Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 18:49
Static task
static1
Behavioral task
behavioral1
Sample
SolaraBETA.rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SolaraBETA.rar
Resource
win10v2004-20240426-en
General
-
Target
SolaraBETA.rar
-
Size
17.4MB
-
MD5
1c9deb468c25cd3113ec8a9780d8135b
-
SHA1
b5adae52a06077fafbf9dd975d8da10f05a97d2a
-
SHA256
135fc77c5f588f90e1e49d0a96070703cf4a6ca3714dbb5030719a40570e3c3e
-
SHA512
70caf62f094a6af7ed85fa7d897ae8fdba808004c5ed1ab1cca79453d1dc4840fbfd959da362d638d4e4617915e2aa7a76ef4d38edf9fb8e50485e97cbab1bfe
-
SSDEEP
393216:wlPnTYj+yKG4H3JGtfrrpwaZpB3VwaJ5rPBwU:Snm+yA5AfrrSabBl5J5rPaU
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 368 Solara.exe 3028 Solara.exe -
Loads dropped DLL 44 IoCs
pid Process 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 368 Solara.exe 368 Solara.exe 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 3028 Solara.exe 3028 Solara.exe 3028 Solara.exe 3028 Solara.exe 3028 Solara.exe 3028 Solara.exe 3028 Solara.exe 3028 Solara.exe 3028 Solara.exe 3028 Solara.exe 3028 Solara.exe 3028 Solara.exe 3028 Solara.exe 3028 Solara.exe 3028 Solara.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2616 NOTEPAD.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3056 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 3056 7zFM.exe Token: 35 3056 7zFM.exe Token: SeSecurityPrivilege 3056 7zFM.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3056 7zFM.exe 3056 7zFM.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2820 wrote to memory of 3056 2820 cmd.exe 29 PID 2820 wrote to memory of 3056 2820 cmd.exe 29 PID 2820 wrote to memory of 3056 2820 cmd.exe 29 PID 3028 wrote to memory of 2128 3028 Solara.exe 36 PID 3028 wrote to memory of 2128 3028 Solara.exe 36 PID 3028 wrote to memory of 2128 3028 Solara.exe 36
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\SolaraBETA.rar1⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\SolaraBETA.rar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3056
-
-
C:\Users\Admin\Desktop\SolaraBETA\Solara.exe"C:\Users\Admin\Desktop\SolaraBETA\Solara.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:368
-
C:\Users\Admin\Desktop\SolaraBETA\Solara.exe"C:\Users\Admin\Desktop\SolaraBETA\Solara.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3028 -s 10202⤵
- Loads dropped DLL
PID:2128
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SolaraBETA\README.txt1⤵
- Opens file in notepad (likely ransom note)
PID:2616
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\Solara.exe.WebView2\EBWebView\Default\Extension State\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\Solara.exe.WebView2\EBWebView\Default\Extension State\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\Solara.exe.WebView2\EBWebView\Default\Shared Dictionary\cache\index
Filesize24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\Solara.exe.WebView2\EBWebView\GraphiteDawnCache\data_0
Filesize8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\Solara.exe.WebView2\EBWebView\GraphiteDawnCache\data_1
Filesize264KB
MD539b220c1a87953fc4b5dc54a07f3f76e
SHA1bf2a0fcb732014c5ec3178449e986b9f9d54010b
SHA25644c13363d0918cfc5d99528214d40e982f83aaf85bf01a493f5ca52a8ce0ad97
SHA51295aab55ac1bd2f5798a3b3cdae592d0f07d2061a19b7cccf649262daa2297c8b2141c9626a10110d9ffdfb2a91dd893c1a6053570f534fe9bf27be660f1ca6d8
-
C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\Solara.exe.WebView2\EBWebView\GraphiteDawnCache\data_2
Filesize8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\Solara.exe.WebView2\EBWebView\GraphiteDawnCache\data_3
Filesize8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\WpfApp1.exe.WebView2\EBWebView\Default\Extension Rules\000003.log
Filesize38B
MD551a2cbb807f5085530dec18e45cb8569
SHA17ad88cd3de5844c7fc269c4500228a630016ab5b
SHA2561c43a1bda1e458863c46dfae7fb43bfb3e27802169f37320399b1dd799a819ac
SHA512b643a8fa75eda90c89ab98f79d4d022bb81f1f62f50ed4e5440f487f22d1163671ec3ae73c4742c11830214173ff2935c785018318f4a4cad413ae4eeef985df
-
C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\WpfApp1.exe.WebView2\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Filesize20KB
MD526fc054d6e2537d0eefc2adccd8aed48
SHA157d91cc39566739e53ee686fdf54a54db586225e
SHA256f1f4cab488693f20a1daa0d0d9bf8d5f4bd066d939fbcb78e3c1eb5b44582e4d
SHA512b674081966ad1cf5318e3e86c628c13cdc67bb53cbea5a49992551033fe9730206d7133aaf0535c95a6245a2e20522a9ea9bc7c414a72cf08be8f5c2d81611b8
-
C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\WpfApp1.exe.WebView2\EBWebView\GrShaderCache\f_000001
Filesize16KB
MD593b26a977cf99c9d7038ce067f3f6c19
SHA1daae119d188382adec6aad4c5c34c64adba38ca8
SHA25663c283447cef315cb5165e4f0b879f2554c854f8de5b9919d2578441b4f92e80
SHA512c3ef41ba6bde3aa36479efae3f15c9dc45487615c58a240728b03b1c2b06e31c14810a1344a22f923387c33de731ab70994c3265a023c13dbaaba3f829884464
-
C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\WpfApp1.exe.WebView2\EBWebView\Subresource Filter\Indexed Rules\36\10.34.0.52\LICENSE
Filesize24KB
MD5aad9405766b20014ab3beb08b99536de
SHA1486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA256ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
SHA512bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
-
C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\WpfApp1.exe.WebView2\EBWebView\hyphen-data\101.0.4906.0\hyph-as.hyb
Filesize703B
MD58961fdd3db036dd43002659a4e4a7365
SHA17b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA256c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
SHA512531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
-
C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\WpfApp1.exe.WebView2\EBWebView\hyphen-data\101.0.4906.0\hyph-hi.hyb
Filesize687B
MD50807cf29fc4c5d7d87c1689eb2e0baaa
SHA1d0914fb069469d47a36d339ca70164253fccf022
SHA256f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
SHA5125324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
-
C:\Users\Admin\AppData\Local\Temp\7zE0FBF2196\SolaraBETA\WpfApp1.exe.WebView2\EBWebView\hyphen-data\101.0.4906.0\hyph-nb.hyb
Filesize141KB
MD5677edd1a17d50f0bd11783f58725d0e7
SHA198fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA256c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
SHA512c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
-
Filesize
488KB
MD5851fee9a41856b588847cf8272645f58
SHA1ee185a1ff257c86eb19d30a191bf0695d5ac72a1
SHA2565e7faee6b8230ca3b97ce9542b914db3abbbd1cb14fd95a39497aaad4c1094ca
SHA512cf5c70984cf33e12cf57116da1f282a5bd6433c570831c185253d13463b0b9a0b9387d4d1bf4dddab3292a5d9ba96d66b6812e9d7ebc5eb35cb96eea2741348f
-
Filesize
43KB
MD534ec990ed346ec6a4f14841b12280c20
SHA16587164274a1ae7f47bdb9d71d066b83241576f0
SHA2561e987b22cd011e4396a0805c73539586b67df172df75e3dded16a77d31850409
SHA512b565015ca4b11b79ecbc8127f1fd40c986948050f1caefdd371d34ed2136af0aabf100863dc6fd16d67e3751d44ee13835ea9bf981ac0238165749c4987d1ae0
-
Filesize
695KB
MD5195ffb7167db3219b217c4fd439eedd6
SHA11e76e6099570ede620b76ed47cf8d03a936d49f8
SHA256e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
SHA51256eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
-
Filesize
5.2MB
MD5aead90ab96e2853f59be27c4ec1e4853
SHA143cdedde26488d3209e17efff9a51e1f944eb35f
SHA25646cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed
SHA512f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d
-
Filesize
28KB
MD5c4cac2d609bb5e0da9017ebb535634ce
SHA151a264ce4545a2f0d9f2908771e01e001b4e763e
SHA2567c3336c3a50bf3b4c5492c0d085519c040878243e9f7d3ea9f6a2e35c8f1f374
SHA5123b55bdbc5132d05ab53852605afe6ed49f4b3decdde8b11f19a621a78a37d98c7aeaaa8c10bf4565b9b50162816305fa5192ee31950a96dc08ae46bfc6af4ffe
-
Filesize
158KB
MD5aee20ef43cf692c9080c5973b1b79855
SHA1b3885791b0e122f8360d6fb7c0e0ac7fe4fa14fb
SHA25631423e905e29c8a40a483e81dae1491990805fa066634d218b35bb96692bef0d
SHA512eab6684095c0a7555d921fb1a2e136fa1d761c5766c48571000a97403e6d437a3a4833c571f86c039aa8307fb2fc3fae1acffd63085ae9d2ea0d9e7f9ec1ace6
-
Filesize
970KB
MD5901c7a2b9a298ca8e012077b3863845b
SHA17c018d58621b963935620eef33a0a53fbe047dd1
SHA2561b3cb085d240d5572d87397a404060114e69f0098a7bf8a0704a370ab21371c7
SHA5121c3f243777e34c7b81e302695f6234fbeffc9e10ef8e0568523e20318776bdb8a6fc323b0bdafebeade622ddb976ef20a3c53fd442d2f9fc7778a61b282b3f29
-
Filesize
87KB
MD5c61ea149a799fad804a6b157a48b713a
SHA136212a1cd7b3cd2d3909d28fcac482977fdc2214
SHA256108c88858bfe52105c794b58d89d423940e7a1a3a2a4502c1a327672defeae09
SHA5125cd298aea469b0d30f84ee04a20077a4bd7ca6c500e07f02d476730442a7e1623dd3ba84615151c949e7966a1fb07c2ea8a14b9aa9086db443051248dded8224
-
Filesize
134KB
MD57bf24896b80f336c1d16b488f89fef34
SHA150db3c6002a85894f7b960aee1d01b5537a7057b
SHA25628cee166d574b246aa076eb59e24567026c7782f9a70a05b48a61508589e6840
SHA51207a660ab26343cb45602710a2935c6b948c80976de612ac403a6e354f7bedbe56e1e92f95cfb0ffa746625a3da5108c9a796941a0db462621ecb653a752766f0
-
Filesize
24KB
MD50485c463cd8d2ae1cbd42df6f0591246
SHA1ea634140905078e8f687a031ae919cff23c27e6f
SHA256983f4d4c7b7330e7f5f091080c1e81905575ebccd97e11dff8a064979ec8d9b8
SHA512ddf947a1b86c3826859570a3e1d59e4ec4564cfcf25c84841383a4b5f5ad6c2fe618078416aed201fb744d5fbd6c39dab7c1e964dd5e148da018a825fcc0044a
