Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/01/2025, 05:17
Static task
static1
Behavioral task
behavioral1
Sample
Solara.exe
Resource
win7-20240903-en
5 signatures
150 seconds
General
-
Target
Solara.exe
-
Size
3.7MB
-
MD5
a425e9ae201f3aea1583f56c1194d0d1
-
SHA1
e533d3fafedec17a344b1f0dca240854c9b67cbb
-
SHA256
0db9e114fb628164f24fde65b37ab19e4db07e9a60f1a94c3111dd8e85feef94
-
SHA512
d3b60dc84ae98c4589d31e54c2ac7de83527814cbf442d2211a6b77678d41ba05ae64b8fa39b8d525d0a5df46c510b9881ec944c92e1b82490fbb259e2303def
-
SSDEEP
49152:+3iYNwJmVVyVfDeCO2sST0tnx8t/dSoV1Yer1nCYr093R+pQis++ELzl/KuBIYyI:+SYzV2O2sUmnoX1+Ri3s+p3y5zMPx
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4584 2036 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Solara.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2036 Solara.exe 2036 Solara.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2036 Solara.exe Token: SeDebugPrivilege 2036 Solara.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2036 wrote to memory of 4584 2036 Solara.exe 30 PID 2036 wrote to memory of 4584 2036 Solara.exe 30 PID 2036 wrote to memory of 4584 2036 Solara.exe 30 PID 2036 wrote to memory of 4584 2036 Solara.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 6882⤵
- Program crash
PID:4584
-