Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    15-06-2024 11:00

General

  • Target

    SolaraBootstrapper.exe

  • Size

    798KB

  • MD5

    7416a188b82e9dc4b020a59d3c9267d5

  • SHA1

    15b67c0e13667dd00f2f1d1d2d3132e629e746f3

  • SHA256

    6a6990c2da4da8f8870da3e33865a1dff8f16874793b232971194c074f3b7838

  • SHA512

    3f2616216e8dc70362cc6d3f8e76a009108fe04d98697a744c131b76f3c693364ef2a80716ccd9a8f9987d2ac10b0316b0328a0066260055fcbadcd449aaf704

  • SSDEEP

    12288:pfSmzhHoAX5TyQvgwRojAojGdJaTGLLvlguxD:smzhHWQDRojAojGddLL

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 5 IoCs
  • Program crash 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:772
    • C:\Windows\SysWOW64\msiexec.exe
      "msiexec" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      PID:2676
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 1460
      2⤵
      • Program crash
      PID:2896
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding 2E0E514ECEDC8D96E1B67181A4DC8104
      2⤵
      • Loads dropped DLL
      PID:2316
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 5C9F851531D051B1D163EDFCE9A3C1A7
      2⤵
      • Loads dropped DLL
      PID:2956

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    b266f87836d491ecd01d14854b84aeed

    SHA1

    bf077deb57696b4124ce6550a9c8075d7ba2055c

    SHA256

    9984dc68c0cc11961f293d2e77da7044343cd8f9ecf4c607789f4b4830d448d0

    SHA512

    7bbccc984b42259c0ae513214f44a36ab83f544827ca526424e0260400fbfc3653b4eb10b090ace8ca459023a2698ea714dc583a43e6a515d7823a015042257f

  • C:\Users\Admin\AppData\Local\Temp\CabDC8.tmp
    Filesize

    67KB

    MD5

    2d3dcf90f6c99f47e7593ea250c9e749

    SHA1

    51be82be4a272669983313565b4940d4b1385237

    SHA256

    8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

    SHA512

    9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

  • C:\Users\Admin\AppData\Local\Temp\Tar23E6.tmp
    Filesize

    160KB

    MD5

    7186ad693b8ad9444401bd9bcd2217c2

    SHA1

    5c28ca10a650f6026b0df4737078fa4197f3bac1

    SHA256

    9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

    SHA512

    135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

  • C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi
    Filesize

    30.1MB

    MD5

    0e4e9aa41d24221b29b19ba96c1a64d0

    SHA1

    231ade3d5a586c0eb4441c8dbfe9007dc26b2872

    SHA256

    5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

    SHA512

    e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

  • C:\Windows\Installer\MSI26B9.tmp
    Filesize

    122KB

    MD5

    9fe9b0ecaea0324ad99036a91db03ebb

    SHA1

    144068c64ec06fc08eadfcca0a014a44b95bb908

    SHA256

    e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

    SHA512

    906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

  • C:\Windows\Installer\MSI2728.tmp
    Filesize

    211KB

    MD5

    a3ae5d86ecf38db9427359ea37a5f646

    SHA1

    eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

    SHA256

    c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

    SHA512

    96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

  • memory/772-0-0x00000000748EE000-0x00000000748EF000-memory.dmp
    Filesize

    4KB

  • memory/772-1-0x0000000000870000-0x000000000093E000-memory.dmp
    Filesize

    824KB

  • memory/772-2-0x00000000748E0000-0x0000000074FCE000-memory.dmp
    Filesize

    6.9MB

  • memory/772-85-0x00000000748EE000-0x00000000748EF000-memory.dmp
    Filesize

    4KB

  • memory/772-86-0x00000000748E0000-0x0000000074FCE000-memory.dmp
    Filesize

    6.9MB