Analysis Overview
SHA256
83d064ee508b2543d3f9fc16f4ed16fee34cf130713d3cee54d5f20ce7f452cc
Threat Level: Known bad
The file SolaraV2.1 nano.exe was found to be: Known bad.
Malicious Activity Summary
NanoCore
Nanocore family
Adds Run key to start application
Checks whether UAC is enabled
Drops file in Program Files directory
Unsigned PE
System Location Discovery: System Language Discovery
Scheduled Task/Job: Scheduled Task
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-11 16:29
Signatures
Nanocore family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-11 16:29
Reported
2024-08-11 16:30
Platform
win7-20240704-en
Max time kernel
16s
Max time network
16s
Command Line
Signatures
NanoCore
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LAN Subsystem = "C:\\Program Files (x86)\\LAN Subsystem\\lanss.exe" | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files (x86)\LAN Subsystem\lanss.exe | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| File opened for modification | C:\Program Files (x86)\LAN Subsystem\lanss.exe | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe"
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "LAN Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC5CF.tmp"
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "LAN Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC67B.tmp"
Network
| Country | Destination | Domain | Proto |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp |
Files
memory/2552-0-0x0000000074B41000-0x0000000074B42000-memory.dmp
memory/2552-1-0x0000000074B40000-0x00000000750EB000-memory.dmp
memory/2552-2-0x0000000074B40000-0x00000000750EB000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpC5CF.tmp
| MD5 | 4bb70ae457112a038573b994ab89c3ae |
| SHA1 | 7e5057e0034d70f94c17c10438437b138f055780 |
| SHA256 | 411a8d9306b8233d8dad43faae19467494e84a5458e6e2c461bc9db4c10a940c |
| SHA512 | aaba48de49eb6fef60ec38e3f9f7ec3b4fc5962ff95259c9362afd01a30c6d290475b4c9c4dc5ba442de106ad4bde38d28768caf3f6aaf309e613cc115711dd1 |
C:\Users\Admin\AppData\Local\Temp\tmpC67B.tmp
| MD5 | 924694e208642d4d8a4c7e0f0cba0de1 |
| SHA1 | 87e9496a918036c3e3902f125b95a47e38548828 |
| SHA256 | 8de0bab59a9fe15f312e81a373382ed992ce5110deb3813f663b92cfc5eae0b6 |
| SHA512 | ef3cfc08df53777f13fb51fdc0269f6f686c0df57c4dd72f395dc53d1d8ef2b08e33c3601507a45c3cc31a25b70ebf365d0fa93db64e1e851173216a45c49c2c |
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-11 16:29
Reported
2024-08-11 16:30
Platform
win10v2004-20240802-en
Max time kernel
16s
Max time network
21s
Command Line
Signatures
NanoCore
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Monitor = "C:\\Program Files (x86)\\WPA Monitor\\wpamon.exe" | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files (x86)\WPA Monitor\wpamon.exe | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| File opened for modification | C:\Program Files (x86)\WPA Monitor\wpamon.exe | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1932 wrote to memory of 3468 | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | C:\Windows\SysWOW64\schtasks.exe |
| PID 1932 wrote to memory of 3468 | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | C:\Windows\SysWOW64\schtasks.exe |
| PID 1932 wrote to memory of 3468 | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | C:\Windows\SysWOW64\schtasks.exe |
| PID 1932 wrote to memory of 4776 | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | C:\Windows\SysWOW64\schtasks.exe |
| PID 1932 wrote to memory of 4776 | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | C:\Windows\SysWOW64\schtasks.exe |
| PID 1932 wrote to memory of 4776 | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | C:\Windows\SysWOW64\schtasks.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe"
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "WPA Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp67DD.tmp"
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "WPA Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp684B.tmp"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4372,i,3861745594156495651,17595114179815238301,262144 --variations-seed-version --mojo-platform-channel-handle=1016 /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp |
Files
memory/1932-0-0x0000000074D62000-0x0000000074D63000-memory.dmp
memory/1932-1-0x0000000074D60000-0x0000000075311000-memory.dmp
memory/1932-2-0x0000000074D60000-0x0000000075311000-memory.dmp
memory/1932-4-0x0000000074D60000-0x0000000075311000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp67DD.tmp
| MD5 | 4bb70ae457112a038573b994ab89c3ae |
| SHA1 | 7e5057e0034d70f94c17c10438437b138f055780 |
| SHA256 | 411a8d9306b8233d8dad43faae19467494e84a5458e6e2c461bc9db4c10a940c |
| SHA512 | aaba48de49eb6fef60ec38e3f9f7ec3b4fc5962ff95259c9362afd01a30c6d290475b4c9c4dc5ba442de106ad4bde38d28768caf3f6aaf309e613cc115711dd1 |
C:\Users\Admin\AppData\Local\Temp\tmp684B.tmp
| MD5 | a246b3561d823177f3586e629f144233 |
| SHA1 | 0f05d12e55a1d2e5e6a4f307c193882fba093315 |
| SHA256 | 6abae7707b06e52b58f537b335e367cc54b093e899d78f16e94ceaf7ceafca52 |
| SHA512 | 4246aa9a96331e2c7e36b37fa778e31ecae055c77164e0dc673aa50cdec368f08d356ab06ef1a4540816c474828048ab1bebed7e211a4eb929f2918e1fac9c6d |
memory/1932-11-0x0000000074D60000-0x0000000075311000-memory.dmp
memory/1932-12-0x0000000074D62000-0x0000000074D63000-memory.dmp
memory/1932-13-0x0000000074D60000-0x0000000075311000-memory.dmp