Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
01/03/2025, 01:23
Behavioral task
behavioral1
Sample
Solara(DEVSONLY).exe
Resource
win7-20241023-en
windows7-x64
5 signatures
150 seconds
General
-
Target
Solara(DEVSONLY).exe
-
Size
82KB
-
MD5
c406b02bf6392bf4a6e958032e50cc6f
-
SHA1
8560844a9b1e138acad242f00c61e6dea237c89d
-
SHA256
57db7c05233e6542b02fd939bc29235762127a30f4d24bc0007a86db55be6fea
-
SHA512
5ba085fb37e7795e3ba7291952efd38a440d6c8fe1728ee25d72616ac34fe8003b6f191367b05d5e83d1c6270384689a3ad83090df9a6c30f8bd4d27b67ba2f8
-
SSDEEP
1536:mTVvPHi0bJ1erBLJdNcI7NA4bE+hp2uK62IhOxif6AnDRcodep:mRXsxJ7NlbEihOxq5nlKp
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:60413
thanks-viewers.gl.at.ply.gg:60413
Attributes
-
Install_directory
%AppData%
-
install_file
AggregatorHost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral2/memory/5036-1-0x0000000000200000-0x000000000021A000-memory.dmp family_xworm -
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 28 ip-api.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 59 IoCs
pid Process 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1220 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 5036 Solara(DEVSONLY).exe Token: SeDebugPrivilege 1220 taskmgr.exe Token: SeSystemProfilePrivilege 1220 taskmgr.exe Token: SeCreateGlobalPrivilege 1220 taskmgr.exe Token: 33 1220 taskmgr.exe Token: SeIncBasePriorityPrivilege 1220 taskmgr.exe -
Suspicious use of FindShellTrayWindow 61 IoCs
pid Process 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe -
Suspicious use of SendNotifyMessage 60 IoCs
pid Process 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe 1220 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Solara(DEVSONLY).exe"C:\Users\Admin\AppData\Local\Temp\Solara(DEVSONLY).exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5036
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1220
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2068