hxxps://linkvertise[.]com/1208172/solara-bootstrapper?o=sharing

Analysis

max time kernel
146s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://linkvertise.com/1208172/solara-bootstrapper?o=sharing

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
87	api.ipify.org
88	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-945322488-2060912225-3527527000-1000\{D225D680-BCD8-4202-87BB-E9EDDEB07D67}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
4404	msedge.exe
4404	msedge.exe
4176	msedge.exe
4176	msedge.exe
768	identity_helper.exe
768	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 720	4404	msedge.exe	84
PID 4404 wrote to memory of 720	4404	msedge.exe	84
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3308	4404	msedge.exe	85
PID 4404 wrote to memory of 3840	4404	msedge.exe	86
PID 4404 wrote to memory of 3840	4404	msedge.exe	86
PID 4404 wrote to memory of 2076	4404	msedge.exe	87
PID 4404 wrote to memory of 2076	4404	msedge.exe	87
PID 4404 wrote to memory of 2076	4404	msedge.exe	87
PID 4404 wrote to memory of 2076	4404	msedge.exe	87
PID 4404 wrote to memory of 2076	4404	msedge.exe	87
PID 4404 wrote to memory of 2076	4404	msedge.exe	87
PID 4404 wrote to memory of 2076	4404	msedge.exe	87
PID 4404 wrote to memory of 2076	4404	msedge.exe	87
PID 4404 wrote to memory of 2076	4404	msedge.exe	87
PID 4404 wrote to memory of 2076	4404	msedge.exe	87
PID 4404 wrote to memory of 2076	4404	msedge.exe	87
PID 4404 wrote to memory of 2076	4404	msedge.exe	87
PID 4404 wrote to memory of 2076	4404	msedge.exe	87
PID 4404 wrote to memory of 2076	4404	msedge.exe	87
PID 4404 wrote to memory of 2076	4404	msedge.exe	87
PID 4404 wrote to memory of 2076	4404	msedge.exe	87
PID 4404 wrote to memory of 2076	4404	msedge.exe	87
PID 4404 wrote to memory of 2076	4404	msedge.exe	87
PID 4404 wrote to memory of 2076	4404	msedge.exe	87
PID 4404 wrote to memory of 2076	4404	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://linkvertise.com/1208172/solara-bootstrapper?o=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85f5346f8,0x7ff85f534708,0x7ff85f534718
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,11314899266921792883,7974095305484081906,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,11314899266921792883,7974095305484081906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,11314899266921792883,7974095305484081906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11314899266921792883,7974095305484081906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11314899266921792883,7974095305484081906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11314899266921792883,7974095305484081906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2088,11314899266921792883,7974095305484081906,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2088,11314899266921792883,7974095305484081906,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11314899266921792883,7974095305484081906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11314899266921792883,7974095305484081906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
e37c90577cbdf2fb154e4e9c7545632b

SHA1
c893788cf2c36276fe42bff3b19e96249e9195cb

SHA256
f09f244c215e16fe408f7562ca2346f74b49ec84f16bae3a712a836766e301e7

SHA512
bb7db4b527f0d66987d275170377def08892d6d942a1b5c4207822d882d80ad4e2c7668804659d2c7b97ac7257c3caff7aa5f9810f74e286b0f946c1b886741b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
671eeef87ddbda11f6d36c8d70127f64

SHA1
6b897b48ba37b721c894f4ed545be544fc87eb5a

SHA256
8a4a66ae563a5f4921d44dcffc5f5c525e21d27a131e10c155c09d85c624f5c0

SHA512
9d71c675cfe202beddbc7cc700b05ce2d22e6f9ff2e771f8244b010b3ed65bbc59fe22a288189f8ebb36f2c7f49fbb33f8d37e6a880c07a411cf53cd1168f90e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
66dfbdc46f5f6cd04396f3936713e283

SHA1
25d7cb4b133e81e8db4b280e38d9dd52151aabd1

SHA256
db0fb1590eed9f750b3418b52539ff35a279d0857710a7342d4ae62f48342dfe

SHA512
0a80ee8bda753d5598974d871e86f3ba7a2b22cbf1ab1b1f7fa2127ffcfa1e8b24ead3f2a5a23195f7672834f61de73dfb584870ff614bdb52d578989a17a602

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f0cb7da8e92c0352b9e11ca405d59c44

SHA1
e992ea2d487f234e3f94eb74aca42c2c0fa4b5ca

SHA256
616402276d8ff9b8cd34986c7fa5b6eb5fdcf573f5e225fab78c3669d0929d7d

SHA512
023779c45e4f566eca31051a63a8713fd004a13383a2688156722d7542f509a9dedd81c7cb65d075c9fbfe5dc07b273681014ebb04c6c21895e9a89de814d20f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e26dd94a171c41e43ce065d2a388e15e

SHA1
b3dce967cbc5f9667688fc94dd3c4fe40da2ec5c

SHA256
1a178f9a61fd663ee864681331c7e75195f1cceb8e046c4d8803b10c3b9f40f2

SHA512
80cc643115c057d39806f780061dc3c9289282c0f2e2955a1ae7647bf45e5d51c7c1bf04e988ceb246b8e445ba2d76bea1309e6d44d9fb87319244d1013e7a3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ff9cec6931957d0c407e0d3cd3321fd3

SHA1
1fd75566b9a74c40702b166510a34d88d20a648e

SHA256
5cb8b6907e09d3b56c206df07c0ed6ef5d9ec141051cce6a91ca152d76de6bbf

SHA512
541392eea50bcd57a60063ed64584eca99e8e87e13aaa4d852e1254233da472c6414a040b7c74b69db41af4b561312d94ba7466e453da543c19597d970a054ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c224825ee26d403ba3aadaf00c7f7d4b

SHA1
08f0e19ed04a7e89f6cdcf922768b6cc3649c809

SHA256
3d140205f5b2c7869505687e15e1c5de1bcdb2da3b17e1c623b6c68d6f1a81c4

SHA512
ae5ee9f05aaa56c2823f238420a50751a68213970c8a23fc486ed7a8ee50c69e9f713b7e23bce0d1dfe4f86b90f520981c3317956fddf6747fcb87ddde76ec21

Download Submit