ceaed51bfaf0862e89a1790376ff6969bcc7c266e2c7b73cf67f57ad3ca7a397

Resubmissions

01/09/2024, 18:16

240901-wwfj3sydra10

01/09/2024, 18:12

240901-wtngxaydkf1

Analysis

max time kernel
145s
max time network
148s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01/09/2024, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Solara.zip
Size 13.4MB
Sample240901-wtngxaydkf
SHA256 ceaed51bfaf0862e89a1790376ff6969bcc7c266e2c7b73cf67f57ad3ca7a397
MD5 6fe0bb4598fba38e1c2dc25b084ae38e
SHA1 7514257cc85b0a2d4b218f43f9a8f4dd61c545cf
SHA512 232b90973680eadbf11851fa20dc1e0ffbcae86f14bd8b605964a593775705cdc69dcb3cd9a5ab66ce18785c2a098df75f58392b1c3d6a04f28c57541fdc632b
SSDEEP 393216:+H7gx90ywmq3gvGQ1HUPri1xktbsUjOBo+mt:u7e92v+PRUDi1QvaoTt
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	756	firefox.exe
Token: SeDebugPrivilege	756	firefox.exe
Token: SeDebugPrivilege	756	firefox.exe
Token: SeDebugPrivilege	756	firefox.exe
Token: SeDebugPrivilege	756	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
756	firefox.exe
756	firefox.exe
756	firefox.exe
756	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
756	firefox.exe
756	firefox.exe
756	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
756	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 756	4684	firefox.exe	75
PID 4684 wrote to memory of 756	4684	firefox.exe	75
PID 4684 wrote to memory of 756	4684	firefox.exe	75
PID 4684 wrote to memory of 756	4684	firefox.exe	75
PID 4684 wrote to memory of 756	4684	firefox.exe	75
PID 4684 wrote to memory of 756	4684	firefox.exe	75
PID 4684 wrote to memory of 756	4684	firefox.exe	75
PID 4684 wrote to memory of 756	4684	firefox.exe	75
PID 4684 wrote to memory of 756	4684	firefox.exe	75
PID 4684 wrote to memory of 756	4684	firefox.exe	75
PID 4684 wrote to memory of 756	4684	firefox.exe	75
PID 756 wrote to memory of 1040	756	firefox.exe	76
PID 756 wrote to memory of 1040	756	firefox.exe	76
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 4648	756	firefox.exe	77
PID 756 wrote to memory of 2248	756	firefox.exe	78
PID 756 wrote to memory of 2248	756	firefox.exe	78
PID 756 wrote to memory of 2248	756	firefox.exe	78

