eae82110f6f946e3d25841be95c12d02e2d75edc587b08e85bdecccaa5e60115 | Triage

Analysis

max time kernel
39s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 03:56

Sharing

Report Analysis Logs

General

Target

SolaraExecutor.zip
Size

27.7MB
MD5

b544b5e83e316adfc05698374b498746
SHA1

d2788c9a21788ace5c1c05626131b6052025f8a3
SHA256

eae82110f6f946e3d25841be95c12d02e2d75edc587b08e85bdecccaa5e60115
SHA512

ee7a3081b815f36c1f30e38890b42a32ed9cb3965af244b5b1395acaa39233a0aab545710a3b8621d9158597e1d5765c3b828c4b9b234375b3b1cd27cb6178b1
SSDEEP

786432:nA+uDskWQ8bRWNpElTy4SykNPLdltOMa+ylpU+T6CM7:nyBWpgCA4oDjUJHAP

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2868	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2868	AUDIODG.EXE
Token: 33	2868	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2868	AUDIODG.EXE

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SolaraExecutor.zip
1⤵
PID:1476

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1968

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x474
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads