0c71f48d44a74efb798881c84e4ede7906f1342567500558ba7155c12abf090a

General

Target
Solara_FIX.exe
Size 560KB
Sample260517-k187eah16k
SHA256 0c71f48d44a74efb798881c84e4ede7906f1342567500558ba7155c12abf090a
MD5 528692ce69d9415545e49f75808a592e
SHA1 40f5de29db778a59ac0d7dd9891fa875dbb72f3b
SHA512 f88d3f2e1713aef4cbd40c8413eaff04d18447a7031bd1373e2cf4b3596ef6a55df5389af65a2b02db54d29e1d60f36dbbe9bdff529897a838d5e073f3bd02ac
SSDEEP 6144:nsWFHmARaVBdnns33mOhU5ucuacqUgtGc6lZr3Rs2+1ycc0mtYh4QecqdeECnyMf:iAMVBFsmQcYxZC6e6AtVLHL
TLSH
T1BCC43A147F998A09E4802A3E455E1604DBAED5F126327303370AFF624D059DEEE6D3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Solara_FIX.exe
- Size 560KB
- SHA256 0c71f48d44a74efb798881c84e4ede7906f1342567500558ba7155c12abf090a
- MD5 528692ce69d9415545e49f75808a592e
- SHA1 40f5de29db778a59ac0d7dd9891fa875dbb72f3b
- SHA512 f88d3f2e1713aef4cbd40c8413eaff04d18447a7031bd1373e2cf4b3596ef6a55df5389af65a2b02db54d29e1d60f36dbbe9bdff529897a838d5e073f3bd02ac
- SSDEEP 6144:nsWFHmARaVBdnns33mOhU5ucuacqUgtGc6lZr3Rs2+1ycc0mtYh4QecqdeECnyMf:iAMVBFsmQcYxZC6e6AtVLHL
- TLSH
  T1BCC43A147F998A09E4802A3E455E1604DBAED5F126327303370AFF624D059DEEE6D3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution persistence ransomware
- Modifies WinLogon for persistence
  persistence
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (7606) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Drops file in System32 directory
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- Suspicious use of SetThreadContext
behavioral1