Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1799s -
max time network
1685s -
platform
windows10-1703_x64 -
resource
win10-20240404-uk -
resource tags
arch:x64arch:x86image:win10-20240404-uklocale:uk-uaos:windows10-1703-x64systemwindows -
submitted
04/07/2024, 14:45
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.mediafire.com/file/hxqpc0gpgm7bwbc/SolaraB.zip/file
Resource
win10-20240404-uk
Behavioral task
behavioral2
Sample
https://www.mediafire.com/file/hxqpc0gpgm7bwbc/SolaraB.zip/file
Resource
win10v2004-20240611-uk
General
-
Target
https://www.mediafire.com/file/hxqpc0gpgm7bwbc/SolaraB.zip/file
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133645891526130994" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3364 chrome.exe 3364 chrome.exe 4268 chrome.exe 4268 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3364 chrome.exe 3364 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe Token: SeShutdownPrivilege 3364 chrome.exe Token: SeCreatePagefilePrivilege 3364 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe 3364 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3364 wrote to memory of 1084 3364 chrome.exe 72 PID 3364 wrote to memory of 1084 3364 chrome.exe 72 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 3528 3364 chrome.exe 74 PID 3364 wrote to memory of 300 3364 chrome.exe 75 PID 3364 wrote to memory of 300 3364 chrome.exe 75 PID 3364 wrote to memory of 196 3364 chrome.exe 76 PID 3364 wrote to memory of 196 3364 chrome.exe 76 PID 3364 wrote to memory of 196 3364 chrome.exe 76 PID 3364 wrote to memory of 196 3364 chrome.exe 76 PID 3364 wrote to memory of 196 3364 chrome.exe 76 PID 3364 wrote to memory of 196 3364 chrome.exe 76 PID 3364 wrote to memory of 196 3364 chrome.exe 76 PID 3364 wrote to memory of 196 3364 chrome.exe 76 PID 3364 wrote to memory of 196 3364 chrome.exe 76 PID 3364 wrote to memory of 196 3364 chrome.exe 76 PID 3364 wrote to memory of 196 3364 chrome.exe 76 PID 3364 wrote to memory of 196 3364 chrome.exe 76 PID 3364 wrote to memory of 196 3364 chrome.exe 76 PID 3364 wrote to memory of 196 3364 chrome.exe 76 PID 3364 wrote to memory of 196 3364 chrome.exe 76 PID 3364 wrote to memory of 196 3364 chrome.exe 76 PID 3364 wrote to memory of 196 3364 chrome.exe 76 PID 3364 wrote to memory of 196 3364 chrome.exe 76 PID 3364 wrote to memory of 196 3364 chrome.exe 76 PID 3364 wrote to memory of 196 3364 chrome.exe 76 PID 3364 wrote to memory of 196 3364 chrome.exe 76 PID 3364 wrote to memory of 196 3364 chrome.exe 76
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/hxqpc0gpgm7bwbc/SolaraB.zip/file1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff42319758,0x7fff42319768,0x7fff423197782⤵PID:1084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1848,i,5405688323671981847,5137235505642885575,131072 /prefetch:22⤵PID:3528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 --field-trial-handle=1848,i,5405688323671981847,5137235505642885575,131072 /prefetch:82⤵PID:300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2080 --field-trial-handle=1848,i,5405688323671981847,5137235505642885575,131072 /prefetch:82⤵PID:196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2808 --field-trial-handle=1848,i,5405688323671981847,5137235505642885575,131072 /prefetch:12⤵PID:4112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2816 --field-trial-handle=1848,i,5405688323671981847,5137235505642885575,131072 /prefetch:12⤵PID:4776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3684 --field-trial-handle=1848,i,5405688323671981847,5137235505642885575,131072 /prefetch:82⤵PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4404 --field-trial-handle=1848,i,5405688323671981847,5137235505642885575,131072 /prefetch:82⤵PID:788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4292 --field-trial-handle=1848,i,5405688323671981847,5137235505642885575,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4268
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4328
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216B
MD5899ef416db95f189dc3e3fc11cfdc147
SHA14a4faf7258ffe004b2972b5d24843d17a03bece0
SHA256e6b9b8355612be8958cee450c6ab832b3a8a4adf11fa9d3af9e78ec92b2d1b89
SHA5121563b897d579bed02ec0b1a41f3c7a55c25331415fbca1fefab5bc3a4171d5c7b7815cfc9e4c71f7f4b47d2f0ca4b5c742fb737cc2bf2c335dc3ec707a29182c
-
Filesize
2KB
MD511a7e161b6f950ea98d598bb43c54514
SHA12e33e25fcc3d0d9bc0b3d6fa40cb69e9f6d36bae
SHA256c032359fb839a12bd8b3827b635ef31e736a36cbd365a95c5de350c5ee51d658
SHA5124944f101ec4843558e28213a125d7c018fb826c6ef9c36d34ab956ccbcba5723c5dfa4a18daa1f373a04b880e395bf6619299b7a160781836d3429c1958f7f4b
-
Filesize
2KB
MD5d462838d3795674e3814a27a5f35bbc9
SHA17b7c03d45b5a72a8afb02415f86297946946a0a7
SHA2568114d816b6d0c33980817a8b61dc5b7aefbbe4fbfdd6a680fd6a914ea8457b32
SHA5121f4fb2c15f2c671cfb5be1e08b4b2d812b3f4c53dc047ad522f97e4c8eba6ea18f1713f966812c4f0a5a982ead42282af207796a340bcb566d924e458ae03e74
-
Filesize
3KB
MD5f7a09faf1a8611ee5699e0527247bdf3
SHA11e327c46a3784498867a997efa08dfd38ff6ec38
SHA25689c9945f7fe03e24028dfaeb01e9df0275403ed0d02659e06bf1934bb48ff2de
SHA512be809ba45872fc54d7651a0a475bc733d1fe9470b40aa3948e80c71ea507b22667e3d934ba042cd8be19d51fb37229b7e2d13b2c05f191060fdda1e05ca24969
-
Filesize
535B
MD54685588a3226bf501bfdf988a924667f
SHA1f3f298cfa9d241ad88b938f53faaa97d14262e1f
SHA25678b5693b7628de9f3ecf38262f12caf37c6c80afd7d65ecb20f913890fcfe1b7
SHA512aba16349c547ad8786d1fb71b28d2ffc92f7d4b1d04f7f4211b7d52e2d983c237dec8e7bf3b9bbe436e726943f4ad62d16231a01d95d3e32184abc9d870da30a
-
Filesize
6KB
MD5d5f80c8b90c21e4935727a23e793f21d
SHA1af1724076e985565c494b7329c385beebde60127
SHA256ac8bca7c3637e0c2a5cd3fe5b33331c2f23709c056a3f6d653b662f617a2b5bd
SHA512133fe1403b768e17f608402b042ed5b2f29837e2c1a78be339b4d037555de90b29c8498403618981969ca59f73606135258c29d1af905c43e3eb5dcdefb91a72
-
Filesize
6KB
MD5fc8564e3619825acd07be3635b7a3a28
SHA1889d8150ef88b225c13dabf57893b9514bc449a9
SHA2562ac49ab68c715013cbfe4200550a3d22795f931af56a9ab3696a949a8f0300e3
SHA51210d6c73151d9326592a4135591d79c2d9fe466c4426abf5d5aefceff98729e84160b33518fcbf48b5ed1e3560749da13ca6ad932c4d15ac24b8ad3363a855484
-
Filesize
6KB
MD58fe18bb49e3a25a4adf24ff8d2bc9aef
SHA171dcade939d9d2f85351b0b2ea1fb7decbfd0207
SHA256128bfbeb2bd672c446123f23ccc3ba5abd1705ffd20c20106f66aaa7909dbbce
SHA51219a3c0159709467a991c414ac038e975d2d8fc520e74992e2d09ccd437a2701a7a1cf21493e21d96e5a7783c17f2d3691eacfb2755c399a47fa863a4a26d7ddf
-
Filesize
136KB
MD52752b9efffca18bafc9792433ec84be7
SHA196f57dd1d824f7e0a9d1ac40303be9817285ecea
SHA2560e1d0cffb1d9989f911615ef44beb3bb8cf8791910cd7ef441338496a48fdb62
SHA5125a843e9b7d5146e06a6e2e063c78ef6815e70cd5104b9697fcfd2c6eca5224529b7a1d19f66427858327c2791760dcafa2ec5edadf2e693020f67985081cedd0
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd