Overview

overview

10

Static

static

10

SolaraFixerV2.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SolaraFixerV2.exe

  • Size

    102.4MB

  • Sample

    240630-1cjjvazapm

  • MD5

    793e221923cece30f95f4e3515444124

  • SHA1

    3766bfc1fc52d4833c97835258fe31015c41756d

  • SHA256

    a4265614e04677542885cffd035fef96599ca7656a6caf53287bd67f2db8d6f9

  • SHA512

    0d2e54e22c6036efc65c2da05646cb20ee9969279508bbd1f82a3eff8404297dc17c91d89202ef01cba3abfd391dabdb1f1c2e904562890b0e0d6e16f20d7f46

  • SSDEEP

    3145728:EUCn7pa8S6xjKcBa6c2qHO5iVY2nGQbRe0zJcBWnAX9U:xKVBSWNa6sHCiH1XcBWS

Score
10/10
pysilonevasionexecutionpersistencepyinstaller

Malware Config

Targets

    • Target

      SolaraFixerV2.exe

    • Size

      102.4MB

    • MD5

      793e221923cece30f95f4e3515444124

    • SHA1

      3766bfc1fc52d4833c97835258fe31015c41756d

    • SHA256

      a4265614e04677542885cffd035fef96599ca7656a6caf53287bd67f2db8d6f9

    • SHA512

      0d2e54e22c6036efc65c2da05646cb20ee9969279508bbd1f82a3eff8404297dc17c91d89202ef01cba3abfd391dabdb1f1c2e904562890b0e0d6e16f20d7f46

    • SSDEEP

      3145728:EUCn7pa8S6xjKcBa6c2qHO5iVY2nGQbRe0zJcBWnAX9U:xKVBSWNa6sHCiH1XcBWS

    Score
    9/10
    evasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

1
T1112

Credential Access

Discovery

File and Directory Discovery

1
T1083

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks