Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7Solara.Dir...re.dll
windows11-21h2-x64
1Solara.Dir...ms.dll
windows11-21h2-x64
1Solara.Dir...pf.dll
windows11-21h2-x64
1Solara.Dir...dex.js
windows11-21h2-x64
3Solara.Dir...n/mime
windows11-21h2-x64
1Solara.Dir...me.cmd
windows11-21h2-x64
1Solara.Dir...me.ps1
windows11-21h2-x64
3Solara.Dir...DME.js
windows11-21h2-x64
3Solara.Dir...dex.js
windows11-21h2-x64
3Solara.Dir...DME.js
windows11-21h2-x64
3Solara.Dir...ten.js
windows11-21h2-x64
3Solara.Dir...DME.js
windows11-21h2-x64
3Solara.Dir...dex.js
windows11-21h2-x64
3Solara.Dir...ead.js
windows11-21h2-x64
3Solara.Dir...son.js
windows11-21h2-x64
3Solara.Dir...raw.js
windows11-21h2-x64
3Solara.Dir...ext.js
windows11-21h2-x64
3Solara.Dir...ded.js
windows11-21h2-x64
3Solara.Dir...dme.js
windows11-21h2-x64
3Solara.Dir...dex.js
windows11-21h2-x64
3Solara.Dir...und.js
windows11-21h2-x64
3Solara.Dir...dex.js
windows11-21h2-x64
3Solara.Dir...und.js
windows11-21h2-x64
3Solara.Dir...dex.js
windows11-21h2-x64
3Solara.Dir...DME.js
windows11-21h2-x64
3Solara.Dir...dex.js
windows11-21h2-x64
3Solara.Dir...DME.js
windows11-21h2-x64
3Solara.Dir...dex.js
windows11-21h2-x64
3Solara.Dir...dme.js
windows11-21h2-x64
3Solara.Dir...dex.js
windows11-21h2-x64
3Solara.Dir...DME.js
windows11-21h2-x64
3Solara.Dir...dex.js
windows11-21h2-x64
3Analysis
-
max time kernel
1740s -
max time network
1750s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
19/06/2024, 18:02
Behavioral task
behavioral1
Sample
Solara.Dir/Microsoft.Web.WebView2.Core.dll
Resource
win11-20240419-en
Behavioral task
behavioral2
Sample
Solara.Dir/Microsoft.Web.WebView2.WinForms.dll
Resource
win11-20240611-en
Behavioral task
behavioral3
Sample
Solara.Dir/Microsoft.Web.WebView2.Wpf.dll
Resource
win11-20240611-en
Behavioral task
behavioral4
Sample
Solara.Dir/Monaco/fileaccess/index.js
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
Solara.Dir/Monaco/fileaccess/node_modules/.bin/mime
Resource
win11-20240611-en
Behavioral task
behavioral6
Sample
Solara.Dir/Monaco/fileaccess/node_modules/.bin/mime.cmd
Resource
win11-20240508-en
Behavioral task
behavioral7
Sample
Solara.Dir/Monaco/fileaccess/node_modules/.bin/mime.ps1
Resource
win11-20240611-en
Behavioral task
behavioral8
Sample
Solara.Dir/Monaco/fileaccess/node_modules/accepts/README.js
Resource
win11-20240611-en
Behavioral task
behavioral9
Sample
Solara.Dir/Monaco/fileaccess/node_modules/accepts/index.js
Resource
win11-20240508-en
Behavioral task
behavioral10
Sample
Solara.Dir/Monaco/fileaccess/node_modules/array-flatten/README.js
Resource
win11-20240508-en
Behavioral task
behavioral11
Sample
Solara.Dir/Monaco/fileaccess/node_modules/array-flatten/array-flatten.js
Resource
win11-20240611-en
Behavioral task
behavioral12
Sample
Solara.Dir/Monaco/fileaccess/node_modules/body-parser/README.js
Resource
win11-20240611-en
Behavioral task
behavioral13
Sample
Solara.Dir/Monaco/fileaccess/node_modules/body-parser/index.js
Resource
win11-20240508-en
Behavioral task
behavioral14
Sample
Solara.Dir/Monaco/fileaccess/node_modules/body-parser/lib/read.js
Resource
win11-20240508-en
Behavioral task
behavioral15
Sample
Solara.Dir/Monaco/fileaccess/node_modules/body-parser/lib/types/json.js
Resource
win11-20240419-en
Behavioral task
behavioral16
Sample
Solara.Dir/Monaco/fileaccess/node_modules/body-parser/lib/types/raw.js
Resource
win11-20240611-en
Behavioral task
behavioral17
Sample
Solara.Dir/Monaco/fileaccess/node_modules/body-parser/lib/types/text.js
Resource
win11-20240611-en
Behavioral task
behavioral18
Sample
Solara.Dir/Monaco/fileaccess/node_modules/body-parser/lib/types/urlencoded.js
Resource
win11-20240508-en
Behavioral task
behavioral19
Sample
Solara.Dir/Monaco/fileaccess/node_modules/bytes/Readme.js
Resource
win11-20240611-en
Behavioral task
behavioral20
Sample
Solara.Dir/Monaco/fileaccess/node_modules/bytes/index.js
Resource
win11-20240508-en
Behavioral task
behavioral21
Sample
Solara.Dir/Monaco/fileaccess/node_modules/call-bind/callBound.js
Resource
win11-20240611-en
Behavioral task
behavioral22
Sample
Solara.Dir/Monaco/fileaccess/node_modules/call-bind/index.js
Resource
win11-20240611-en
Behavioral task
behavioral23
Sample
Solara.Dir/Monaco/fileaccess/node_modules/call-bind/test/callBound.js
Resource
win11-20240611-en
Behavioral task
behavioral24
Sample
Solara.Dir/Monaco/fileaccess/node_modules/call-bind/test/index.js
Resource
win11-20240508-en
Behavioral task
behavioral25
Sample
Solara.Dir/Monaco/fileaccess/node_modules/content-disposition/README.js
Resource
win11-20240508-en
Behavioral task
behavioral26
Sample
Solara.Dir/Monaco/fileaccess/node_modules/content-disposition/index.js
Resource
win11-20240508-en
Behavioral task
behavioral27
Sample
Solara.Dir/Monaco/fileaccess/node_modules/content-type/README.js
Resource
win11-20240419-en
Behavioral task
behavioral28
Sample
Solara.Dir/Monaco/fileaccess/node_modules/content-type/index.js
Resource
win11-20240419-en
Behavioral task
behavioral29
Sample
Solara.Dir/Monaco/fileaccess/node_modules/cookie-signature/Readme.js
Resource
win11-20240419-en
Behavioral task
behavioral30
Sample
Solara.Dir/Monaco/fileaccess/node_modules/cookie-signature/index.js
Resource
win11-20240611-en
Behavioral task
behavioral31
Sample
Solara.Dir/Monaco/fileaccess/node_modules/cookie/README.js
Resource
win11-20240611-en
Behavioral task
behavioral32
Sample
Solara.Dir/Monaco/fileaccess/node_modules/cookie/index.js
Resource
win11-20240508-en
General
-
Target
Solara.Dir/Microsoft.Web.WebView2.Core.dll
-
Size
488KB
-
MD5
851fee9a41856b588847cf8272645f58
-
SHA1
ee185a1ff257c86eb19d30a191bf0695d5ac72a1
-
SHA256
5e7faee6b8230ca3b97ce9542b914db3abbbd1cb14fd95a39497aaad4c1094ca
-
SHA512
cf5c70984cf33e12cf57116da1f282a5bd6433c570831c185253d13463b0b9a0b9387d4d1bf4dddab3292a5d9ba96d66b6812e9d7ebc5eb35cb96eea2741348f
-
SSDEEP
12288:W/TcW1virB3ye+iKzORFNgeA+imQ9pRFZNIEJdIElxPrEIgcvLcglxMwCepM1STy:W/1C4I
Malware Config
Signatures
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1008 OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1008 OpenWith.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dll,#11⤵PID:332
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4952
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1008