-
Filesize
22KB
MD51193f810519fbc07beb3ffbad3247fc4
SHA1db099628a19b2d34e89028c2e16bc89df28ed78f
SHA256ab2158fe6b354fb429f57f374ca25105b44e97edcbdc1b752650d895dadd6fd1
SHA5123222a10c3be5098aca0211015efe75cfbcd408fd28315acedd016d8f77513f81e207536b072001525965635da39c4aae8ef9f6ad367f5d695de67b1614179353
-
Filesize
21KB
MD5a22f9a4cbd701209842b204895fedf37
SHA172fa50160baf1f2ea2adcff58f3f90a77a59d949
SHA2562ee3d52640d84ac4f7f7ddfe748f51baa6fd0d492286c781251222420e85ca97
SHA512903755d4fa6651669295a10e66be8ea223cd8d5ad60ebe06188d8b779fef7e964d0aa26dc5479f14aab655562d3c1ef76b86790fb97f991eaf52da0f70e40529
-
Filesize
20KB
MD5ba17b278fff2c18e34e47562ddde8166
SHA1bed762d11b98737fcf1d1713d77345ec4780a8c2
SHA256c36f5c0ac5d91a8417866dd4d8c670c2192ba83364693e7438282fb8678c3d1e
SHA51272516b81606ccf836549c053325368e93264fdebc7092e42e3df849a16ccefa81b7156ae5609e227faa7c9c1bf9d68b2ac349791a839f4575728f350dd048f27
-
Filesize
11KB
MD5894e538fbd29d9af2dac82abbb798aa8
SHA13c28b3063ce80b3fd61e0afc6934e3180f5bef12
SHA256b12679d33126d2dcb0cd3625fccf5c3afc40d95c1be36dc55f7471de94929d23
SHA51232ad7f4ba21c7ec47b374ed776cc1662de23a955a00aab509d9b82a9f4aa4b46580933c3382a1cffa526d93af686013104ca1d8d50ab3bab02a291e64b88a884
-
Filesize
26KB
MD55df2410c0afd30c9a11de50de4798089
SHA14112c5493009a1d01090ccae810500c765dc6d54
SHA256e6a1ef1f7c1957c50a3d9c1d70c0f7b0d8badc7f279cd056eb179dc256bfefda
SHA5128ecb79078d05d5b2a432f511953985b3253d5d43d87709a5795709ee8dbca63c5f1166ed94d8984c13f2ea06adfa7d6b82c6735c23c6e64f2f37a257066864e6
-
Filesize
26KB
MD5aacade02d7aaf6b5eff26a0e3a11c42d
SHA193b8077b535b38fdb0b7c020d24ba280adbe80c3
SHA256e71d517e6b7039437e3fc449d8ad12eeeca0d5c8ed1c500555344fd90ddc3207
SHA512e02fcbcb70100f67e65903d8b1a7e6314cabfb0b14797bd6e1c92b7bcb3994a54133e35d16da0a29576145b2783221330591526f856b79a25c0575fc923985a6
-
Filesize
522KB
MD5e31f5136d91bad0fcbce053aac798a30
SHA1ee785d2546aec4803bcae08cdebfd5d168c42337
SHA256ee94e2201870536522047e6d7fe7b903a63cd2e13e20c8fffc86d0e95361e671
SHA512a1543eb1d10d25efb44f9eaa0673c82bfac5173055d04c0f3be4792984635a7c774df57a8e289f840627754a4e595b855d299070d469e0f1e637c3f35274abe6
-
Filesize
576KB
MD57b92a6cb5d2cad407c457ab12d2b211d
SHA1e04020b3448fc6084fa31b7f791f22ff15e31328
SHA2563c6a772319fff3ee56d4cedbe332bb5c0c2f394714cf473c6cdf933754114784
SHA512b28740c1aca4f0f60a9e4a9ab5a0561af774d977ab6d42a7eea70c9e560c77c50be5d9d869f05d0435e2923f4f600219335d22425807ab23cbbcda75442c4b42
-
Filesize
99KB
MD57a2b8cfcd543f6e4ebca43162b67d610
SHA1c1c45a326249bf0ccd2be2fbd412f1a62fb67024
SHA2567d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f
SHA512e38304fb9c5af855c1134f542adf72cde159fab64385533eafa5bb6e374f19b5a29c0cb5516fc5da5c0b5ac47c2f6420792e0ac8ddff11e749832a7b7f3eb5c8
-
Filesize
113KB
MD575365924730b0b2c1a6ee9028ef07685
SHA1a10687c37deb2ce5422140b541a64ac15534250f
SHA256945e7f5d09938b7769a4e68f4ef01406e5af9f40db952cba05ddb3431dd1911b
SHA512c1e31c18903e657203ae847c9af601b1eb38efa95cb5fa7c1b75f84a2cba9023d08f1315c9bb2d59b53256dfdb3bac89930252138475491b21749471adc129a1