6b5bc20646f1d8c2b40dcaa0d716d6fa8aa25589c54043cf0fa547a21d10fcf4

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SolaraBootstrapper.pyc
Size

44KB
MD5

9f241419142904350c75b6b7efc989a5
SHA1

3f17c020abcdc918171bd234dcfba603ac0dcf17
SHA256

9aad9ba8c5c99d686bfe97c913e58c5490d7c1c00a66a03346f05c65aefafe69
SHA512

80e688059f563e873685b522c428cd1df908affa462a507ba524916899fe4cbeb20df74958749f0389597bd92a67c17f81768537bf5184ff647c6088ccbb54dd
SSDEEP

768:n9JWUQ4PFDea6iMVqD62oP2ASzvrLJHaj9bmJACa06hYFUDlhLx3QpJ6y:n9JWN0FDea9sG6sAg/J6j9xaUDlhLxA9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2760 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2760 AcroRd32.exe
2760 AcroRd32.exe

pid	process
2760	AcroRd32.exe

pid	process
2760	AcroRd32.exe
2760	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 944 wrote to memory of 1928	944	cmd.exe	rundll32.exe
PID 944 wrote to memory of 1928	944	cmd.exe	rundll32.exe
PID 944 wrote to memory of 1928	944	cmd.exe	rundll32.exe
PID 1928 wrote to memory of 2760	1928	rundll32.exe	AcroRd32.exe
PID 1928 wrote to memory of 2760	1928	rundll32.exe	AcroRd32.exe
PID 1928 wrote to memory of 2760	1928	rundll32.exe	AcroRd32.exe
PID 1928 wrote to memory of 2760	1928	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.pyc
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1928

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.pyc"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2760

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
16e5f699cede73386dfd40e7e4ef7385

SHA1
5c68617206598e273c66a16a4c74c0430dfe0eba

SHA256
cf53ff6f6864fd46844dc3c4fc84b27defa3b5271c0d521c520c7f536ef80727

SHA512
b2ced54e3dbbf0d3d94447acb30344df0ddbaeb0c0c55361ab144a2bcc7ca122d866fca6bd411e5d588e13a45615f447846f3b494b257e83fe8817c71f10692c

Download Submit