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Solara.zip
1⤵
PID:3896

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.0.1638362606\1907113460" -parentBuildID 20221007134813 -prefsHandle 1720 -prefMapHandle 1712 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8baf7b39-1f3f-4113-8e55-429b65cab85f} 756 "\\.\pipe\gecko-crash-server-pipe.756" 1800 284b00f5b58 gpu
    3⤵
    PID:1040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.1.652678389\630727009" -parentBuildID 20221007134813 -prefsHandle 2124 -prefMapHandle 2120 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30f6a5b6-8be0-486f-9a54-cbfaa88e2f76} 756 "\\.\pipe\gecko-crash-server-pipe.756" 2152 2849dc72e58 socket
    3⤵
    PID:4648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.2.1667747031\1371635547" -childID 1 -isForBrowser -prefsHandle 2788 -prefMapHandle 2812 -prefsLen 20866 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d60ab1e9-f8a7-4e18-af32-e690d5338aff} 756 "\\.\pipe\gecko-crash-server-pipe.756" 2732 284b005c858 tab
    3⤵
    PID:2248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.3.444451351\1716223215" -childID 2 -isForBrowser -prefsHandle 3464 -prefMapHandle 3460 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f09d4b40-ea07-46d9-8b42-5ada0cf6c406} 756 "\\.\pipe\gecko-crash-server-pipe.756" 3144 2849dc62858 tab
    3⤵
    PID:4308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.4.69700701\1744519254" -childID 3 -isForBrowser -prefsHandle 4428 -prefMapHandle 4432 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5aef4e43-d8c8-4605-95ff-acd2e1ed362a} 756 "\\.\pipe\gecko-crash-server-pipe.756" 4448 284b6462658 tab
    3⤵
    PID:1696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.5.1651809899\1231702470" -childID 4 -isForBrowser -prefsHandle 4912 -prefMapHandle 4876 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4ae743d-215c-4e43-bc6f-5b24f0da552d} 756 "\\.\pipe\gecko-crash-server-pipe.756" 4928 284b5198f58 tab
    3⤵
    PID:2408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.6.676257478\1333240169" -childID 5 -isForBrowser -prefsHandle 5076 -prefMapHandle 5080 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c474a0dd-cf2c-4836-8cb0-b95de0df7ba4} 756 "\\.\pipe\gecko-crash-server-pipe.756" 4960 284b6634858 tab
    3⤵
    PID:4108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.7.1102842151\2016725965" -childID 6 -isForBrowser -prefsHandle 5276 -prefMapHandle 5280 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {06235906-e5bf-4c4a-aae3-70503c958944} 756 "\\.\pipe\gecko-crash-server-pipe.756" 5268 284b7306b58 tab
    3⤵
    PID:4684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.8.2047469772\547489481" -childID 7 -isForBrowser -prefsHandle 2508 -prefMapHandle 5252 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcdfcc16-d161-4bb2-b5fb-80fa4621620f} 756 "\\.\pipe\gecko-crash-server-pipe.756" 5692 284b8105358 tab
    3⤵
    PID:1400

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 ae18696a30fee6aa4cd11fd0acec093547c5db736428113c45ee9ee2b0ae93ed
MD5 2da13628ac802c54c9ce4b964ec7eb10
SHA1 d474d88c3da50cb22317fc0b4d6f096b9af094b6
SHA512 4b2e3e9ec55db0786e6c4c7a2801e0ff0933af015f3ede782d526d2cea51002fb4e47109c3ce02fc87f61a1df9cfcf18f17fbf81b92e1ba273fbd12fc4ce2a29
MD5 SHA1 SHA512

Submit Download

04359caa-36e0-40d5-827a-91fa378cc5d8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\04359caa-36e0-40d5-827a-91fa378cc5d8
Size 11KB
SHA256 d3a75d2adadf7dfff5ecee183d7de7dda196ffb3d4bd91b854d6030386574c2e
MD5 af8a38d0b0552b833bfe44738d05cda7
SHA1 9feac0bafd7fc53f1a4ce1344497e2ae756c0926
SHA512 74a1d12e2bcfc1af6659961ef32a6f3cb0c8778d37ff1219ab97c5770e2de27df28327b2851dee3ef8f5770ed48c2e178f01e2c76a4d1cb5f08acfe16f983898
SSDEEP 192:qkTVRAel81MN4b1J09Tg6iHtkAfBy6i0xm0A+kGOC/ZJ+42kNo48e4Lv1z:qivf71z
MD5 SHA1 SHA512 SSDEEP

