Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\process lasso management console (gui)
- <SYSTEM32>\tasks\session agent for process lasso
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\ProcessGovernor] 'ImagePath' = '"%ProgramFiles%\Process Lasso\srvstub.exe" "%ProgramFiles%\Process Lasso\processgovernor.exe" "ProcessGovernor" /exiteven...
Creates the following services
- 'ProcessGovernor' %ProgramFiles%\Process Lasso\srvstub.exe" "%ProgramFiles%\Process Lasso\processgovernor.exe" "ProcessGovernor" /exitevent:Global\ProcessGovernorExitEven
Malicious functions
Patches code
in dll
- ~doapjsj.tmp process, UxTheme.dll module
- ~doapjsj.tmp process, USER32.dll module
- ~doapjsj.tmp process, COMDLG32.dll module
Modifies file system
Creates the following files
- %CommonProgramFiles(x86)%\~abypgje.tmp
- %TEMP%\aute271.tmp
- %CommonProgramFiles(x86)%\~doapjsj.tmp
- %TEMP%\is-iimic.tmp\~doapjsj.tmp
- %TEMP%\is-ogos0.tmp\_isetup\_regdll.tmp
- %TEMP%\is-ogos0.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ogos0.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-ogos0.tmp\istask.dll
- %TEMP%\is-ogos0.tmp\vclstylesinno.dll
- %TEMP%\is-ogos0.tmp\metroblue.vsf
- %TEMP%\is-ogos0.tmp\wizardform.bitmapimage1.bmp
- %ProgramFiles%\process lasso\is-r8uuu.tmp
- %TEMP%\is-ogos0.tmp\is-i9c1u.tmp
- %TEMP%\is-ogos0.tmp\is-qcum6.tmp
- %ProgramFiles%\process lasso\is-mjplk.tmp
- %ProgramFiles%\process lasso\is-20tm1.tmp
- %ProgramFiles%\process lasso\is-74b8b.tmp
- %ProgramFiles%\process lasso\is-amml7.tmp
- %ProgramFiles%\process lasso\is-rhtbo.tmp
- %ProgramFiles%\process lasso\is-ilbbm.tmp
- %ProgramFiles%\process lasso\is-46nnl.tmp
- %ProgramFiles%\process lasso\is-8itgm.tmp
- %ProgramFiles%\process lasso\is-mva05.tmp
- %ProgramFiles%\process lasso\is-v4u8m.tmp
- %ProgramFiles%\process lasso\is-eaorj.tmp
- %ProgramFiles%\process lasso\is-r8g3c.tmp
- %ProgramFiles%\process lasso\is-gh7oi.tmp
- %ProgramFiles%\process lasso\is-nnn9o.tmp
- %ProgramFiles%\process lasso\is-0db3t.tmp
- %ProgramFiles%\process lasso\is-hfks0.tmp
- %ProgramFiles%\process lasso\is-j7euo.tmp
- %ProgramFiles%\process lasso\is-he7vk.tmp
- %ProgramFiles%\process lasso\is-hpu4c.tmp
- %ProgramFiles%\process lasso\is-vdhtb.tmp
- %ProgramFiles%\process lasso\is-omm0e.tmp
- %ProgramFiles%\process lasso\is-clof4.tmp
- %ProgramFiles%\process lasso\is-tfiko.tmp
- %ProgramFiles%\process lasso\is-0d2u5.tmp
- %ProgramFiles%\process lasso\is-83vfd.tmp
- %ProgramFiles%\process lasso\is-thdgt.tmp
- %ProgramFiles%\process lasso\is-heogo.tmp
- %ProgramFiles%\process lasso\is-24f94.tmp
- %ProgramFiles%\process lasso\is-4181c.tmp
- %ProgramFiles%\process lasso\is-v8ehp.tmp
- %ProgramFiles%\process lasso\is-m0co4.tmp
- %ProgramFiles%\process lasso\is-6nvt3.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\process lasso\process lasso.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\process lasso\uninstall.lnk
