Resubmissions
08-12-2024 13:21
241208-qlxsqazkck 708-12-2024 13:12
241208-qfk7qsyrgl 808-12-2024 13:05
241208-qbv65syqfq 808-12-2024 13:03
241208-qaeg1atrcw 8Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-12-2024 13:21
Static task
static1
Behavioral task
behavioral1
Sample
Solaraexecutor.zip
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Solaraexecutor.zip
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
Solaraexecutor.zip
-
Size
30.1MB
-
MD5
5b96ce8081bb025c4ad8ae12dc91e102
-
SHA1
8708c3a51d990a437a4fe003c1fe2bc39e2f65cb
-
SHA256
f9e5fe3194d9734845dd782b8e41065577ed7628a112934f1a57599f8dd92209
-
SHA512
39a5e646df49f5c45f24e6aa479dfb40302f939383fdad15d6e3d9de7819aac5a2ec5525fad46ead503fe94d97b11fa587aa0448051d78d37ee8f0f6fdaa146a
-
SSDEEP
786432:3mA77b6IpMM1QvHzoB/h4pUfbRgo0lJBrPCLaBzR8mHl0:X/b6OMM1QvM/4p8R30lju26m6
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2608 Bootstraper.exe -
Loads dropped DLL 7 IoCs
pid Process 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2648 7zFM.exe 2548 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 2648 7zFM.exe Token: 35 2648 7zFM.exe Token: SeSecurityPrivilege 2648 7zFM.exe Token: SeDebugPrivilege 2548 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2648 7zFM.exe 2648 7zFM.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Solaraexecutor.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2648
-
C:\Users\Admin\Desktop\Bootstraper.exe"C:\Users\Admin\Desktop\Bootstraper.exe"1⤵
- Executes dropped EXE
PID:2608
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2548
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.7MB
MD5a7b7470c347f84365ffe1b2072b4f95c
SHA157a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA256af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
SHA51283391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d