Submit Download

319fe5e5-d96e-4ed1-be28-aeac5d136112

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\319fe5e5-d96e-4ed1-be28-aeac5d136112
Size 746B
SHA256 b4f772d54b61c4418b26511564f96bbd29b00c36187fec6a3688d5df4fac1c46
MD5 b20aca3c95bcc11dcd33dfb6f61aefc9
SHA1 8912aab6ddfc8e100703adea5fcb57a459a5a02f
SHA512 3844a863a4176b9b0bbc8ecf519fd4b50d862e33b280c6a4251512627a5a0a967a2e093747634821f971efc7163d40db1b613774e9f943f27ae2794a5e3e90dc
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js
Size 6KB
SHA256 f03efc7f047be3ba121f99784daef01b3c3bdecd6166af8d36bfff8d8bc18a22
MD5 a3d73c55daaf36efde536f1d59975e0b
SHA1 b0cffd3d4cff3aba7a1751aeb11c81d764e89892
SHA512 3b2152b25544c52db299101d767e5868993ee3af275d712cce05c23a912fed72b408876d58f7c08b31b06866b83da8aae57ad7b6f77e9836942beec6150e1ee9
SSDEEP 96:xH95nUTeqGqA+dXv6aeOTzSbPXAnpjMHydvqRBw8H21GS:r5nIRA+dXv6aelPXZydWBw8Hk
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js
Size 6KB
SHA256 05d55df7eb2324e6de128851178c2551e1618f3f989fa1efb099c40f99a6fca3
MD5 872f62fe8330c26c66025fc5806d44ee
SHA1 280fe2a8e325c3f2e6e566b5b30f62115407b112
SHA512 18d0fc2ab3380aaa033f832389f197e6a9e22f7b5520fc46d9c2152b77beaf9e841235251f02d4550bdba187c106fccccd495147e2b46236fa7fbe3ea0d64f60
SSDEEP 96:xH9QnUTeqGqA+dXv6aeOTzSbPXAnpjMHydvqRBw8H26GS:rQnIRA+dXv6aelPXZydWBw8Hr
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js
Size 6KB
SHA256 776eabbc840551a3c193aa4a3df2c1c34cab9a93e20873c7a82a28f0115807fa
MD5 96e5a920258591fc10ef1305dafc05da
SHA1 070f526b4f45f242f2645d4f583bf773f2f917ba
SHA512 9449fc70f8415ff4828f9390ad6fe04a3402d071059375b61254cc2c200cc9cdca476e73659d6a530a1536b5523d5cd69206f106dbfde8cc146eaa0c2d9f4dd4
SSDEEP 96:xH95nUTeqGqA+dXV9eOTzSbPXAnpjMHydvqtBw8H21GS:r5nIRA+dXV9elPXZydSBw8Hk
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs.js
Size 6KB
SHA256 baacd38d232c22d871fb71aa362cac86568a1ca16d3bb79af6c553dd9f1f7791
MD5 a1ddf55f1f5de6ab8f9b565291070b31
SHA1 873d6b89ae3d14190befbd159735a9ab7b4594ae
SHA512 123371d68a8b05639c349897e385972ad3ad370407f891263d87875f6ef3ab819203cef790374a07f6119a9d0f1016df854f1b3e121ae322b327f742ad4d364c
SSDEEP 96:xH95nUTeqGqA+dXV9eOTzS7PXAnpjPHydvqtBw8V2o:r5nIRA+dXV9e5PXwydSBw8Vz
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 e54fe3b3376cb3c0bb9c16661f7648715b1f3556551e6243596078239e934845
MD5 42eb36f2b52c519269164b7a538d4918
SHA1 dcfb0729e57735ff264e66c3585ad8b41ff5c9f2
SHA512 e6435d3a62b5086070a37d3cf6d445e0729e4d1b3650fb1bc3bd0f1849479a68da2213d55ca3ff964f3c5cec35db0ab649b2a82dfecbd4ebd491cfe3f414334a
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 a5ffc0a361a28094b4a778123a2234bb593f3fddd696dedeb8eeda7ceb69956c
MD5 58dd85f2a10cda70aa74cc6fe1d41847
SHA1 a9cc5a96f38c789a871db51ee4568aadcc0e03de
SHA512 356a2e087840f17c401bc7a06f8eaa3f0303f2e923a933b86c05b2a92f7812c555f87a430d8fedb4e0eaa8d1a1488dcb1060f2cc1348f1ecfc6fd80a59415cb5
SSDEEP 96:fLBqMVc8lNs8EMJF70baMZk0zf8W8Qge3ZwS2cJqgJ:FqMV9NsRgFEaMZkcuemAZJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 184KB
SHA256 8f426b4be5e3440fa14d37480f018b7dc3d1a547b0e91c2fbfc6e31d9054a359
MD5 731c0e733fe1e3123d366af7c8e578ae
SHA1 9756304ea773dd9cd96e5996dc79de2ed6a9ae9c
SHA512 d29e0f2356a3226f64692b390c122d4d70f09f677d9f5d086f2babaeba6574d670171edb24ff52f928871ec489680f57910e21fac1ca8ec08783a07d21b1f427
SSDEEP 3072:XGcHzPRuFPF3y3O6g39636uacM1eHlx27:XGcHzPR093y3O636uacM1eHK7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads