Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
05/08/2024, 21:19
240805-z6k44asejf 3Analysis
-
max time kernel
36s -
max time network
43s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
05/08/2024, 21:19
Static task
static1
Behavioral task
behavioral1
Sample
S0lardJIR.zip
Resource
win10-20240611-en
windows10-1703-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
S0lardJIR.zip
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
ReadMe.txt
Resource
win10-20240404-en
windows10-1703-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
ReadMe.txt
Resource
win11-20240802-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
S0laradD.zip
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
S0laradD.zip
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
150 seconds
General
-
Target
S0lardJIR.zip
-
Size
51.7MB
-
MD5
7e8d8e61ce430c2deba9fc3ec92adcdd
-
SHA1
35d82c91b3de86e54d85c7114c7ea28886006bb4
-
SHA256
acab77b266b9dd84d0c9ee60c734bd501567bbd8cafc8cc483a4b20800e62c9c
-
SHA512
662cccad7fc29ab59f496e744da543cedc61fd1f6b1f4c712fedbb0ef036e08ae915bfa4b9b291c99bf02514a54b63bd0f5c5c44cc908c335f47474e2ad460fb
-
SSDEEP
1572864:b6PvGj3IoD2r+hZ0ddjx6e+w1TC9LGrtUUGGZ:bN4o6MSjx6e+wwFvGZ
Score
3/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133673664663171167" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3136 chrome.exe 3136 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeShutdownPrivilege 3136 chrome.exe Token: SeCreatePagefilePrivilege 3136 chrome.exe Token: SeShutdownPrivilege 3136 chrome.exe Token: SeCreatePagefilePrivilege 3136 chrome.exe Token: SeShutdownPrivilege 3136 chrome.exe Token: SeCreatePagefilePrivilege 3136 chrome.exe Token: SeShutdownPrivilege 3136 chrome.exe Token: SeCreatePagefilePrivilege 3136 chrome.exe Token: SeShutdownPrivilege 3136 chrome.exe Token: SeCreatePagefilePrivilege 3136 chrome.exe Token: SeShutdownPrivilege 3136 chrome.exe Token: SeCreatePagefilePrivilege 3136 chrome.exe Token: SeShutdownPrivilege 3136 chrome.exe Token: SeCreatePagefilePrivilege 3136 chrome.exe Token: SeShutdownPrivilege 3136 chrome.exe Token: SeCreatePagefilePrivilege 3136 chrome.exe Token: SeShutdownPrivilege 3136 chrome.exe Token: SeCreatePagefilePrivilege 3136 chrome.exe Token: SeShutdownPrivilege 3136 chrome.exe Token: SeCreatePagefilePrivilege 3136 chrome.exe Token: SeShutdownPrivilege 3136 chrome.exe Token: SeCreatePagefilePrivilege 3136 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe 3136 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3136 wrote to memory of 4492 3136 chrome.exe 74 PID 3136 wrote to memory of 4492 3136 chrome.exe 74 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 4428 3136 chrome.exe 76 PID 3136 wrote to memory of 2876 3136 chrome.exe 77 PID 3136 wrote to memory of 2876 3136 chrome.exe 77 PID 3136 wrote to memory of 4468 3136 chrome.exe 78 PID 3136 wrote to memory of 4468 3136 chrome.exe 78 PID 3136 wrote to memory of 4468 3136 chrome.exe 78 PID 3136 wrote to memory of 4468 3136 chrome.exe 78 PID 3136 wrote to memory of 4468 3136 chrome.exe 78 PID 3136 wrote to memory of 4468 3136 chrome.exe 78 PID 3136 wrote to memory of 4468 3136 chrome.exe 78 PID 3136 wrote to memory of 4468 3136 chrome.exe 78 PID 3136 wrote to memory of 4468 3136 chrome.exe 78 PID 3136 wrote to memory of 4468 3136 chrome.exe 78 PID 3136 wrote to memory of 4468 3136 chrome.exe 78 PID 3136 wrote to memory of 4468 3136 chrome.exe 78 PID 3136 wrote to memory of 4468 3136 chrome.exe 78 PID 3136 wrote to memory of 4468 3136 chrome.exe 78 PID 3136 wrote to memory of 4468 3136 chrome.exe 78 PID 3136 wrote to memory of 4468 3136 chrome.exe 78 PID 3136 wrote to memory of 4468 3136 chrome.exe 78 PID 3136 wrote to memory of 4468 3136 chrome.exe 78 PID 3136 wrote to memory of 4468 3136 chrome.exe 78 PID 3136 wrote to memory of 4468 3136 chrome.exe 78 PID 3136 wrote to memory of 4468 3136 chrome.exe 78 PID 3136 wrote to memory of 4468 3136 chrome.exe 78
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\S0lardJIR.zip1⤵PID:4972
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:768
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff8c8f9758,0x7fff8c8f9768,0x7fff8c8f97782⤵PID:4492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1552 --field-trial-handle=1864,i,5033001288510342283,9305673042814217148,131072 /prefetch:22⤵PID:4428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1828 --field-trial-handle=1864,i,5033001288510342283,9305673042814217148,131072 /prefetch:82⤵PID:2876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2112 --field-trial-handle=1864,i,5033001288510342283,9305673042814217148,131072 /prefetch:82⤵PID:4468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1864,i,5033001288510342283,9305673042814217148,131072 /prefetch:12⤵PID:2292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1864,i,5033001288510342283,9305673042814217148,131072 /prefetch:12⤵PID:1852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4428 --field-trial-handle=1864,i,5033001288510342283,9305673042814217148,131072 /prefetch:12⤵PID:2988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 --field-trial-handle=1864,i,5033001288510342283,9305673042814217148,131072 /prefetch:82⤵PID:444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 --field-trial-handle=1864,i,5033001288510342283,9305673042814217148,131072 /prefetch:82⤵PID:4820
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2324
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5a718fa15ee4363abec29f4343169f458
SHA150c23a1b6fa266896ef28201de5fb3025d9be1ac
SHA25609a8b39f7879e673355692dd32c7c3c344dd606b4d42f4d8ca22497d4170b632
SHA512d57673440d943aec1c2a77746d8c6009d9e6a4e59d0708a236dd2ac7db6b9a8eebc2c94f5fc3286567363f973accf26bff75a53f8b6950d87e08080307c03e62
-
Filesize
307KB
MD5d5e00b359712330314968831d024f397
SHA16c748d0a112756d6554bc7558a48d1f44115233f
SHA25651e93971724f132a09bc7f8dc0d01209e6bfc268bbd9b356b9dd42cb06d84e50
SHA5124b063c091282d5184404ed9a339e7e43d81f7d344ac133c2d9908d160dcb333bbee85028e16649f64a732952d9b5ca9025e64d3379fad238221836d09e316f80
-
Filesize
150KB
MD573665ed91763ea32a5485d9bc5356c2e
SHA128e9530c670225bc77ef9963eb60e7c3cee315b0
SHA256c29adadb041d8382848654e990082505c5aead1e67ec402c1ceb91f665d15992
SHA51239bf0310b04bdd6f6d6c02f01464ab72b984a2785633422d7cce96d22501af80bde092d88fbb11942d4de02c657e2852218ca7532c2032ad3d48ac07096240d6
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd