8e2f032d0ff15f2c9bab0f9f894936066c42f388a5e891ed76e4e7cb9ff2e365

General

Target

Solara-Executor
Size

304KB
MD5

517f63f72eade402b33b49d155c78bfa
SHA1

61ab7528b8b247714d6a70312f09b28682e7c500
SHA256

8e2f032d0ff15f2c9bab0f9f894936066c42f388a5e891ed76e4e7cb9ff2e365
SHA512

8c62582aa300bbec3ab45485843875ec52af0a6c34dd04e91fd981008ffb57a8112c0bd5449c7e281f3b83a6d5cdda7f9c94c1909590c98a17c62743d7e213ac
SSDEEP

6144:D6ozv2n9dH5M2vkm0aFRv3pId9RY9AvZJT3CqbMrhryfQNRPaCieMjAkvCJv1ViT:mozv2n9dH5M2vkm0aFRv3pId9RY9AvZn

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

2580 chrome.exe
2580 chrome.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe

Suspicious use of FindShellTrayWindow 50 IoCs

Processes:

chrome.exe

pid	process
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

chrome.exe

pid	process
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2580 wrote to memory of 2612	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2612	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2612	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2520	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2488	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2488	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2488	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2548	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2548	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2548	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2548	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2548	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2548	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2548	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2548	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2548	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2548	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2548	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2548	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2548	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2548	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2548	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2548	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2548	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2548	2580	chrome.exe	chrome.exe
PID 2580 wrote to memory of 2548	2580	chrome.exe	chrome.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Solara-Executor
1⤵
PID:2956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6e19758,0x7fef6e19768,0x7fef6e19778
2⤵
PID:2612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1416,i,4097361303645506153,17802688247010581450,131072 /prefetch:2
2⤵
PID:2520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=1416,i,4097361303645506153,17802688247010581450,131072 /prefetch:8
2⤵
PID:2488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1648 --field-trial-handle=1416,i,4097361303645506153,17802688247010581450,131072 /prefetch:8
2⤵
PID:2548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2304 --field-trial-handle=1416,i,4097361303645506153,17802688247010581450,131072 /prefetch:1
2⤵
PID:2824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2312 --field-trial-handle=1416,i,4097361303645506153,17802688247010581450,131072 /prefetch:1
2⤵
PID:2828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1152 --field-trial-handle=1416,i,4097361303645506153,17802688247010581450,131072 /prefetch:2
2⤵
PID:2452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1360 --field-trial-handle=1416,i,4097361303645506153,17802688247010581450,131072 /prefetch:1
2⤵
PID:1060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3440 --field-trial-handle=1416,i,4097361303645506153,17802688247010581450,131072 /prefetch:8
2⤵
PID:1408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3564 --field-trial-handle=1416,i,4097361303645506153,17802688247010581450,131072 /prefetch:8
2⤵
PID:2324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3692 --field-trial-handle=1416,i,4097361303645506153,17802688247010581450,131072 /prefetch:8
2⤵
PID:1628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3712 --field-trial-handle=1416,i,4097361303645506153,17802688247010581450,131072 /prefetch:1
2⤵
PID:2032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2640 --field-trial-handle=1416,i,4097361303645506153,17802688247010581450,131072 /prefetch:8
2⤵
PID:2760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=1416,i,4097361303645506153,17802688247010581450,131072 /prefetch:8
2⤵
PID:2776

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:612

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp
Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
361B

MD5
ad7e8fb213e3c9a607ba31e103e6b56d

SHA1
10b79f32940d6e7a63408e9132d364a7520baf8d

SHA256
4f5d536d29a97d4c554ccff4e3b49028c5dce30f6026db9e061792768e930e76

SHA512
a53b5726676190fc52ef326315001677a830cd4884658df23e6edc6443885270e1c6498397a4f9c8f99de1d9a7d5532a705418711320a1ad32f00ce5786eb5ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
67fca8a59c5d2a879679f449dfe8fb0a

SHA1
ea98ca9df2832dde5769cecad12e1a1439f19c3d

SHA256
cc6f5af09bd8c7d9ddd0bdea7442f4727901ab0f0d01c36957605d1775b2c4b5

SHA512
e7bfc9d7ebee8d83cfbd515ad0131b4591179e5855a7e0277f627be37770c395a290231dff4f01064d195f4fdab84aabc4f19cd3e71e39c1e63e38b1b92bd092

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
2eadfc0ee449325cf1414557aa3f17b5

SHA1
3428e10e3da93857bd8d57677fa6e65b262da650

SHA256
d32fdbebc9d6dee7440ab5f6bca12beba173ce7187f3364f7b13aa197b251fa3

SHA512
0f6427203e52a964f7adc4e46038f3c9654888007b41daac9fa0e3658fe009f6088c963c86c2cbe739d16f504c2407d9c52d947f73ba7580bab20aebac5eaeb2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
140KB

MD5
990906522c16e736cb0400c9aa4f2938

SHA1
d2faa2ceba78470229e24d7da4d7f6055ce0e0c2

SHA256
68517cd76e4c0172865cd5cf953d2714ecbb486554e86f607e7ca1cab6d2fc52

SHA512
29d79f9bd0f83dd02fb394f42792d26ebc03a9107abfec43041bd7b9ce2fb85d8fbf8472e439036036d79f96af3a9b651183f2fa99e84f4d060c4cd0af94ad6e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
\??\pipe\crashpad_2580_DVMNJLXODAEQFVEM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads