Overview
overview
9Static
static
9Solarًa.zip
windows7-x64
1Solarًa.zip
windows10-2004-x64
1Solar/auto...st.lua
windows7-x64
3Solar/auto...st.lua
windows10-2004-x64
3Solar/auto...t2.lua
windows7-x64
3Solar/auto...t2.lua
windows10-2004-x64
3Solar/locales/af.pak
windows7-x64
3Solar/locales/af.pak
windows10-2004-x64
3Solar/locales/am.pak
windows7-x64
3Solar/locales/am.pak
windows10-2004-x64
3Solar/locales/ar.pak
windows7-x64
3Solar/locales/ar.pak
windows10-2004-x64
3Solar/locales/bg.pak
windows7-x64
3Solar/locales/bg.pak
windows10-2004-x64
3Solar/locales/bn.pak
windows7-x64
3Solar/locales/bn.pak
windows10-2004-x64
3Solar/locales/ca.pak
windows7-x64
3Solar/locales/ca.pak
windows10-2004-x64
3Solar/locales/cs.pak
windows7-x64
3Solar/locales/cs.pak
windows10-2004-x64
3Solar/locales/da.pak
windows7-x64
3Solar/locales/da.pak
windows10-2004-x64
3Solar/locales/de.pak
windows7-x64
3Solar/locales/de.pak
windows10-2004-x64
3Solar/locales/el.pak
windows7-x64
3Solar/locales/el.pak
windows10-2004-x64
3Solar/loca...GB.pak
windows7-x64
3Solar/loca...GB.pak
windows10-2004-x64
3Solar/loca...US.pak
windows7-x64
3Solar/loca...US.pak
windows10-2004-x64
3Solar/loca...19.pak
windows7-x64
3Solar/loca...19.pak
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-09-2024 04:00
Behavioral task
behavioral1
Sample
Solarًa.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Solarًa.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Solar/autoexec/test.lua
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Solar/autoexec/test.lua
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Solar/autoexec/test2.lua
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Solar/autoexec/test2.lua
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Solar/locales/af.pak
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Solar/locales/af.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Solar/locales/am.pak
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Solar/locales/am.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Solar/locales/ar.pak
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Solar/locales/ar.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Solar/locales/bg.pak
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Solar/locales/bg.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Solar/locales/bn.pak
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Solar/locales/bn.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Solar/locales/ca.pak
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Solar/locales/ca.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Solar/locales/cs.pak
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Solar/locales/cs.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Solar/locales/da.pak
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
Solar/locales/da.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Solar/locales/de.pak
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Solar/locales/de.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Solar/locales/el.pak
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
Solar/locales/el.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Solar/locales/en-GB.pak
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
Solar/locales/en-GB.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Solar/locales/en-US.pak
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
Solar/locales/en-US.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Solar/locales/es-419.pak
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
Solar/locales/es-419.pak
Resource
win10v2004-20240802-en
General
-
Target
Solar/autoexec/test2.lua
-
Size
11B
-
MD5
701bf4a4743e5e0361e26999881a5ce9
-
SHA1
f34d33bcb5c13eae1c15faddc6054e479f74aa28
-
SHA256
c2d0a5e0790d97a015387a995c0d0b5eb3e88138466586fc980787c9b1731eb8
-
SHA512
8c0eedc5dca108eb9682239164cba3c70ba4c12e4520a9bdfa8efce0416ce51534fcea2ef4dcd7ea2dfc684358a064233165b0bda5287892de2014a1f2b21c6f
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\lua_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\.lua rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\.lua\ = "lua_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\lua_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\lua_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\lua_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\lua_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\lua_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2660 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2660 AcroRd32.exe 2660 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2696 wrote to memory of 2584 2696 cmd.exe rundll32.exe PID 2696 wrote to memory of 2584 2696 cmd.exe rundll32.exe PID 2696 wrote to memory of 2584 2696 cmd.exe rundll32.exe PID 2584 wrote to memory of 2660 2584 rundll32.exe AcroRd32.exe PID 2584 wrote to memory of 2660 2584 rundll32.exe AcroRd32.exe PID 2584 wrote to memory of 2660 2584 rundll32.exe AcroRd32.exe PID 2584 wrote to memory of 2660 2584 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Solar\autoexec\test2.lua1⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Solar\autoexec\test2.lua2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Solar\autoexec\test2.lua"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5ef5fefcf72d7099547fb8dd4aa820011
SHA15dd4c382c043beb0f0327bb6b035b28a065c5a00
SHA256e449e95f6f317a548f1eafe1f03c5a6b55747f6e9d7bae9321260ac91688b7ae
SHA5123ae6f45c39ba3451f6b5151edf4e64670026cacdf6ed424c917beae616264264732d0aeab4fa6d8ad22c2cada4d23e68bf97bdf21ede43d7e4321cfc23cc3b0e