Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 14:34
Behavioral task
behavioral1
Sample
SolaraBootstrapper.exe
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
General
-
Target
SolaraBootstrapper.exe
-
Size
227KB
-
MD5
666f6194638d6e82977e48cbb6c69558
-
SHA1
df3cdcf3a47544982d88b3a8ee6c499ebab2b4f2
-
SHA256
f25954c0bee0de252c3148d22de7b37780124b0065cebf09cfca2fce9fbef080
-
SHA512
dd9f868fcdae3205ca1714390a1dbe8c598e1c16e785cb2491bbb45e444a9f2fe3a04d0b4004c1c1575090c610241857439e2c29f8e82ec3b060700bb3e4e177
-
SSDEEP
6144:+loZMLrIkd8g+EtXHkv/iD4wDvr7ByalogRj++70vb8e1muzri:ooZ0L+EP8wDvr7ByalogRj++7mZm
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/780-1-0x00000000001A0000-0x00000000001E0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 780 SolaraBootstrapper.exe Token: SeIncreaseQuotaPrivilege 2756 wmic.exe Token: SeSecurityPrivilege 2756 wmic.exe Token: SeTakeOwnershipPrivilege 2756 wmic.exe Token: SeLoadDriverPrivilege 2756 wmic.exe Token: SeSystemProfilePrivilege 2756 wmic.exe Token: SeSystemtimePrivilege 2756 wmic.exe Token: SeProfSingleProcessPrivilege 2756 wmic.exe Token: SeIncBasePriorityPrivilege 2756 wmic.exe Token: SeCreatePagefilePrivilege 2756 wmic.exe Token: SeBackupPrivilege 2756 wmic.exe Token: SeRestorePrivilege 2756 wmic.exe Token: SeShutdownPrivilege 2756 wmic.exe Token: SeDebugPrivilege 2756 wmic.exe Token: SeSystemEnvironmentPrivilege 2756 wmic.exe Token: SeRemoteShutdownPrivilege 2756 wmic.exe Token: SeUndockPrivilege 2756 wmic.exe Token: SeManageVolumePrivilege 2756 wmic.exe Token: 33 2756 wmic.exe Token: 34 2756 wmic.exe Token: 35 2756 wmic.exe Token: SeIncreaseQuotaPrivilege 2756 wmic.exe Token: SeSecurityPrivilege 2756 wmic.exe Token: SeTakeOwnershipPrivilege 2756 wmic.exe Token: SeLoadDriverPrivilege 2756 wmic.exe Token: SeSystemProfilePrivilege 2756 wmic.exe Token: SeSystemtimePrivilege 2756 wmic.exe Token: SeProfSingleProcessPrivilege 2756 wmic.exe Token: SeIncBasePriorityPrivilege 2756 wmic.exe Token: SeCreatePagefilePrivilege 2756 wmic.exe Token: SeBackupPrivilege 2756 wmic.exe Token: SeRestorePrivilege 2756 wmic.exe Token: SeShutdownPrivilege 2756 wmic.exe Token: SeDebugPrivilege 2756 wmic.exe Token: SeSystemEnvironmentPrivilege 2756 wmic.exe Token: SeRemoteShutdownPrivilege 2756 wmic.exe Token: SeUndockPrivilege 2756 wmic.exe Token: SeManageVolumePrivilege 2756 wmic.exe Token: 33 2756 wmic.exe Token: 34 2756 wmic.exe Token: 35 2756 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 780 wrote to memory of 2756 780 SolaraBootstrapper.exe 28 PID 780 wrote to memory of 2756 780 SolaraBootstrapper.exe 28 PID 780 wrote to memory of 2756 780 SolaraBootstrapper.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2756
-