Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    300s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    30/06/2024, 14:52

General

  • Target

    Solar Tweaks.exe

  • Size

    130.1MB

  • MD5

    b7cd0e6338eea04671d96dc170749be3

  • SHA1

    99ccfefb5d283e37f488c78112fcb9e9418d6798

  • SHA256

    b922365aa35ae4352b0fec087219efca5b6173adba2d0a475b336a2fc6e36fad

  • SHA512

    1f1b70563cb97ca3e6a6dd25a50d3b59da265539a011d7b4b99d17f09d2145c6469d55a589978c3f657f78225083ae8d4e1ba208195924967ffc5ffa4b8b7943

  • SSDEEP

    1572864:2mYWQRWtJ65M7a2iu4Rywh9hJyO9N+oJOTU8f/kmgZ2sI:B4M7a2H4Ryu+dNgI

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Solar Tweaks.exe
    "C:\Users\Admin\AppData\Local\Temp\Solar Tweaks.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Users\Admin\AppData\Local\Temp\Solar Tweaks.exe
      "C:\Users\Admin\AppData\Local\Temp\Solar Tweaks.exe" --type=gpu-process --field-trial-handle=1344,10484922694791134178,2245615191555646019,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1360 /prefetch:2
      2⤵
        PID:1152
      • C:\Users\Admin\AppData\Local\Temp\Solar Tweaks.exe
        "C:\Users\Admin\AppData\Local\Temp\Solar Tweaks.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1344,10484922694791134178,2245615191555646019,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1636 /prefetch:8
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2748
      • C:\Users\Admin\AppData\Local\Temp\Solar Tweaks.exe
        "C:\Users\Admin\AppData\Local\Temp\Solar Tweaks.exe" --type=renderer --field-trial-handle=1344,10484922694791134178,2245615191555646019,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1860 /prefetch:1
        2⤵
        • Checks computer location settings
        • Suspicious behavior: EnumeratesProcesses
        PID:2588
      • C:\Users\Admin\AppData\Local\Temp\Solar Tweaks.exe
        "C:\Users\Admin\AppData\Local\Temp\Solar Tweaks.exe" --type=gpu-process --field-trial-handle=1344,10484922694791134178,2245615191555646019,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1360 /prefetch:2
        2⤵
          PID:1648

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\solartweaks\settings.json

        Filesize

        2B

        MD5

        99914b932bd37a50b983c5e7c90ae93b

        SHA1

        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

        SHA256

        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

        SHA512

        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

      • memory/1152-1-0x0000000000060000-0x0000000000061000-memory.dmp

        Filesize

        4KB

      • memory/1152-33-0x0000000077360000-0x0000000077361000-memory.dmp

        Filesize

        4KB