Analysis
-
max time kernel
131s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/08/2024, 03:48
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Solara.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Solara.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Solara.exe -
resource yara_rule behavioral1/memory/4556-519-0x0000000180000000-0x0000000180A7C000-memory.dmp themida behavioral1/memory/4556-522-0x0000000180000000-0x0000000180A7C000-memory.dmp themida behavioral1/memory/4556-520-0x0000000180000000-0x0000000180A7C000-memory.dmp themida behavioral1/memory/4556-521-0x0000000180000000-0x0000000180A7C000-memory.dmp themida behavioral1/memory/4556-529-0x0000000180000000-0x0000000180A7C000-memory.dmp themida behavioral1/memory/4556-532-0x0000000180000000-0x0000000180A7C000-memory.dmp themida -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 130 pastebin.com 131 pastebin.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4556 Solara.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2718105630-359604950-2820636825-1000\{242ACCF2-611A-4D2D-911E-98B072DEDCBE} msedge.exe Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings msedge.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 760 msedge.exe 760 msedge.exe 1380 msedge.exe 1380 msedge.exe 4468 identity_helper.exe 4468 identity_helper.exe 3112 msedge.exe 3112 msedge.exe 2220 msedge.exe 2220 msedge.exe 4556 Solara.exe 4556 Solara.exe 4556 Solara.exe 4556 Solara.exe 4556 Solara.exe 4556 Solara.exe 4556 Solara.exe 4556 Solara.exe 4556 Solara.exe 4556 Solara.exe 4556 Solara.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 4556 Solara.exe 4556 Solara.exe 4556 Solara.exe 4556 Solara.exe 4556 Solara.exe 4556 Solara.exe 4556 Solara.exe 4556 Solara.exe 4556 Solara.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
pid Process 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4556 Solara.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 4556 Solara.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1380 wrote to memory of 1000 1380 msedge.exe 81 PID 1380 wrote to memory of 1000 1380 msedge.exe 81 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 1448 1380 msedge.exe 84 PID 1380 wrote to memory of 760 1380 msedge.exe 85 PID 1380 wrote to memory of 760 1380 msedge.exe 85 PID 1380 wrote to memory of 4024 1380 msedge.exe 86 PID 1380 wrote to memory of 4024 1380 msedge.exe 86 PID 1380 wrote to memory of 4024 1380 msedge.exe 86 PID 1380 wrote to memory of 4024 1380 msedge.exe 86 PID 1380 wrote to memory of 4024 1380 msedge.exe 86 PID 1380 wrote to memory of 4024 1380 msedge.exe 86 PID 1380 wrote to memory of 4024 1380 msedge.exe 86 PID 1380 wrote to memory of 4024 1380 msedge.exe 86 PID 1380 wrote to memory of 4024 1380 msedge.exe 86 PID 1380 wrote to memory of 4024 1380 msedge.exe 86 PID 1380 wrote to memory of 4024 1380 msedge.exe 86 PID 1380 wrote to memory of 4024 1380 msedge.exe 86 PID 1380 wrote to memory of 4024 1380 msedge.exe 86 PID 1380 wrote to memory of 4024 1380 msedge.exe 86 PID 1380 wrote to memory of 4024 1380 msedge.exe 86 PID 1380 wrote to memory of 4024 1380 msedge.exe 86 PID 1380 wrote to memory of 4024 1380 msedge.exe 86 PID 1380 wrote to memory of 4024 1380 msedge.exe 86 PID 1380 wrote to memory of 4024 1380 msedge.exe 86 PID 1380 wrote to memory of 4024 1380 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff8b4a246f8,0x7ff8b4a24708,0x7ff8b4a247182⤵PID:1000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:22⤵PID:1448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:82⤵PID:4024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:1748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:12⤵PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:82⤵PID:1940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:12⤵PID:5072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:12⤵PID:4924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:12⤵PID:1872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:12⤵PID:2796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:12⤵PID:5036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:12⤵PID:388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:3716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:12⤵PID:5084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:12⤵PID:3284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3692 /prefetch:82⤵PID:1892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5512 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:12⤵PID:1828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:12⤵PID:4296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:12⤵PID:4168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:12⤵PID:4828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:12⤵PID:4248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:12⤵PID:2280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6808 /prefetch:82⤵PID:3832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:12⤵PID:2988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6788 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,17135888383834577068,8212841696866074012,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5604 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3532
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5048
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1916
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2604
-
C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe"C:\Users\Admin\Downloads\Solara.Dir\Solara\Solara.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ab8ce148cb7d44f709fb1c460d03e1b0
SHA144d15744015155f3e74580c93317e12d2cc0f859
SHA256014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
SHA512f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
-
Filesize
152B
MD538f59a47b777f2fc52088e96ffb2baaf
SHA1267224482588b41a96d813f6d9e9d924867062db
SHA25613569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
SHA5124657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4943571f-4809-4c1f-9059-ec27dc8636c0.tmp
Filesize8KB
MD555d043324782c0b336cb0ec7c7594823
SHA17f253cc322618e213e55202420d22c159715ed1c
SHA25691ffb1a845c375bb44eb0550ad22950f685165b581ecab5da26b4932aa9f1419
SHA5128db4498c7cc5c8dbedd61d1471ab4a27c7496ea9df14ee4eb96fef3e6b415bb6c47d48a18f0cd4f680113c4df41e15a1e703032490c9539aa6d01369f4dfb90f
-
Filesize
209KB
MD53e552d017d45f8fd93b94cfc86f842f2
SHA1dbeebe83854328e2575ff67259e3fb6704b17a47
SHA25627d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
SHA512e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
-
Filesize
20KB
MD56931123c52bee278b00ee54ae99f0ead
SHA16907e9544cd8b24f602d0a623cfe32fe9426f81f
SHA256c54a6c3031bf3472077c716fa942bd683119dc483b7e0181e8a608fa0b309935
SHA51240221fe98816aa369c45f87dc62e6d91fcdb559d9756cb6a05819f1cde629e23a51803e71371f4e4f27112a09489d58ed45b2b901a5f2f00c69c082b3576057f
-
Filesize
20KB
MD593eeea702a80c096950e60b99b74b8a4
SHA1cc5facf47047c7aac51bdfa9db1339891957e8c7
SHA25698fa60f3d0aa0668eb3bd9f56657d4d016913f2194b0e2077810f4c906a77854
SHA512c4ceb5227cada0067261eb6adcda1a0cebe46e1184884a03bc8061f0d947fa8f3751ac3709080934e79ef2b0b76aa417f5e0df40ce8cbaa9c1b4153c3b83734f
-
Filesize
24KB
MD5c594a826934b9505d591d0f7a7df80b7
SHA1c04b8637e686f71f3fc46a29a86346ba9b04ae18
SHA256e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610
SHA51204a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD5770679d58ac6778ab2160ca0d3d335fe
SHA197c20f2ac7a30ac174875afad50b74a6635e04cc
SHA256c054fe1ef1153b875302999e986835342f8f5ec268ec6761658803ac0cac3953
SHA512569117d150f6b91f209dfea57b6cdb1b1c5a769bcc063594034b4c216a5ff90cedf847751e8ebe9e78ab4ce835d793d06ef4cfec0140311d8b4a459158184a37
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD54a53cc1b97baf90812a82373287d9d18
SHA1a60d233b7fc8b1227d6a4355fce687e2d09e4be2
SHA256e82cac16282e610ff5693040742e52f86b4692e2ddec34201756537f073e4156
SHA5128a7aa0495da75516099176d90300b49fbdad968df47b0800db9fd6cfe8fb4f98b93408ce065e7bfc62c768ab11bc7d2d21b826774cf95656266997822c3ab0bc
-
Filesize
2KB
MD54aa752682270c2516df8c19fb074cf12
SHA1b30d1a3a3a8a58927c310c9204419311122a8b2a
SHA25689a0abe946afe03ab6cd360b1169c1ad27762a4cdc1b3a96f6bc1b56abd0d7e7
SHA512e7fa3d426b6a729a903dd9e25a65f22280dca5bc91ddb4d37300933cbc54c4be434650ebadf1f2c5636cbd549a9a6d70c8e68d82eba1194774227b78bbd36613
-
Filesize
6KB
MD54b1538166619ebbb5b2823dcfc1ec3bf
SHA1c1bd793de42e0cc14cd05be3fdf5c8444829d78f
SHA2560233a34beb317f1c8c26472a1822cf818ca50c8551ace2adb369e8b6f2326f2c
SHA512a8639da2f8476a7b4d9c158b5057d0671a10c4dad637746826f9be36f3b5a28f13273d898d7892f382147f0db2cb9281e8b6260a9c17f9e8b385d3f0ef7dfdbe
-
Filesize
6KB
MD5fe50d112d0019fdf94dbd815cef7d03f
SHA1a515f0a3a1d0e02b10b9cc097b2a938e8930aa6a
SHA2569952565bdb9921c3a8207cbc5892ff0a69cc2ef565da7116b1390d64a01e4605
SHA51277bf44c78ba856ee15d1a344fb099a6d7516fb96c2800f1caf8db6a71d7352dec50ec374a067518788c7beb2a02b34919e2da9c78fa02c54a1c9e5925ce505b5
-
Filesize
7KB
MD5cdc1a380a53ecae3d347b492f3642119
SHA1742404f1cc0dd1f5ab71d685c7eb5aaac3c7d987
SHA2567794d1ca0e5c4c28d9c22127827e45af663e095abf5d616b92850eb44db85184
SHA512ce4885f662ce1efdbbbcd47eec7fe9e20c4a4413b8a8ab68bb5cfe7465815e5bc9211e6006ecdcf993b0cc3f62deccd88f3fe01c64763dfd90ad9976f895fcfe
-
Filesize
6KB
MD53857e74a46e3dbe77025ae190483a5e2
SHA10f3bfaef3ac7c00ed6d26c84793c5e52ecbed124
SHA256f766252c26ed352bc1873593384b0c2ab95d82888b77bf11c2db2c699825dea4
SHA512b1392c2c77fbdfe1b745794852401bd89df6160e5790268cb8bb34d05f15474be6eebbf976f8b59e5b3c84de581661e4ffb2e554f46d119e3b06e43fa80b8b79
-
Filesize
8KB
MD5644fd96f5f5ec08c3eb9488800c4a7d2
SHA1fe6f5a9ee6c64bf3573d279a4d79984d6af6b5d8
SHA256015ab459bfacfb080f731d19ab10ca23c5af4f0f64203fcc31e6cf43fb9df0a8
SHA5128c10b2eba184632c8a30c102280a9d2fef01a8e1ba03f8720f8005ff02ad38067b5260c648df927c3d134ec845ff6b8f817dc072f8782a62026c285b5d4ac436
-
Filesize
706B
MD513bfe922cf92e2a6073105f2b34c4f3d
SHA155dc8f03170c4df088dba37ef12c35dbdce143e3
SHA25631600a791f7369670e56a1ff7cff9ce73651ce89a1a2ef732984883039b8d7ac
SHA512ad087e110f877a717b1133c9e398bb8b949737727f6151b42ec9440e2bdaaf82d9d8bc6f489f84bfe766eb12b04edfe43947a5cf9cb887bb2f9c7f0c3c0620e9
-
Filesize
873B
MD560efde703cbaace1a8c14e4f096ee90b
SHA1225fc4688ee6984add258c4eaf189e9bf0293feb
SHA256aa6940c1deeab726cb0909e9f9492d2bb0ce3d5098d14a97392541078145b5a6
SHA512b30f2e99ab8a5ae74416a7a86f58ac9b92217c1f0d2c9414ef7ad7d743412872290b7cf1b7f2005e40851331bde5a6103f94ea6e03393f485ebf1cc4e6c43412
-
Filesize
538B
MD5f390c5bae3c2219046efc4ad07f95c92
SHA15f0c94bd0030b29d4c85a2980f3c0af237977d93
SHA2564b2c8eeb34a63b8a6dff5079866f9c6be27e7fbadeb3ff58b160be2b18f921b0
SHA51276f1da0836914a34ae11af2112e1d49af52fb8600c772b0f8445d9530725f9c44cb44aefd6cef0e317819e3a7979b84b110cba2e54e024ca1e66c585665df87a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD546643a66e48834032e44a155bf62a656
SHA19c98d807644d5607aa7053d8ed6bc2201e2ed459
SHA256959c20cc79a57ab95fee4c110c8595c88e96efbfb21d134b290b0958c129e02a
SHA5123a8e89e691991879429b1c6567febf338f793753627978f38626c32d45b12fa787aed4e491a2443d8e9ba2d86436437051490db69f0723b1e0d9fc01ffa8424a
-
Filesize
10KB
MD533f48f77a3f5e9af80d3e39d0448e0a8
SHA1dc2d9c0b8a3a472d7e597a3aa58c7e784e848c86
SHA256d4ef9a06bbd00577c54d9372508f91a44211078214614734c134745b321faffc
SHA5122baf6b1fa51d77335c95f656d00255c79366159719d99e1de1b8ebe299165b34caa3b3df39a259e738389f4592171274749ff575d751d5b80b12af237e2c841d
-
Filesize
7.6MB
MD543681f04dc1e31ccdcb90a7e69949a52
SHA15a311ce3609ff81426fae34bc4a5731700830b06
SHA25679907648beb01a39a141640961cf63f203e57b4c8207a242c4179a72d02354b1
SHA512f24ce5811073514564569cec4f90500cb302606f86e1a062066c4e29e3381e494c5cc5ce3928dc7370083b99d75f1df8bfb850e657e1b6b96d08fe56d9be6381