Analysis
-
max time kernel
75s -
max time network
83s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
14-06-2024 19:09
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/quivings/Solara/raw/main/Files/SolaraB2.zip
Resource
win11-20240508-en
Behavioral task
behavioral2
Sample
https://github.com/quivings/Solara/raw/main/Files/SolaraB2.zip
Resource
android-33-x64-arm64-20240611.1-en
Behavioral task
behavioral3
Sample
https://github.com/quivings/Solara/raw/main/Files/SolaraB2.zip
Resource
debian12-mipsel-20240221-en
Behavioral task
behavioral4
Sample
https://github.com/quivings/Solara/raw/main/Files/SolaraB2.zip
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
https://github.com/quivings/Solara/raw/main/Files/SolaraB2.zip
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exepid process 2708 msedge.exe 2708 msedge.exe 4260 msedge.exe 4260 msedge.exe 776 msedge.exe 776 msedge.exe 3356 identity_helper.exe 3356 identity_helper.exe -
Suspicious behavior: LoadsDriver 6 IoCs
Processes:
pid 4 4 4 4 4 656 -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
Processes:
msedge.exepid process 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe -
Suspicious use of FindShellTrayWindow 58 IoCs
Processes:
msedge.exepid process 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe -
Suspicious use of SendNotifyMessage 28 IoCs
Processes:
msedge.exepid process 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4260 wrote to memory of 2504 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 2504 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 568 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 2708 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 2708 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 4456 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 4456 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 4456 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 4456 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 4456 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 4456 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 4456 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 4456 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 4456 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 4456 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 4456 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 4456 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 4456 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 4456 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 4456 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 4456 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 4456 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 4456 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 4456 4260 msedge.exe msedge.exe PID 4260 wrote to memory of 4456 4260 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/quivings/Solara/raw/main/Files/SolaraB2.zip1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ffad6a43cb8,0x7ffad6a43cc8,0x7ffad6a43cd82⤵PID:2504
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,6753444834382306221,5275584551618501872,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1876 /prefetch:22⤵PID:568
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,6753444834382306221,5275584551618501872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2708 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,6753444834382306221,5275584551618501872,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:82⤵PID:4456
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,6753444834382306221,5275584551618501872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:1892
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,6753444834382306221,5275584551618501872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:1868
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,6753444834382306221,5275584551618501872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:12⤵PID:2876
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,6753444834382306221,5275584551618501872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:12⤵PID:3400
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1856,6753444834382306221,5275584551618501872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:776 -
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1856,6753444834382306221,5275584551618501872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3356 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,6753444834382306221,5275584551618501872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:12⤵PID:5084
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,6753444834382306221,5275584551618501872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵PID:3100
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,6753444834382306221,5275584551618501872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:12⤵PID:2272
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,6753444834382306221,5275584551618501872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:12⤵PID:3104
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,6753444834382306221,5275584551618501872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:12⤵PID:3416
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2844
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1632
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:1432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD50c705388d79c00418e5c1751159353e3
SHA1aaeafebce5483626ef82813d286511c1f353f861
SHA256697bd270be634688c48210bee7c5111d7897fd71a6af0bbb2141cefd2f8e4a4d
SHA512c1614e79650ab9822c4e175ba528ea4efadc7a6313204e4e69b4a9bd06327fb92f56fba95f2595885b1604ca8d8f6b282ab542988995c674d89901da2bc4186f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5de744d7e20f6bbc6da5b857ec2007b2e
SHA1cc7da5536d6303b6ca5524ee7a643f644bfe8b14
SHA256cca489e63faa174f8d27df48964b26248dcd6f292b81396fb600858acbbe0f56
SHA5125622ab28e172c61d60c16a4ca8631ab70e3940ae3d9167d4cf8a06a3d6dccfc8b0be0336272f9d74532983813181c1cfda15a9670636623118e5769fc2798376
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5ca6e038b607790880dc6409536e9e5b3
SHA1e96de376b96298ea84803a420940b29c1425fa95
SHA2565cc21275b7c3d96712396ee9c13138d559cdc5dc480f4eccbe208305c2a622bf
SHA51276fa40934bd2804a35666a476281e3ecc49b8d12184a94d7157a8470bff710216b20b2048bd84911c345ec8a869207035685775ed38d7967f63d3615a91abed5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD5962932e25353f1ba93a92925190ef7d3
SHA18f20f99e98fc952be198b6c23cd2a58ce7c17020
SHA25628afafca3c05415c0e780a52dc8e1db7f6b37b9bc329a7011b6faa716a135792
SHA51227fb12647ab43291fc0fb42aeee2c45b6c4adcbc5b60c9c55735f0a8ae27c468a2db646c842149442cd259953114c327255a34eb2bc7a2a7f0b48e4a6744d8d2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD5d3c245eefa64c0594f404401303089a0
SHA1bc6c05d579b746a18afffce0f56c8707807e2d08
SHA256ca5039ec54db92bb4a4c86315aa80e76df5306dff3e84124b39e41c63c0cacb3
SHA512f80aedb91b60053abb5114980f06650c74a8e69d8dc60ad5474f6c9fc973f81f94af4855888b90ef9bce432dff93b63619fd3083008cc8e7b6861585f3a90f0e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD50a291018e71c01d3c5d4db5d7a4f0a31
SHA1938fdd7ae1ff8f98d75be269b0ac9823965c1a64
SHA2561dbd5d39409c6d45e57d9949246a03cce7f49fd46825988f05f5e785ccd202cb
SHA51256f9f3cf877b8e9d4be78e8bedd8840af16b819c206056515720a596b7d7f808b1037655e77918d66d8c49e17e8b02c301bb04ee7450d5f7012419a2b6c592b2
-
\??\pipe\LOCAL\crashpad_4260_CSKYKDEAYLBNMGUUMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e