Analysis

  • max time kernel
    1561s
  • max time network
    1562s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    15-06-2024 15:13

General

  • Target

    SolaraBootstrapper.exe

  • Size

    798KB

  • MD5

    baa81d6b98890ac06befe560d00be992

  • SHA1

    b69769c15af3ff85ca16a4ee579ea7fd959179e9

  • SHA256

    ec710ba066a78e3faf19b9d9a589ace5540a6a31551dc977b533e7d67352f87b

  • SHA512

    ded06cff210a201a53670ab55078c4edfcc0c4137af04b1ad3966b69464ec717957508b341d5f5fef485679bdd841017c420a14217d9480181a03fcd9aaad7f1

  • SSDEEP

    12288:PZZmz3HwnXFZ9RgoOojAojAbJaTGLLvlguxD:3mz3Hi9tOojAojAbdLL

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 5 IoCs
  • Program crash 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2968
    • C:\Windows\SysWOW64\msiexec.exe
      "msiexec" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      PID:2868
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 1568
      2⤵
      • Program crash
      PID:956
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1940
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding 99D04D1B5251CFA1DCF5C13427D422F8
      2⤵
      • Loads dropped DLL
      PID:2720
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 31D0DEA8E9177D74B2AD17475E1C5FA4
      2⤵
      • Loads dropped DLL
      PID:3036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    139aae87cc6cb4553390cdae4b0e95aa

    SHA1

    87b973da526a0605447a598d832f9669585899d9

    SHA256

    d0c7868edc38a55cbf30076a0b340013f44a47031c7c1929b8bc779f1464a7f0

    SHA512

    8093c0ddc2ae4fa04649c52bd63e61701754fb601afbaa87db871563fe3bd4152f8106f32d01be885daf359eebebd9a939a720329caecf3deec2fda5cebc11aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    242B

    MD5

    16e51b26ef49cddbfb969e17c1ac2caa

    SHA1

    69c8811df799ba8d75ea46b85c92906b8fcec725

    SHA256

    2d94fdc5575b06c5d185236a445bf45a4349fd6c5fc28c858e3fc3e8b2ee39e9

    SHA512

    f5973f45c72757609d2191a0899f991eeea2c78eebf1371ff0599a37d3b9b689cc0241f081aa1cc6225454565448ecdff79ff4805aacfd29324e52abe42ac40f

  • C:\Users\Admin\AppData\Local\Temp\Tar28E9.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi
    Filesize

    30.1MB

    MD5

    0e4e9aa41d24221b29b19ba96c1a64d0

    SHA1

    231ade3d5a586c0eb4441c8dbfe9007dc26b2872

    SHA256

    5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

    SHA512

    e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

  • C:\Windows\Installer\MSI3C8A.tmp
    Filesize

    122KB

    MD5

    9fe9b0ecaea0324ad99036a91db03ebb

    SHA1

    144068c64ec06fc08eadfcca0a014a44b95bb908

    SHA256

    e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

    SHA512

    906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

  • C:\Windows\Installer\MSI3CDA.tmp
    Filesize

    211KB

    MD5

    a3ae5d86ecf38db9427359ea37a5f646

    SHA1

    eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

    SHA256

    c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

    SHA512

    96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

  • memory/2968-2-0x0000000074B40000-0x000000007522E000-memory.dmp
    Filesize

    6.9MB

  • memory/2968-0-0x0000000074B4E000-0x0000000074B4F000-memory.dmp
    Filesize

    4KB

  • memory/2968-1-0x0000000000E40000-0x0000000000F0E000-memory.dmp
    Filesize

    824KB

  • memory/2968-97-0x0000000074B4E000-0x0000000074B4F000-memory.dmp
    Filesize

    4KB

  • memory/2968-98-0x0000000074B40000-0x000000007522E000-memory.dmp
    Filesize

    6.9MB