Analysis

  • max time kernel
    110s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-06-2024 15:21

General

  • Target

    Solara.Dir.7z

  • Size

    12.1MB

  • MD5

    a0071d0e67a83b0a56fa489d547f7bdf

  • SHA1

    80422fc38a436a87f322bb9f41a0ce87111c929f

  • SHA256

    89b63921f65f87f82027ad749b627d266a6fc7453cad757049bab38fb4ba2db3

  • SHA512

    abbe51c4393cc110c2fe081638d82851f87aefb4e6be314f4831b635f03f518f050b66b3c8c32ecfe40ac368a6ffc921f8902dbc05e8335b1b034ae9752c2600

  • SSDEEP

    196608:YGP79eyQQLrAJkwdk0m8F5X2eNlxqtAF0tsAJdmodCYYhOZlVgjamMKiQHBzpSix:/P8fRdkhs3rxqtAFiLMFC5cSizfhr/

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 57 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 20 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Solara.Dir.7z
    1⤵
    • Modifies registry class
    PID:4792
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2628
  • C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads