.tmp\Process Lasso 18.3.0.34.tmp" /SL5="$50246,5298690,60928,C:\Users\Admin\AppData\Local\Temp\Process Lasso 18.3.0.34.exe" /SILENT3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\regedit.exe"C:\Windows\regedit.exe" /S "C:\Users\Admin\AppData\Local\Temp\settings.reg"4⤵
- Runs .reg file with regedit
PID:5072
-
-
C:\Program Files\Process Lasso\installHelper.exe"C:\Program Files\Process Lasso\installHelper.exe" /firstinstall4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3116
-
-
C:\Program Files\Process Lasso\installHelper.exe"C:\Program Files\Process Lasso\installHelper.exe" /migrate4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1068
-
-
C:\Program Files\Process Lasso\installHelper.exe"C:\Program Files\Process Lasso\installHelper.exe" /powerinstall4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5452
-
-
C:\Program Files\Process Lasso\installHelper.exe"C:\Program Files\Process Lasso\installHelper.exe" /install4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4264
-
-
-
-
C:\Program Files\Process Lasso\bitsumsessionagent.exe"C:\Program Files\Process Lasso\bitsumsessionagent.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:1304
-
C:\Program Files\Process Lasso\srvstub.exe"C:\Program Files\Process Lasso\srvstub.exe" "C:\Program Files\Process Lasso\processgovernor.exe" "ProcessGovernor" /exitevent:Global\ProcessGovernorExitEvent1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3772
-
C:\Program Files\Process Lasso\ProcessLasso.exe"C:\Program Files\Process Lasso\processlasso.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2564
-
C:\Program Files\Process Lasso\bitsumsessionagent.exe"C:\Program Files\Process Lasso\bitsumsessionagent.exe" ----------------------------------------------------------------1⤵
- Executes dropped EXE
PID:3140
-
C:\Program Files\Process Lasso\srvstub.exe"C:\Program Files\Process Lasso\srvstub.exe" "C:\Program Files\Process Lasso\processgovernor.exe" "ProcessGovernor" /exitevent:Global\ProcessGovernorExitEvent1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Program Files\Process Lasso\processgovernor.exe"C:\Program Files\Process Lasso\processgovernor.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1136
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Process Lasso\InstallHelper.exe
- Size 875KB
- SHA256 9e1134a5cde9e5daad1d0a65f54667223991123de9d430b9f9093d04f504e388
- MD5 4e5e0104576f11e702ecabb30524909b
- SHA1 eef1379880bd681f3b6ad547ecafef96119e2e2d
- SHA512 bb496f86ced7fafb2ac70b10d56881c6776534f9dbe359ba6ad37239597349df0908508bc03f21f7f681237ad9a58a5bf8b4ae7c9289f31a26d3c5962a10197e
- SSDEEP 12288:kKt/OU7GH/C8rtN0JFfWeG86yeLWZJhBlRq9J19KGZa:kY/OFq8rtN0JFfWeG81UWnjG1fZa
- TLSH T12615B1D056B649ACD069CD3C8991CC9AF9EB7D0C463D7ABB027438580F3EB994A74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Lasso\ProcessGovernor.exe
- Size 1.3MB
- SHA256 a4bab6d10422bb53be17044a9a92a75c32deb944656eb0de1953845ddc33d549
- MD5 0bf29e819f9f89032e07c392ffcd9c12
- SHA1 ad6a8a9d9c54d1fea78aed3c620d3a339f1401e9
- SHA512 c1d04ce764f24747a28f0deb1337f0618a598a3e6cd8cdb1d5b7c7eabe3dac54b98024bf4987889d2471c385858263215df3b7cececd65a68629e96e413f3a19
- SSDEEP 24576:6sWvHbfaQWy/JVM4IQd4uEma5X5ZehTbGL+vldvk5HgAEWmGzs:6jrWylIQdhEma5veVbGsrVzT
- TLSH T1EC5528D416B905ACE066D97C8A81CC8AE5EB7C0D073D7AFB02B036591F3EBD50A79E11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Lasso\ProcessLasso.exe
- Size 2.5MB
- SHA256 4c64811bdca53b955d1d216e6a46598bcbb415d5874ab226cbc2b5b96dff7451
- MD5 2fc66b7449d68cb94ee4774bdf2cd656
- SHA1 0d5b7e39a81b5c9102d93b5ac73396c5c0df456e
- SHA512 0d14949c18d9eb2615d69499a64cfdb6d5b197a2d0e5a5366e471bc8a380d752b42f70872cbad354ddcb0ce68bcc23179e72505f9074b7256b74b222dd91730f
- SSDEEP 49152:nkIe/Smnix+rEPYZL4hRyAlScItq/hCW3EAmi:xDooyM/6Ev
- TLSH T11BC549A521B801ADE076C57C89858D5BE5FB7C0D173979FB0160B9581F3FBEA0A38E12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Lasso\bitsumsessionagent.exe
- Size 180KB
- SHA256 6425100982bf47c2ea13f03a5b14f0446af45184d119a5b507af5441787984c8
- MD5 28fde8a972a76670e7ccae1a164d1b6c
- SHA1 ca95499e75456bfebb71c4adbdd93c81aa22d979
- SHA512 5868a373e6f9fcde3da1d5013fc77302dfc1907e3ce8fd02f4b744c1ac9b22426821876471ef60be0034ecda39d8e2c5c9d99edf6258d1a855883f6d8478cc48
- SSDEEP 3072:gaNn5AwjVsJu3hE38kojLVJ6D4rXHnT5xH+HY2K:gaBWJuA23nD+PK
- TLSH T1B4045C5673E510F9E1778234C9A11A05F772B82207609BEF17B08376AF276D19E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Lasso\pl_rsrc_english.dll
- Size 1.9MB
- SHA256 b361eda89686f8a34b6165ee73a5dd46fe3a1af98e5110a0ea4f256b13188f5a
- MD5 ab593d45096d29c8559d5644e0f7996c
- SHA1 5e0fd59cfbb46a89696c2bac039dabb217927285
- SHA512 3378186a6f41e339eb11e5c145722f2ec6b54f5ddb80cabc33377c71ac5b4bc5a08c4e5a10ede0ee673580e726446a9557f4435f2f42a0c3fca4ccd3124ec66d
- SSDEEP 6144:1fFa9MmhuV2FFdq7qFrwnim0gsZEeV3dyvl22UjFC8fB4adLxp7WGCNE/Jt1icNY:1fcHoozFzLXKGh4ZJe6cwTqREewRDz
- TLSH T1829571CE12FADC58F179EE781DA04E5818D73C8DE838B13D3A31711E99786669828F53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Lasso\srvstub.exe
- Size 131KB
- SHA256 8d13b0bbf5fc71782d9cd7d355f69ec7316ce98ac447a68517e6d742ef259212
- MD5 41af51a0e0e2aeaadcb737907c991dfe
- SHA1 e57bfd6a880a78bf913a6058bd9321dbb2f3c35d
- SHA512 b72edc0446709c963d9cca596cde535d625cee2928e600e36c7b32d1a8fa5be08b763ccf7785575fc72177b56f64bb2fb07e0d715397395ec349b638703cdeaf
- SSDEEP 3072:TEYvuYeweXlgl3ku3f+p9J6BFsvJDT+wOCwPnvUOar2H:Y21eO3ku3WbJ6/nvp/H
- TLSH T1A0D36C57B3E530F8E1778579C4A1170AE772B8721BA09BDF03A046652F236D09E3EB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\ProcessLasso\config\prolasso.ini
- Size 9KB
- SHA256 a24dcc3a3cdac5ca52300478133b0439c454724724b0f34632c0a3eaa295f236
- MD5 2f53935f55639291466c0ce29be41f77
- SHA1 7a8d5aca0a3f036aa438d57775d1d31ca1e5d3dd
- SHA512 e13120bdde477e7586065853bfdda9f46f86988f8030e1feab343f4b8e94af47dd4f3ae216960d18509b6e3fd01b653d5ef512d58516a10f5accdc239c0c33fc
- SSDEEP 192:gCU8hjD6xebh7kFaMm3aIm6XKWYFcCZiONkMN6GWYsaEeAu2:g18hjD7t7zHaIm6XKWYFcKiONkMN6GWd
- TLSH T1B1227B9397F92008F2BB1F64EEB868B64BB7BC665E19C49D41D4010D05F1E90D9B23B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\ProcessLasso\logs\processlasso.log
- Size 786B
- SHA256 922f449d3d45467ad210c06c9645e56821d90942fbc9f3618499c03eebe6e3c6
- MD5 789d3ac033c8ad31daf325ae3707a8f0
- SHA1 d430f67d448f9b5d35772d26d69ab795c2134c6e
- SHA512 8b883f75edc87f41d02e255b3e68a5728e5926ccbd95d1f06fa54f8ed0b9a19b615dba44149a874debb202a360f8006b5ea7e709c7fd5a8ff0ca366d9b8a9161
- TLSH T1D4014148D1AD4C4F51CCE94133890C728CDAF985828683392CBFCB1B7F9491D008B904
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-CIG11.tmp\ISTask.dll
- Size 66KB
- SHA256 e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d
- MD5 86a1311d51c00b278cb7f27796ea442e
- SHA1 ac08ac9d08f8f5380e2a9a65f4117862aa861a19
- SHA512 129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec
- SSDEEP 1536:KVqiEnH9RGX9xXLUWB1GOlb3MvH4xK+RRlm9A:isGX3Vwwbc6Rlm9A
- TLSH T138635C07B6D08676E072AFBC5C39A214A63B7D353D35D0ADABB90D8D4E282C29D4C357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-CIG11.tmp\VclStylesInno.dll
- Size 3.0MB
- SHA256 0e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
- MD5 b0ca93ceb050a2feff0b19e65072bbb5
- SHA1 7ebbbbe2d2acd8fd516f824338d254a33b69f08d
- SHA512 37242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2
- SSDEEP 49152:fvdCka90J5FJ8n2uRrH12SSSAt4VOZkT7LZc8/:fg65FOnRZAt4VObK
- TLSH T12EE56C27B2447A3EC0AB1B3D983BA294AD3FB71177179C5A5BF40C8C8E35580393A597
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-D6893.tmp\Process Lasso 18.3.0.34.tmp
- Size 907KB
- SHA256 2006b2b4d5eb64722f0bba35380057c9556a7e8bd4bf95b92cd68d84ba255be6
- MD5 3754a5eb2b26e9b6a89bd0690718351a
- SHA1 5356815f88cbcc512c74b401c5b1c89f8e950944
- SHA512 9ad991d58a60924650523f3e59a02389a7e729fbf73a0b20479c590375f40f041e0a7101604d7305ef8d7a8d57ba53e8823a75aa27441757881c604236ab0bec
- SSDEEP 24576:wkHgKPNrPA37hzHIA6/oR36vln6sYEubnhRgZtnTkDExlJr:w6frPA37hzHIA6/3UvjhRgZ9TZH
- TLSH T17D157C62F280C437C1A31E749E5786D5693BBE082E3879EB7BF91F4C4E3954139262D2
- MD5 SHA1 SHA512 SSDEEP TLSH