- %HOMEPATH%\desktop\process lasso.lnk
- %ProgramFiles%\process lasso\unins000.dat
- %TEMP%\{3936c578-b9b4-4935-b068-b01ea26f5482}.png
- %LOCALAPPDATA%\microsoft\windows\explorer\notifyicon\microsoft.explorer.notification.{06c5e068-5f53-bd64-f088-8e3428bcbe88}.png
Sets the 'hidden' attribute to the following files
- %CommonProgramFiles(x86)%\~doapjsj.tmp
Deletes following files that it created itself
- %TEMP%\aute271.tmp
- %TEMP%\is-ogos0.tmp\syspin.exe
- <SYSTEM32>\tasks\session agent for process lasso
- %TEMP%\is-ogos0.tmp\istask.dll
- %TEMP%\is-ogos0.tmp\metroblue.vsf
- %TEMP%\is-ogos0.tmp\vclstylesinno.dll
- %TEMP%\is-ogos0.tmp\wizardform.bitmapimage1.bmp
- %TEMP%\is-ogos0.tmp\_isetup\_regdll.tmp
- %TEMP%\is-ogos0.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ogos0.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-iimic.tmp\~doapjsj.tmp
- %CommonProgramFiles(x86)%\~doapjsj.tmp
- %CommonProgramFiles(x86)%\~abypgje.tmp
- %TEMP%\{3936c578-b9b4-4935-b068-b01ea26f5482}.png
- %LOCALAPPDATA%\microsoft\windows\explorer\notifyicon\microsoft.explorer.notification.{06c5e068-5f53-bd64-f088-8e3428bcbe88}.png
Moves the following files
- from %ProgramFiles%\process lasso\is-r8uuu.tmp to %ProgramFiles%\process lasso\unins000.exe
- from %TEMP%\is-ogos0.tmp\is-i9c1u.tmp to %TEMP%\is-ogos0.tmp\syspin.exe
- from %ProgramFiles%\process lasso\is-mjplk.tmp to %ProgramFiles%\process lasso\bitsumsessionagent.exe
- from %ProgramFiles%\process lasso\is-20tm1.tmp to %ProgramFiles%\process lasso\cpueater.exe
- from %ProgramFiles%\process lasso\is-74b8b.tmp to %ProgramFiles%\process lasso\insights.exe
- from %ProgramFiles%\process lasso\is-amml7.tmp to %ProgramFiles%\process lasso\installhelper.exe
- from %ProgramFiles%\process lasso\is-rhtbo.tmp to %ProgramFiles%\process lasso\logviewer.exe
- from %ProgramFiles%\process lasso\is-ilbbm.tmp to %ProgramFiles%\process lasso\pl.cmd
- from %ProgramFiles%\process lasso\is-46nnl.tmp to %ProgramFiles%\process lasso\pl_rsrc_english.dll
- from %ProgramFiles%\process lasso\is-8itgm.tmp to %ProgramFiles%\process lasso\pl_rsrc_russian.dll
- from %ProgramFiles%\process lasso\is-mva05.tmp to %ProgramFiles%\process lasso\processgovernor.exe
- from %ProgramFiles%\process lasso\is-v4u8m.tmp to %ProgramFiles%\process lasso\processlasso.exe
- from %ProgramFiles%\process lasso\is-eaorj.tmp to %ProgramFiles%\process lasso\processlassolauncher.exe
- from %ProgramFiles%\process lasso\is-r8g3c.tmp to %ProgramFiles%\process lasso\quickupgrade.exe
- from %ProgramFiles%\process lasso\is-gh7oi.tmp to %ProgramFiles%\process lasso\srvstub.exe
- from %ProgramFiles%\process lasso\is-nnn9o.tmp to %ProgramFiles%\process lasso\start-governor.bat
- from %ProgramFiles%\process lasso\is-0db3t.tmp to %ProgramFiles%\process lasso\stop-governor.bat
- from %ProgramFiles%\process lasso\is-hfks0.tmp to %ProgramFiles%\process lasso\testlasso.exe
- from %ProgramFiles%\process lasso\is-j7euo.tmp to %ProgramFiles%\process lasso\threadracer.exe
- from %ProgramFiles%\process lasso\is-he7vk.tmp to %ProgramFiles%\process lasso\tweakscheduler.exe
- from %ProgramFiles%\process lasso\is-hpu4c.tmp to %ProgramFiles%\process lasso\vistammsc.exe
- from %ProgramFiles%\process lasso\is-vdhtb.tmp to %ProgramFiles%\process lasso\pl_rsrc_bulgarian.dll
- from %ProgramFiles%\process lasso\is-omm0e.tmp to %ProgramFiles%\process lasso\pl_rsrc_chinese.dll
- from %ProgramFiles%\process lasso\is-clof4.tmp to %ProgramFiles%\process lasso\pl_rsrc_chinese_traditional.dll
- from %ProgramFiles%\process lasso\is-tfiko.tmp to %ProgramFiles%\process lasso\pl_rsrc_finnish.dll
- from %ProgramFiles%\process lasso\is-0d2u5.tmp to %ProgramFiles%\process lasso\pl_rsrc_french.dll
- from %ProgramFiles%\process lasso\is-83vfd.tmp to %ProgramFiles%\process lasso\pl_rsrc_german.dll
- from %ProgramFiles%\process lasso\is-thdgt.tmp to %ProgramFiles%\process lasso\pl_rsrc_italian.dll
- from %ProgramFiles%\process lasso\is-heogo.tmp to %ProgramFiles%\process lasso\pl_rsrc_japanese.dll
- from %ProgramFiles%\process lasso\is-24f94.tmp to %ProgramFiles%\process lasso\pl_rsrc_korean.dll
- from %ProgramFiles%\process lasso\is-4181c.tmp to %ProgramFiles%\process lasso\pl_rsrc_polish.dll
- from %ProgramFiles%\process lasso\is-v8ehp.tmp to %ProgramFiles%\process lasso\pl_rsrc_ptbr.dll
- from %ProgramFiles%\process lasso\is-m0co4.tmp to %ProgramFiles%\process lasso\pl_rsrc_slovenian.dll
- from %ProgramFiles%\process lasso\is-6nvt3.tmp to %ProgramFiles%\process lasso\pl_rsrc_spanish.dll
Substitutes the following files
- %TEMP%\is-ogos0.tmp\syspin.exe
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%CommonProgramFiles(x86)%\~doapjsj.tmp' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /LOADINF="%CommonProgramFiles(x86)%\~abypgje.tmp"
- '%TEMP%\is-iimic.tmp\~doapjsj.tmp' /SL5="$C01DC,5031291,60928,%CommonProgramFiles(x86)%\~doapjsj.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /LOADINF="%CommonProgramFiles(x86)%\~abypgje.tmp"
- '%ProgramFiles%\process lasso\installhelper.exe' /firstinstall
- '%ProgramFiles%\process lasso\installhelper.exe' /migrate
- '%ProgramFiles%\process lasso\installhelper.exe' /powerinstall
- '%ProgramFiles%\process lasso\installhelper.exe' /install
Executes the following
- '%WINDIR%\regedit.exe' /S "%CommonProgramFiles(x86)%\settings.reg"
- '%CommonProgramFiles(x86)%\~doapjsj.tmp' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /LOADINF="%CommonProgramFiles(x86)%\~abypgje.tmp"' (with hidden window)
- '%ProgramFiles%\process lasso\installhelper.exe' /firstinstall' (with hidden window)
- '%ProgramFiles%\process lasso\installhelper.exe' /migrate' (with hidden window)
- '%ProgramFiles%\process lasso\installhelper.exe' /powerinstall' (with hidden window)
- '%ProgramFiles%\process lasso\installhelper.exe' /install' (with hidden window)
