Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 22:53
Behavioral task
behavioral1
Sample
SolarNuker-main/SolarNuker.py
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
SolarNuker-main/SolarNuker.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
SolarNuker-main/SolarNukerV2.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
SolarNuker-main/SolarNukerV2.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
SolarNuker-main/start.bat
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
SolarNuker-main/start.bat
Resource
win10v2004-20240426-en
General
-
Target
SolarNuker-main/SolarNuker.py
-
Size
12KB
-
MD5
c625264b3ec562ea87d9170a06c5e54d
-
SHA1
062ce523b60907b5c011b9f862da4599e0dbea47
-
SHA256
bc3d48c43552b695e9991f196134dc08185bfcce225f1051dddde75422a29456
-
SHA512
006d1821cda283f9f4ded280b69bb1e1dc5d80d48f1392c8b77e513ca3ce6147d950b3e50b900d9e5233821b7d380672d3d36acf5947523f4d6ae15bb1d3261a
-
SSDEEP
384:RFcWa0eZ1PsUQ/BfjPsUQ/B9xHqUhClQdavltvbGFUlqiQC7lohyeXl/:gD1PsUQ/BfjPsUQ/BMQP
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.py rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2776 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2776 AcroRd32.exe 2776 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1640 wrote to memory of 2680 1640 cmd.exe rundll32.exe PID 1640 wrote to memory of 2680 1640 cmd.exe rundll32.exe PID 1640 wrote to memory of 2680 1640 cmd.exe rundll32.exe PID 2680 wrote to memory of 2776 2680 rundll32.exe AcroRd32.exe PID 2680 wrote to memory of 2776 2680 rundll32.exe AcroRd32.exe PID 2680 wrote to memory of 2776 2680 rundll32.exe AcroRd32.exe PID 2680 wrote to memory of 2776 2680 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\SolarNuker-main\SolarNuker.py1⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SolarNuker-main\SolarNuker.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SolarNuker-main\SolarNuker.py"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2776