Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/08/2024, 07:37
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://solaraexecutor.com/bootstrapper/
Resource
win10v2004-20240802-en
General
-
Target
https://solaraexecutor.com/bootstrapper/
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Bootstrapper.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation BootstrapperV1.16.exe -
Executes dropped EXE 3 IoCs
pid Process 5448 Bootstrapper.exe 4564 Bootstrapper.exe 6124 BootstrapperV1.16.exe -
Loads dropped DLL 11 IoCs
pid Process 5548 MsiExec.exe 5548 MsiExec.exe 5800 MsiExec.exe 5800 MsiExec.exe 5800 MsiExec.exe 5800 MsiExec.exe 5800 MsiExec.exe 5776 MsiExec.exe 5776 MsiExec.exe 5776 MsiExec.exe 5548 MsiExec.exe -
Blocklisted process makes network request 2 IoCs
flow pid Process 147 5300 msiexec.exe 149 5300 msiexec.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 125 pastebin.com 126 pastebin.com 127 pastebin.com 140 pastebin.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\nodejs\node_modules\npm\node_modules\agentkeepalive\index.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\gauge\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\valid.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\dep-valid.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\common-ancestor-path\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\cacache\lib\content\rm.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\can-place-dep.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\commands\fund.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\ca\verify\chain.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\xcodeproj_file.py msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@colors\colors\themes\generic-logging.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\isexe\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\cacache\lib\verify.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-fetch\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@colors\colors\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\lib\util\move-file.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\minipass-fetch\lib\response.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\make-fetch-happen\lib\cache\key.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\bin\lib\print-tree.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\tracker.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-init.html msiexec.exe File created C:\Program Files\nodejs\node_modules\corepack\dist\pnpx.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\ca\verify\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npx.html msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\man\man1\npm-stop.1 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\glob\node_modules\minimatch\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\hosted-git-info\lib\hosts.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\remove.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-hook.html msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\event-target-shim\index.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\tlog\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\man\man1\npm-link.1 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-explain.html msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmteam\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\gauge\lib\error.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\events\.airtap.yml msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\metavuln-calculator\lib\hash.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmdiff\lib\untar.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\cacache\lib\util\move-file.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\wide-align\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\fs.realpath\old.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\readable-stream\CONTRIBUTING.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\chalk\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\lt.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\_stream_duplex.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\MSVSToolFile.py msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cli-table3\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\tools\emacs\run-unit-tests.sh msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\SECURITY.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\buffer\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\re.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\cacache\node_modules\glob\common.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\gauge\lib\plumbing.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\addon.gypi msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\read-package-json-fast\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\man\man7\scope.7 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\fs-minipass\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@gar\promisify\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\debug\node_modules\ms\license.md msiexec.exe File created C:\Program Files\nodejs\node_modules\corepack\shims\pnpm msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\console-control-strings\package.json msiexec.exe -
Drops file in Windows directory 21 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI7609.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI77FE.tmp msiexec.exe File created C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon msiexec.exe File created C:\Windows\Installer\e586c07.msi msiexec.exe File created C:\Windows\Installer\e586c03.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC} msiexec.exe File opened for modification C:\Windows\Installer\MSI7EE5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI71C0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI72BC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI781E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9F02.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9F71.tmp msiexec.exe File opened for modification C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon msiexec.exe File opened for modification C:\Windows\Installer\MSIA4C2.tmp msiexec.exe File opened for modification C:\Windows\Installer\e586c03.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI72AB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7F06.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA0D9.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 5600 5448 WerFault.exe 127 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wevtutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bootstrapper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bootstrapper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E msiexec.exe -
Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNode = "EnvironmentPath" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\corepack msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPath msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeRuntime msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\PackageName = "node-v18.16.0-x64.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeEtwSupport = "NodeRuntime" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Assignment = "1" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\npm msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductName = "Node.js" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Version = "303038464" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\DocumentationShortcuts msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\PackageCode = "347C7A52EDBDC9A498427C0BC7ABB536" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductIcon = "C:\\Windows\\Installer\\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\\NodeIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNpmModules = "EnvironmentPath" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\5B532AFE1A6C6E24B99C208A5DF6C1CD msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media\1 = ";" msiexec.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 455114.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 4984 msedge.exe 4984 msedge.exe 1444 msedge.exe 1444 msedge.exe 4440 identity_helper.exe 4440 identity_helper.exe 5444 msedge.exe 5444 msedge.exe 6124 BootstrapperV1.16.exe 6124 BootstrapperV1.16.exe 6124 BootstrapperV1.16.exe 5300 msiexec.exe 5300 msiexec.exe 5156 msedge.exe 5156 msedge.exe 5156 msedge.exe 5156 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
pid Process 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5448 Bootstrapper.exe Token: SeDebugPrivilege 4564 Bootstrapper.exe Token: SeDebugPrivilege 6124 BootstrapperV1.16.exe Token: SeShutdownPrivilege 3712 msiexec.exe Token: SeIncreaseQuotaPrivilege 3712 msiexec.exe Token: SeSecurityPrivilege 5300 msiexec.exe Token: SeCreateTokenPrivilege 3712 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3712 msiexec.exe Token: SeLockMemoryPrivilege 3712 msiexec.exe Token: SeIncreaseQuotaPrivilege 3712 msiexec.exe Token: SeMachineAccountPrivilege 3712 msiexec.exe Token: SeTcbPrivilege 3712 msiexec.exe Token: SeSecurityPrivilege 3712 msiexec.exe Token: SeTakeOwnershipPrivilege 3712 msiexec.exe Token: SeLoadDriverPrivilege 3712 msiexec.exe Token: SeSystemProfilePrivilege 3712 msiexec.exe Token: SeSystemtimePrivilege 3712 msiexec.exe Token: SeProfSingleProcessPrivilege 3712 msiexec.exe Token: SeIncBasePriorityPrivilege 3712 msiexec.exe Token: SeCreatePagefilePrivilege 3712 msiexec.exe Token: SeCreatePermanentPrivilege 3712 msiexec.exe Token: SeBackupPrivilege 3712 msiexec.exe Token: SeRestorePrivilege 3712 msiexec.exe Token: SeShutdownPrivilege 3712 msiexec.exe Token: SeDebugPrivilege 3712 msiexec.exe Token: SeAuditPrivilege 3712 msiexec.exe Token: SeSystemEnvironmentPrivilege 3712 msiexec.exe Token: SeChangeNotifyPrivilege 3712 msiexec.exe Token: SeRemoteShutdownPrivilege 3712 msiexec.exe Token: SeUndockPrivilege 3712 msiexec.exe Token: SeSyncAgentPrivilege 3712 msiexec.exe Token: SeEnableDelegationPrivilege 3712 msiexec.exe Token: SeManageVolumePrivilege 3712 msiexec.exe Token: SeImpersonatePrivilege 3712 msiexec.exe Token: SeCreateGlobalPrivilege 3712 msiexec.exe Token: SeRestorePrivilege 5300 msiexec.exe Token: SeTakeOwnershipPrivilege 5300 msiexec.exe Token: SeRestorePrivilege 5300 msiexec.exe Token: SeTakeOwnershipPrivilege 5300 msiexec.exe Token: SeRestorePrivilege 5300 msiexec.exe Token: SeTakeOwnershipPrivilege 5300 msiexec.exe Token: SeRestorePrivilege 5300 msiexec.exe Token: SeTakeOwnershipPrivilege 5300 msiexec.exe Token: SeRestorePrivilege 5300 msiexec.exe Token: SeTakeOwnershipPrivilege 5300 msiexec.exe Token: SeRestorePrivilege 5300 msiexec.exe Token: SeTakeOwnershipPrivilege 5300 msiexec.exe Token: SeRestorePrivilege 5300 msiexec.exe Token: SeTakeOwnershipPrivilege 5300 msiexec.exe Token: SeRestorePrivilege 5300 msiexec.exe Token: SeTakeOwnershipPrivilege 5300 msiexec.exe Token: SeRestorePrivilege 5300 msiexec.exe Token: SeTakeOwnershipPrivilege 5300 msiexec.exe Token: SeRestorePrivilege 5300 msiexec.exe Token: SeTakeOwnershipPrivilege 5300 msiexec.exe Token: SeRestorePrivilege 5300 msiexec.exe Token: SeTakeOwnershipPrivilege 5300 msiexec.exe Token: SeSecurityPrivilege 6112 wevtutil.exe Token: SeBackupPrivilege 6112 wevtutil.exe Token: SeSecurityPrivilege 6080 wevtutil.exe Token: SeBackupPrivilege 6080 wevtutil.exe Token: SeRestorePrivilege 5300 msiexec.exe Token: SeTakeOwnershipPrivilege 5300 msiexec.exe Token: SeRestorePrivilege 5300 msiexec.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1444 wrote to memory of 1188 1444 msedge.exe 85 PID 1444 wrote to memory of 1188 1444 msedge.exe 85 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4572 1444 msedge.exe 86 PID 1444 wrote to memory of 4984 1444 msedge.exe 87 PID 1444 wrote to memory of 4984 1444 msedge.exe 87 PID 1444 wrote to memory of 544 1444 msedge.exe 88 PID 1444 wrote to memory of 544 1444 msedge.exe 88 PID 1444 wrote to memory of 544 1444 msedge.exe 88 PID 1444 wrote to memory of 544 1444 msedge.exe 88 PID 1444 wrote to memory of 544 1444 msedge.exe 88 PID 1444 wrote to memory of 544 1444 msedge.exe 88 PID 1444 wrote to memory of 544 1444 msedge.exe 88 PID 1444 wrote to memory of 544 1444 msedge.exe 88 PID 1444 wrote to memory of 544 1444 msedge.exe 88 PID 1444 wrote to memory of 544 1444 msedge.exe 88 PID 1444 wrote to memory of 544 1444 msedge.exe 88 PID 1444 wrote to memory of 544 1444 msedge.exe 88 PID 1444 wrote to memory of 544 1444 msedge.exe 88 PID 1444 wrote to memory of 544 1444 msedge.exe 88 PID 1444 wrote to memory of 544 1444 msedge.exe 88 PID 1444 wrote to memory of 544 1444 msedge.exe 88 PID 1444 wrote to memory of 544 1444 msedge.exe 88 PID 1444 wrote to memory of 544 1444 msedge.exe 