Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
22-08-2024 23:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BootstrapperSolara.exe
Resource
win10-20240404-en
windows10-1703-x64
13 signatures
150 seconds
General
-
Target
BootstrapperSolara.exe
-
Size
961KB
-
MD5
fa965ef7dad222010cb3185768dddf72
-
SHA1
64ea311586210eee0741f4e94f51c66a3e99dbf2
-
SHA256
7851e924f810dab1284813a043f4e41f52306cb919085f0afc3a17b32c7da450
-
SHA512
59057559c2a776660395a0a1d0ce67d3a7157b367f654b79f36c46df12c829a0c61a43718b57e5c1490367b6264202c9411e3d3fa74e58c59f05851abb5b6a61
-
SSDEEP
12288:u0EgdoJsmwgZXgV7BqUURLBCt3KpOJE+sm93hW2FZm4sPMaJhf6ozg+GQm8gXags:6gyJs2QV0UURdCt3LJrhePMN
Score
9/10
Malware Config
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Loads dropped DLL 1 IoCs
pid Process 308 BootstrapperSolara.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 308 set thread context of 2300 308 BootstrapperSolara.exe 76 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BootstrapperSolara.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2300 MSBuild.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3472 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeBackupPrivilege 2300 MSBuild.exe Token: SeSecurityPrivilege 2300 MSBuild.exe Token: SeSecurityPrivilege 2300 MSBuild.exe Token: SeSecurityPrivilege 2300 MSBuild.exe Token: SeSecurityPrivilege 2300 MSBuild.exe Token: SeDebugPrivilege 2300 MSBuild.exe Token: SeDebugPrivilege 3472 taskmgr.exe Token: SeSystemProfilePrivilege 3472 taskmgr.exe Token: SeCreateGlobalPrivilege 3472 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 308 wrote to memory of 2300 308 BootstrapperSolara.exe 76 PID 308 wrote to memory of 2300 308 BootstrapperSolara.exe 76 PID 308 wrote to memory of 2300 308 BootstrapperSolara.exe 76 PID 308 wrote to memory of 2300 308 BootstrapperSolara.exe 76 PID 308 wrote to memory of 2300 308 BootstrapperSolara.exe 76 PID 308 wrote to memory of 2300 308 BootstrapperSolara.exe 76 PID 308 wrote to memory of 2300 308 BootstrapperSolara.exe 76 PID 308 wrote to memory of 2300 308 BootstrapperSolara.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\BootstrapperSolara.exe"C:\Users\Admin\AppData\Local\Temp\BootstrapperSolara.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2300
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3472
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1072
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4284
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4940
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4440
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1892
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4148
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4168
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2804
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2568
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4036
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD57f38048a5b4bb647a43e93df970417c3
SHA1f7022125ba74f50d0d4515ca0b47ccc88c2f47e1
SHA25681d8c4d06be3654f64a49a2effb3606bb48a37556f4db38a524033d9949915bc
SHA51206adc7711a98548c94954546a4a547b2547d63d1f26351a58e17d38b73c02e54823daf99d9aae8311225c02bf9e2f40bbb903ff6707c3ddaa64b1caafbbe342f
-
Filesize
1.2MB
MD5ee8f4d53a63875270bc1c0a28d791148
SHA1963c75a3c698f536e32620f507bb607cbe7af72f
SHA2568831023784ad6d17c0ac4f550f21e95699bc54da6a79a08c079852465fea5023
SHA51243c4b8ffffe8169d7f773426f202a5aa136ca8a57b5d3f8b8a2467ab118cce149b944f405ca5d904d677e74069519ded4115f8a8629c2e59570bae01dad94972