Analysis
-
max time kernel
1199s -
max time network
1175s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
15-06-2024 18:21
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/quivings/Solara/blob/main/Files/SolaraB.zip
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
https://github.com/quivings/Solara/blob/main/Files/SolaraB.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
https://github.com/quivings/Solara/blob/main/Files/SolaraB.zip
Resource
win11-20240508-en
General
-
Target
https://github.com/quivings/Solara/blob/main/Files/SolaraB.zip
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133629506281626281" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 4800 chrome.exe 4800 chrome.exe 3424 chrome.exe 3424 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
Processes:
chrome.exepid process 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
chrome.exepid process 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4800 wrote to memory of 4092 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 4092 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2924 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2552 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2552 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe PID 4800 wrote to memory of 2980 4800 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/quivings/Solara/blob/main/Files/SolaraB.zip1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffa87cab58,0x7fffa87cab68,0x7fffa87cab782⤵PID:4092
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1512 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:22⤵PID:2924
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:82⤵PID:2552
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2128 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:82⤵PID:2980
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2988 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:12⤵PID:4164
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2996 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:12⤵PID:244
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4484 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:82⤵PID:1868
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:82⤵PID:1828
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5068 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:12⤵PID:2332
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4780 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:12⤵PID:3912
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3792 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:12⤵PID:780
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=1440 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:12⤵PID:2692
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4444 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3424 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3048 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:12⤵PID:4700
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1416 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:12⤵PID:2380
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3372 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:12⤵PID:1412
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD50ebfbf95ba4c4878caaef787f2ccb6a0
SHA1b4e6d2d67c092b0dff30a210bcc4add0790bdce7
SHA2561926fd062c0f730107babe4198d13868446752a0a3ebeeba2e7a6a172898213e
SHA512862579c9dc5453e9283d0c2d46c149afdd72534b48c2cbdfa21f7b90afaf57045b5c87190485133cdb6f1d9822dc54801c1f5f625e1c9560c34c1990c5f9d1b6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
129KB
MD51dbb076c0e175c5de076e9f1ebc904bd
SHA17f6ace6a3e8a2cafe993625c9c8306611f6d2152
SHA256f34672044895b0b10f522650b1dfa53866eea341783dad973eaaf59a70d3166e
SHA512e9744e244ad35d090f4cf4fc2314308e730192845263cebf40d47a80fcac0fb297820630c8bd1b0abcd2f1631bd0ca0f0e979f85d0033c0684087ac789ad8b55
-
\??\pipe\crashpad_4800_QQQBSNSASHBBXEHDMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e