88 PID 1444 wrote to memory of 544 1444 msedge.exe 88 PID 1444 wrote to memory of 544 1444 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://solaraexecutor.com/bootstrapper/1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6c5646f8,0x7ffc6c564708,0x7ffc6c5647182⤵PID:1188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:4572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:82⤵PID:544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:12⤵PID:3276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2516 /prefetch:12⤵PID:4448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:12⤵PID:184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:12⤵PID:3472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:12⤵PID:4784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6600 /prefetch:82⤵PID:756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6600 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:12⤵PID:5440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:12⤵PID:5448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:12⤵PID:5600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:12⤵PID:5608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2988 /prefetch:12⤵PID:6064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:12⤵PID:5200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:12⤵PID:4256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6536 /prefetch:82⤵PID:5320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3028 /prefetch:12⤵PID:5340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:12⤵PID:4248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5460 /prefetch:82⤵PID:4180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5444
-
-
C:\Users\Admin\Downloads\Bootstrapper.exe"C:\Users\Admin\Downloads\Bootstrapper.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5448 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5448 -s 17723⤵
- Program crash
PID:5600
-
-
-
C:\Users\Admin\Downloads\Bootstrapper.exe"C:\Users\Admin\Downloads\Bootstrapper.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4564 -
C:\Users\Admin\Downloads\BootstrapperV1.16.exe"C:\Users\Admin\Downloads\BootstrapperV1.16.exe" --oldBootstrapper "C:\Users\Admin\Downloads\Bootstrapper.exe" --isUpdate true3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6124 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3712
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4667163802564252809,18156365513015825024,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5772 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5156
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5004
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5448 -ip 54481⤵PID:5732
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5300 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 6362729B417C3EE5F94BECD5F5331E4F2⤵
- Loads dropped DLL
PID:5548
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 38EBB6BBC353E095EC9170567749BE252⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5800
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 122A5D2F4713616F5209BBE81D0DF2F6 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5776 -
C:\Windows\SysWOW64\wevtutil.exe"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6112 -
C:\Windows\System32\wevtutil.exe"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow644⤵
- Suspicious use of AdjustPrivilegeToken
PID:6080
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD51e5ae9e946a2b5c43f3bdb5d281e7973
SHA1fea701e5392b1a0eac06bdf551388fc0e948bb5c
SHA2565e4a04d5d2007f7ba3ae14f8aba1ac779ffd24aedecf0f2c1b456c6068644d32
SHA5124d188863cf4e11b7bded4bfe9c5ee920003db8c7f65eb0f9fb2674dcef5b4ec2ab63ba2c1c561426f36b46210cf582760c9d0ffb85f55805db8d9754b6f1f023
-
Filesize
10KB
MD51d51e18a7247f47245b0751f16119498
SHA178f5d95dd07c0fcee43c6d4feab12d802d194d95
SHA2561975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f
SHA5121eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76
-
Filesize
8KB
MD5d3bc164e23e694c644e0b1ce3e3f9910
SHA11849f8b1326111b5d4d93febc2bafb3856e601bb
SHA2561185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4
SHA51291ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854
-
Filesize
818B
MD52916d8b51a5cc0a350d64389bc07aef6
