Analysis
-
max time kernel
1199s -
max time network
1175s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
15/06/2024, 18:21
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/quivings/Solara/blob/main/Files/SolaraB.zip
Resource
win10-20240404-en
windows10-1703-x64
25 signatures
1200 seconds
Behavioral task
behavioral2
Sample
https://github.com/quivings/Solara/blob/main/Files/SolaraB.zip
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
1200 seconds
Behavioral task
behavioral3
Sample
https://github.com/quivings/Solara/blob/main/Files/SolaraB.zip
Resource
win11-20240508-en
windows11-21h2-x64
8 signatures
1200 seconds
General
-
Target
https://github.com/quivings/Solara/blob/main/Files/SolaraB.zip
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133629506281626281" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4800 chrome.exe 4800 chrome.exe 3424 chrome.exe 3424 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4800 wrote to memory of 4092 4800 chrome.exe 80 PID 4800 wrote to memory of 4092 4800 chrome.exe 80 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2924 4800 chrome.exe 81 PID 4800 wrote to memory of 2552 4800 chrome.exe 82 PID 4800 wrote to memory of 2552 4800 chrome.exe 82 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83 PID 4800 wrote to memory of 2980 4800 chrome.exe 83
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/quivings/Solara/blob/main/Files/SolaraB.zip1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffa87cab58,0x7fffa87cab68,0x7fffa87cab782⤵PID:4092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1512 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:22⤵PID:2924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:82⤵PID:2552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2128 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:82⤵PID:2980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2988 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:12⤵PID:4164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2996 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:12⤵PID:244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4484 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:82⤵PID:1868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:82⤵PID:1828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5068 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:12⤵PID:2332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4780 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:12⤵PID:3912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3792 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:12⤵PID:780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=1440 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:12⤵PID:2692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4444 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3048 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:12⤵PID:4700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1416 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:12⤵PID:2380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3372 --field-trial-handle=1808,i,6578097715270719594,2317175248524600840,131072 /prefetch:12⤵PID:1412
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD50ebfbf95ba4c4878caaef787f2ccb6a0
SHA1b4e6d2d67c092b0dff30a210bcc4add0790bdce7
SHA2561926fd062c0f730107babe4198d13868446752a0a3ebeeba2e7a6a172898213e
SHA512862579c9dc5453e9283d0c2d46c149afdd72534b48c2cbdfa21f7b90afaf57045b5c87190485133cdb6f1d9822dc54801c1f5f625e1c9560c34c1990c5f9d1b6
-
Filesize
129KB
MD51dbb076c0e175c5de076e9f1ebc904bd
SHA17f6ace6a3e8a2cafe993625c9c8306611f6d2152
SHA256f34672044895b0b10f522650b1dfa53866eea341783dad973eaaf59a70d3166e
SHA512e9744e244ad35d090f4cf4fc2314308e730192845263cebf40d47a80fcac0fb297820630c8bd1b0abcd2f1631bd0ca0f0e979f85d0033c0684087ac789ad8b55