Analysis
-
max time kernel
357s -
max time network
358s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 15:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SolaraBootstrapper.exe
Resource
win7-20240508-en
4 signatures
1800 seconds
General
-
Target
SolaraBootstrapper.exe
-
Size
798KB
-
MD5
baa81d6b98890ac06befe560d00be992
-
SHA1
b69769c15af3ff85ca16a4ee579ea7fd959179e9
-
SHA256
ec710ba066a78e3faf19b9d9a589ace5540a6a31551dc977b533e7d67352f87b
-
SHA512
ded06cff210a201a53670ab55078c4edfcc0c4137af04b1ad3966b69464ec717957508b341d5f5fef485679bdd841017c420a14217d9480181a03fcd9aaad7f1
-
SSDEEP
12288:PZZmz3HwnXFZ9RgoOojAojAbJaTGLLvlguxD:3mz3Hi9tOojAojAbdLL
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2664 2168 WerFault.exe SolaraBootstrapper.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SolaraBootstrapper.exepid process 2168 SolaraBootstrapper.exe 2168 SolaraBootstrapper.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SolaraBootstrapper.exedescription pid process Token: SeDebugPrivilege 2168 SolaraBootstrapper.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
SolaraBootstrapper.exedescription pid process target process PID 2168 wrote to memory of 2664 2168 SolaraBootstrapper.exe WerFault.exe PID 2168 wrote to memory of 2664 2168 SolaraBootstrapper.exe WerFault.exe PID 2168 wrote to memory of 2664 2168 SolaraBootstrapper.exe WerFault.exe PID 2168 wrote to memory of 2664 2168 SolaraBootstrapper.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 10002⤵
- Program crash
PID:2664
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2168-0-0x00000000742EE000-0x00000000742EF000-memory.dmpFilesize
4KB
-
memory/2168-1-0x0000000000E20000-0x0000000000EEE000-memory.dmpFilesize
824KB
-
memory/2168-2-0x00000000742E0000-0x00000000749CE000-memory.dmpFilesize
6.9MB
-
memory/2168-3-0x00000000742E0000-0x00000000749CE000-memory.dmpFilesize
6.9MB