SHA1c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA256733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
SHA512508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
-
Filesize
1KB
MD55ad87d95c13094fa67f25442ff521efd
SHA101f1438a98e1b796e05a74131e6bb9d66c9e8542
SHA25667292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
SHA5127187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3
-
Filesize
754B
MD5d2cf52aa43e18fdc87562d4c1303f46a
SHA158fb4a65fffb438630351e7cafd322579817e5e1
SHA25645e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
SHA51254e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
-
Filesize
771B
MD5e9dc66f98e5f7ff720bf603fff36ebc5
SHA1f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b
SHA256b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
SHA5128027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b
-
Filesize
730B
MD5072ac9ab0c4667f8f876becedfe10ee0
SHA10227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA2562ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
SHA512f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
-
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json
Filesize1KB
MD5d116a360376e31950428ed26eae9ffd4
SHA1192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b
SHA256c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5
SHA5125221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a
-
Filesize
802B
MD5d7c8fab641cd22d2cd30d2999cc77040
SHA1d293601583b1454ad5415260e4378217d569538e
SHA25604400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be
SHA512278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764
-
Filesize
16KB
MD5bc0c0eeede037aa152345ab1f9774e92
SHA156e0f71900f0ef8294e46757ec14c0c11ed31d4e
SHA2567a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5
SHA5125f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3
-
Filesize
780B
MD5b020de8f88eacc104c21d6e6cacc636d
SHA120b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA2563f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
SHA5124220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
-
Filesize
763B
MD57428aa9f83c500c4a434f8848ee23851
SHA1166b3e1c1b7d7cb7b070108876492529f546219f
SHA2561fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
SHA512c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
-
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts
Filesize4KB
MD5f0bd53316e08991d94586331f9c11d97
SHA1f5a7a6dc0da46c3e077764cfb3e928c4a75d383e
SHA256dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef
SHA512fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839
-
Filesize
771B
MD51d7c74bcd1904d125f6aff37749dc069
SHA121e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab
SHA25624b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9
SHA512b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778
-
Filesize
168B
MD5db7dbbc86e432573e54dedbcc02cb4a1
SHA1cff9cfb98cff2d86b35dc680b405e8036bbbda47
SHA2567cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9
SHA5128f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec
-
Filesize
133B
MD535b86e177ab52108bd9fed7425a9e34a
SHA176a1f47a10e3ab829f676838147875d75022c70c
SHA256afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319
SHA5123c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62
-
Filesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
Filesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
Filesize
63KB
MD567e59a06ec50dcd4aebe11bb4a7e99a5
SHA15d073dbe75e1a8b4ff9c3120df0084f373768dae
SHA25614be8f816315d26d4bc7f78088d502eff79dee045f9e6b239493a707758107fe
SHA5126364515e92ed455f837dcc021cc5d7bbab8eac2a61140de17ff6a67dfdbbd8fbdded5ce739d001a0ba555b6693dafdb6af83424d6643ff6efddc46d391b21d95
-
Filesize
20KB
MD58c34c7b82f4668c975defa63ea3c9911
SHA101aee6e4857efb1898934c58dfbaab60a9bafb75
SHA2566fddf44c880fa4ab45d21e764fb4371c8820b7b1c49502ece0fb5e1eab95ab3e
SHA5127b8db2103dedf6b36759771c5b0451d6e2feb8ba889a07f1dbb869c229739e4343636ab5fe0bae8ff7ae5798d533caf3e408e34b71be72d0bfdd076da5a6104f
-
Filesize
20KB
MD50c4e029571dc182bfb39161f25531f06
SHA177b38d4a247b63881e7b9be324979c203987ae4e
SHA256fa5e2241e03bf7f6357dbff6a4716e4fee8b612fcb241ce68411552ba643cee1
SHA51251501b8f4caadf0975eb5d1b3e193c3215c3b0706f7203d9173c8bbd3149526e9134b8b87ebcb0de6f1ed44e9f735ea3871201ac476f99e463380fbdd39ec7db
-
Filesize
210KB
MD548d2860dd3168b6f06a4f27c6791bcaa
SHA1f5f803efed91cd45a36c3d6acdffaaf0e863bf8c
SHA25604d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77
SHA512172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize768B
MD5d0afee2f5b9b7fa29869c89e66f4f608
SHA18e5c498f3758c523be5e6e96bcf21f3c82ee5495
SHA2562e51cb64c72553d17bc08d171deacf29a20de59c3c21fd3fce43cca0c389544b
SHA51230bdf44426b17cfe335ef1fb10c871c730f55673db1df618c1c6a5d1d2ec133011080123c3894ac0ac8fdc88e86f92c8e2915e23e0b8bb74775e34f58bffc22a
-
Filesize
3KB
MD5cda8f16b566190ce65abedec8e6a6937
SHA1347b3583ff2ffbecbcae6dad1042966d06689bb8
SHA256a5166fea1d48393fd2e8c1db0b2162371d7286ad5116a843775810a6e5ba6317
SHA512b876dba41dc3dc440bc715642144776cd5641e0046012d4c0e5ee468ce04d4130d39c977bb7e4aa8b67f4680755d1ee875398fe1e23298b4589d6dba23c8e309
-
Filesize
6KB
MD5754822fdc7a101d168571671a5ac0b3e
SHA162030a9035ad546422c22acb15f5cee0334e4f4d
SHA256216649ff30ee234fc2aaa3bcc1fb96814e90edbe7121a55eac507970714b2799
SHA51218664c7ea18ede672310fbd66c0028632679d73e69f5b1cdb2cef8bab15c17a605304d75e5c731ea34f6f46bdc46e6894acaf4edb009ad8d4adf83e38b6b305a
-
Filesize
8KB
MD5a5427ddb04b92ad7f9f083ec770af694
SHA1a465c9644d8bce4d043a231f8c54c69f0f73910e
SHA25646b27871244bc4183bdcc4f1cb49fba6b1f5836673920e35bbb80857a70cf19b
SHA512c0da31e662305414528b0708a881f666d073f23784acf5b322e245def6e286cc9539b1553222f5f091eb8c9745bc9ad3d23bacb2b20022c62c51a5d199382f5b
-
Filesize
8KB
MD588b60b3f6c369b04196dd38c31152aff
SHA1b86895e373c673fd2bfd24aeafa365642eae77dd
SHA2560e5dbb5afbf6e1baca71248a1bf2592c273b4d7b61c68c2e109d58e807dc9e87
SHA51236aa01ad1f5a9d4c1c4b9bc439cc8af2fd27ff0b4982b59120624b3024d96135180b2429c306c0e8559c274655732b968f882de970d6845d3b84d24dfb35f139
-
Filesize
538B
MD5245ce3179cdf525c0a5d72bc612e7e5a
SHA16bac408626266ec19a13694c98504d5c034740dc
SHA2562082b59d984960b6e2ac61a17db06f8f839db5017f147b0c1d81613031eb74df
SHA5124f3e480208e7f5c7781e1145dac29fd22f6217143efeef517554a3e16df848f6ee72014f6c40f4b3ce0458cab56681bbdaec85d8e535bbedf179e90754a1214f
-
Filesize
204B
MD5429efc897c9469d06be816d1c5f543e7
SHA1ab654e43d440a4c876df6617cdc263563dcfae10
SHA2560d794e57438fe186451ec0973f47c5a17c83ecd40bc6c5645ecdde97fc01abbe
SHA51279021be42a09ef5a446575832657daa4e9ffc7dd53ec8bfe62ee15c101a75d1592f56458bc90d8ae293f4d9c09233b7476c58a72de35c1dddefc029fe7cbd2c0
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5a4a8acda170c235a433954f770ba1fab
SHA1826d51e7411e37ada6b87d21b22bd590701a7e06
SHA256e633ed2872484454e11de68a87aac2fd4f1296e8553dc37a9feeeff27862e466
SHA512c925ac7f4e6940098777846ffcf4f01b2dfaa902bd14f9dc70730a623e25754d94edad703310f709112316fa29135c4f2cc7b5e15504ff1216d990c588abea78
-
Filesize
11KB
MD5b20f7e1a691981636ffe454a5f92e711
SHA12ae2d9b83da72191f169c0073c3426fe86299ce4
SHA256c10a216864fc8bc14ac722ed74bc02d1ead417ae947bf59972c159d3f3627a57
SHA512a151be3088f91230fae31c3a1b33ec6112d2325086d943093e1245bfad17ae20ca7c52f506b93c6439f6f5ba44a7e4138400e2a367f4fc60d5135d0b42b77e92
-
Filesize
30.1MB
MD50e4e9aa41d24221b29b19ba96c1a64d0
SHA1231ade3d5a586c0eb4441c8dbfe9007dc26b2872
SHA2565bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d
SHA512e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913
-
Filesize
796KB
MD576639ab92661f5c384302899934051ab
SHA19b33828f8ad3a686ff02b1a4569b8ae38128caed
SHA2566bb9ad960bcc9010db1b9918369bdfc4558f19287b5b6562079c610a28320178
SHA512928e4374c087070f8a6786f9082f05a866751ea877edf9afa23f6941dfc4d6762e1688bbb135788d6286ec324fa117fc60b46fed2f6e3a4ab059465a00f2ebee
-
Filesize
797KB
MD515d7bb17789bfb8fe7ce7843e88ac07c
SHA1a2666fcaafe1e8f9947786f258c5948b6dd70ded
SHA2569beaeb166b00470c91311de3abb29900873e9286a94578c1b5076602a287d5a0
SHA5120c428ed5f82740750da775ccc46778478d759918a09d40d63c6eef33f9ef1090bec88c61f0a6b5984115a1d5a513378f31d13e7890bd3777c56c162109987e0a
-
Filesize
122KB
MD59fe9b0ecaea0324ad99036a91db03ebb
SHA1144068c64ec06fc08eadfcca0a014a44b95bb908
SHA256e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9
SHA512906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176
-
Filesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
Filesize
297KB
MD57a86ce1a899262dd3c1df656bff3fb2c
SHA133dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541
SHA256b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c
SHA512421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec