Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

3

Solara_Updater.exe

windows11-21h2-x64

6

Analysis

  • max time kernel
    127s
  • max time network
    102s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    16/05/2024, 17:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Solara_Updater.exe

  • Size

    240KB

  • MD5

    b89051e8cf348e69c0943b540af3b99c

  • SHA1

    50200e338cb5df75077c6144884bf0ff6bf7cc7a

  • SHA256

    2e0a0e7e5d510f4274cd22ca2ed10f4bcca932a8cb2a756a47c13fb36a5fb58d

  • SHA512

    ab1e75c6ccf80fdd29bb35ec802032a46cf642e444ba392a2224cc025d05d78148f60bf81d4405b25301ce86b83e03d9249378864afa575fa6a61f05dea21408

  • SSDEEP

    6144:poKbfO8otzIJZiCgq1gQb4KgLqMIuLRTK83KrAqG:poKzO8otaZiCgSgQb4KgLqMIuLRTwrAq

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
    "C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3664
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1300

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Solara\SolaraBETA3.1\Monaco\fileaccess\node_modules\get-intrinsic\.nycrc
      Filesize

      139B

      MD5

      d0104f79f0b4f03bbcd3b287fa04cf8c

      SHA1

      54f9d7adf8943cb07f821435bb269eb4ba40ccc2

      SHA256

      997785c50b0773e5e18bf15550fbf57823c634fefe623cd37b3c83696402ad0a

      SHA512

      daf9b5445cfc02397f398adfa0258f2489b70699dfec6ca7e5b85afe5671fdcabe59edee332f718f5e5778feb1e301778dffe93bb28c1c0914f669659bad39c6

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Solara\SolaraBETA3.1\Monaco\fileaccess\node_modules\has-proto\.eslintrc
      Filesize

      43B

      MD5

      c28b0fe9be6e306cc2ad30fe00e3db10

      SHA1

      af79c81bd61c9a937fca18425dd84cdf8317c8b9

      SHA256

      0694050195fc694c5846b0a2a66b437ac775da988f0a779c55fb892597f7f641

      SHA512

      e3eca17804522ffa4f41e836e76e397a310a20e8261a38115b67e8b644444153039d04198fb470f45be2997d2c7a72b15bd4771a02c741b3cbc072ea6ef432e9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Solara\SolaraBETA3.1\Monaco\fileaccess\node_modules\hasown\.nycrc
      Filesize

      216B

      MD5

      c2ab942102236f987048d0d84d73d960

      SHA1

      95462172699187ac02eaec6074024b26e6d71cff

      SHA256

      948366fea3b423a46366326d0bb2e54b08abd1cf0b243678ba6625740c40da5a

      SHA512

      e36b20c16ceeb090750f3865efc8d7fd983ae4e8b41c30cc3865d2fd4925bf5902627e1f1ed46c0ff2453f076ef9de34be899ef57754b29cd158440071318479

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Solara\SolaraBETA3.1\Monaco\fileaccess\node_modules\vary\LICENSE
      Filesize

      1KB

      MD5

      13babc4f212ce635d68da544339c962b

      SHA1

      4881ad2ec8eb2470a7049421047c6d076f48f1de

      SHA256

      bd47ce7b88c7759630d1e2b9fcfa170a0f1fde522be09e13fb1581a79d090400

      SHA512

      40e30174433408e0e2ed46d24373b12def47f545d9183b7bce28d4ddd8c8bb528075c7f20e118f37661db9f1bba358999d81a14425eb3e0a4a20865dfcb53182

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Solara\SolaraBETA3.1\XcHvYYrNa.exe.WebView2\EBWebView\Default\Extension State\CURRENT
      Filesize

      16B

      MD5

      46295cac801e5d4857d09837238a6394

      SHA1

      44e0fa1b517dbf802b18faf0785eeea6ac51594b

      SHA256

      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

      SHA512

      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Solara\SolaraBETA3.1\XcHvYYrNa.exe.WebView2\EBWebView\Default\Extension State\MANIFEST-000001
      Filesize

      41B

      MD5

      5af87dfd673ba2115e2fcf5cfdb727ab

      SHA1

      d5b5bbf396dc291274584ef71f444f420b6056f1

      SHA256

      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

      SHA512

      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Solara\SolaraBETA3.1\XcHvYYrNa.exe.WebView2\EBWebView\Default\Shared Dictionary\cache\index
      Filesize

      24B

      MD5

      54cb446f628b2ea4a5bce5769910512e

      SHA1

      c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

      SHA256

      fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

      SHA512

      8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Solara\SolaraBETA3.1\XcHvYYrNa.exe.WebView2\EBWebView\GraphiteDawnCache\data_0
      Filesize

      8KB

      MD5

      cf89d16bb9107c631daabf0c0ee58efb

      SHA1

      3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

      SHA256

      d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

      SHA512

      8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Solara\SolaraBETA3.1\XcHvYYrNa.exe.WebView2\EBWebView\GraphiteDawnCache\data_1
      Filesize

      264KB

      MD5

      63896a0ca15699fbe5b19f47d77dd76f

      SHA1

      f80c87d5a4b11a7371a6e2e7a4439dbfb761c0e8

      SHA256

      43fd408cc3398a65bac829cfc344b98c83137d312434ec3b877bbf3fcd94d1e0

      SHA512

      6ae075862d3d2de51f87ca5d9ef3e14eab2c0817be5fafafe94c021d8e57ee890c4b998f1d3588acbf9c540a6f097742db116e1953dcd693cc051111cdd3fede

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Solara\SolaraBETA3.1\XcHvYYrNa.exe.WebView2\EBWebView\GraphiteDawnCache\data_2
      Filesize

      8KB

      MD5

      0962291d6d367570bee5454721c17e11

      SHA1

      59d10a893ef321a706a9255176761366115bedcb

      SHA256

      ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

      SHA512

      f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Solara\SolaraBETA3.1\XcHvYYrNa.exe.WebView2\EBWebView\GraphiteDawnCache\data_3
      Filesize

      8KB

      MD5

      41876349cb12d6db992f1309f22df3f0

      SHA1

      5cf26b3420fc0302cd0a71e8d029739b8765be27

      SHA256

      e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

      SHA512

      e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

      Download Submit

    • memory/3664-7-0x000000000D4C0000-0x000000000D4D2000-memory.dmp

      Filesize

      72KB

      Download

    • memory/3664-6-0x000000000D490000-0x000000000D49A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/3664-4-0x00000000751F0000-0x00000000759A1000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/3664-3-0x00000000751FE000-0x00000000751FF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3664-2-0x00000000751F0000-0x00000000759A1000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/3664-1-0x0000000000670000-0x00000000006B2000-memory.dmp

      Filesize

      264KB

      Download

    • memory/3664-0-0x00000000751FE000-0x00000000751FF000-memory.dmp

      Filesize

      4KB

      Download