Overview
overview
10Static
static
9UpdaterSxl...c].zip
windows11-21h2-x64
1README.txt
windows11-21h2-x64
3UpdaterSolara.rar
windows11-21h2-x64
3Updater Solara.exe
windows11-21h2-x64
10$INTERNET_...Answer
windows11-21h2-x64
1$INTERNET_...entina
windows11-21h2-x64
1$INTERNET_...ckland
windows11-21h2-x64
1$INTERNET_...Breeds
windows11-21h2-x64
1$INTERNET_...apitol
windows11-21h2-x64
1$INTERNET_CACHE/Chart
windows11-21h2-x64
1$INTERNET_...zation
windows11-21h2-x64
1$INTERNET_CACHE/Cp
windows11-21h2-x64
1$INTERNET_CACHE/Delhi
windows11-21h2-x64
1$INTERNET_CACHE/Fresh
windows11-21h2-x64
1$INTERNET_CACHE/Glad
windows11-21h2-x64
1$INTERNET_CACHE/Heard
windows11-21h2-x64
1$INTERNET_...mposed
windows11-21h2-x64
1$INTERNET_...Incest
windows11-21h2-x64
1$INTERNET_...active
windows11-21h2-x64
1$INTERNET_CACHE/Looks
windows11-21h2-x64
1$INTERNET_CACHE/Nano
windows11-21h2-x64
1$INTERNET_...ations
windows11-21h2-x64
1$INTERNET_...cessed
windows11-21h2-x64
1dll/VMProt...32.dll
windows11-21h2-x64
3dll/VMProt...32.lib
windows11-21h2-x64
3dll/autoex...SE.txt
windows11-21h2-x64
3dll/celeryuwp.dll
windows11-21h2-x64
1dll/celeryuwpver
windows11-21h2-x64
1dll/uwpoff.bin
windows11-21h2-x64
3dll/uwpoffver
windows11-21h2-x64
1dll/uwpversion.txt
windows11-21h2-x64
3scripts/scripts.dll
windows11-21h2-x64
1Analysis
-
max time kernel
144s -
max time network
155s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
04-06-2024 21:05
Behavioral task
behavioral1
Sample
UpdaterSxlxra V3,5 PC [ryosx.cc].zip
Resource
win11-20240419-en
Behavioral task
behavioral2
Sample
README.txt
Resource
win11-20240426-en
Behavioral task
behavioral3
Sample
UpdaterSolara.rar
Resource
win11-20240508-en
Behavioral task
behavioral4
Sample
Updater Solara.exe
Resource
win11-20240426-en
Behavioral task
behavioral5
Sample
$INTERNET_CACHE/Answer
Resource
win11-20240508-en
Behavioral task
behavioral6
Sample
$INTERNET_CACHE/Argentina
Resource
win11-20240508-en
Behavioral task
behavioral7
Sample
$INTERNET_CACHE/Auckland
Resource
win11-20240426-en
Behavioral task
behavioral8
Sample
$INTERNET_CACHE/Breeds
Resource
win11-20240508-en
Behavioral task
behavioral9
Sample
$INTERNET_CACHE/Capitol
Resource
win11-20240426-en
Behavioral task
behavioral10
Sample
$INTERNET_CACHE/Chart
Resource
win11-20240508-en
Behavioral task
behavioral11
Sample
$INTERNET_CACHE/Civilization
Resource
win11-20240426-en
Behavioral task
behavioral12
Sample
$INTERNET_CACHE/Cp
Resource
win11-20240508-en
Behavioral task
behavioral13
Sample
$INTERNET_CACHE/Delhi
Resource
win11-20240508-en
Behavioral task
behavioral14
Sample
$INTERNET_CACHE/Fresh
Resource
win11-20240419-en
Behavioral task
behavioral15
Sample
$INTERNET_CACHE/Glad
Resource
win11-20240426-en
Behavioral task
behavioral16
Sample
$INTERNET_CACHE/Heard
Resource
win11-20240426-en
Behavioral task
behavioral17
Sample
$INTERNET_CACHE/Imposed
Resource
win11-20240426-en
Behavioral task
behavioral18
Sample
$INTERNET_CACHE/Incest
Resource
win11-20240426-en
Behavioral task
behavioral19
Sample
$INTERNET_CACHE/Interactive
Resource
win11-20240508-en
Behavioral task
behavioral20
Sample
$INTERNET_CACHE/Looks
Resource
win11-20240508-en
Behavioral task
behavioral21
Sample
$INTERNET_CACHE/Nano
Resource
win11-20240426-en
Behavioral task
behavioral22
Sample
$INTERNET_CACHE/Occupations
Resource
win11-20240426-en
Behavioral task
behavioral23
Sample
$INTERNET_CACHE/Processed
Resource
win11-20240508-en
Behavioral task
behavioral24
Sample
dll/VMProtectSDK32.dll
Resource
win11-20240426-en
Behavioral task
behavioral25
Sample
dll/VMProtectSDK32.lib
Resource
win11-20240426-en
Behavioral task
behavioral26
Sample
dll/autoexec/HOW_TO_USE.txt
Resource
win11-20240426-en
Behavioral task
behavioral27
Sample
dll/celeryuwp.dll
Resource
win11-20240508-en
Behavioral task
behavioral28
Sample
dll/celeryuwpver
Resource
win11-20240508-en
Behavioral task
behavioral29
Sample
dll/uwpoff.bin
Resource
win11-20240419-en
Behavioral task
behavioral30
Sample
dll/uwpoffver
Resource
win11-20240426-en
Behavioral task
behavioral31
Sample
dll/uwpversion.txt
Resource
win11-20240508-en
Behavioral task
behavioral32
Sample
scripts/scripts.dll
Resource
win11-20240419-en
General
-
Target
dll/uwpversion.txt
-
Size
5B
-
MD5
f0016f1d09aea25afcb3fb5948acbb9f
-
SHA1
5151f95ad805265d9169fb020297c97b589a90cb
-
SHA256
cc1a4126ba1a738f56187a2a2a9df4f3d3f6baa8dc966feed9d0f6e09a5a486a
-
SHA512
da19cc04a0a6cc175f056ce4bb5091cb1f7a4efa922704ddedce2aa7dbfda8e53709a81206234744d8ef34c97fd1a31ea0f62ecd41ed7977064dc5ece36477ef
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings cmd.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 5016 NOTEPAD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
cmd.exedescription pid process target process PID 5104 wrote to memory of 5016 5104 cmd.exe NOTEPAD.EXE PID 5104 wrote to memory of 5016 5104 cmd.exe NOTEPAD.EXE
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\dll\uwpversion.txt1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\dll\uwpversion.txt2⤵
- Opens file in notepad (likely ransom note)