hxxps://link-hub[.]net/1187422/solarav4-download

Analysis

max time kernel
14s
max time network
16s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
24/08/2024, 21:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://link-hub.net/1187422/solarav4-download

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
42	api.ipify.org
13	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1964	msedge.exe
1964	msedge.exe
4664	msedge.exe
4664	msedge.exe
5784	msedge.exe
5784	msedge.exe
5304	identity_helper.exe
5304	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 3888	4664	msedge.exe	81
PID 4664 wrote to memory of 3888	4664	msedge.exe	81
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 2140	4664	msedge.exe	82
PID 4664 wrote to memory of 1964	4664	msedge.exe	83
PID 4664 wrote to memory of 1964	4664	msedge.exe	83
PID 4664 wrote to memory of 1940	4664	msedge.exe	84
PID 4664 wrote to memory of 1940	4664	msedge.exe	84
PID 4664 wrote to memory of 1940	4664	msedge.exe	84
PID 4664 wrote to memory of 1940	4664	msedge.exe	84
PID 4664 wrote to memory of 1940	4664	msedge.exe	84
PID 4664 wrote to memory of 1940	4664	msedge.exe	84
PID 4664 wrote to memory of 1940	4664	msedge.exe	84
PID 4664 wrote to memory of 1940	4664	msedge.exe	84
PID 4664 wrote to memory of 1940	4664	msedge.exe	84
PID 4664 wrote to memory of 1940	4664	msedge.exe	84
PID 4664 wrote to memory of 1940	4664	msedge.exe	84
PID 4664 wrote to memory of 1940	4664	msedge.exe	84
PID 4664 wrote to memory of 1940	4664	msedge.exe	84
PID 4664 wrote to memory of 1940	4664	msedge.exe	84
PID 4664 wrote to memory of 1940	4664	msedge.exe	84
PID 4664 wrote to memory of 1940	4664	msedge.exe	84
PID 4664 wrote to memory of 1940	4664	msedge.exe	84
PID 4664 wrote to memory of 1940	4664	msedge.exe	84
PID 4664 wrote to memory of 1940	4664	msedge.exe	84
PID 4664 wrote to memory of 1940	4664	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://link-hub.net/1187422/solarav4-download
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffaa90d3cb8,0x7ffaa90d3cc8,0x7ffaa90d3cd8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,16627005152456055096,5085468251876936680,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,16627005152456055096,5085468251876936680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,16627005152456055096,5085468251876936680,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16627005152456055096,5085468251876936680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16627005152456055096,5085468251876936680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16627005152456055096,5085468251876936680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16627005152456055096,5085468251876936680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,16627005152456055096,5085468251876936680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,16627005152456055096,5085468251876936680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2ee16858e751901224340cabb25e5704

SHA1
24e0d2d301f282fb8e492e9df0b36603b28477b2

SHA256
e9784fcff01f83f4925f23e3a24bce63314ea503c2091f7309c014895fead33c

SHA512
bd9994c2fb4bf097ce7ffea412a2bed97e3af386108ab6aab0df9472a92d4bd94489bb9c36750a92f9818fa3ea6d1756497f5364611e6ebd36de4cd14e9a0fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea667b2dedf919487c556b97119cf88a

SHA1
0ee7b1da90be47cc31406f4dba755fd083a29762

SHA256
9e7e47ebf490ba409eab3be0314fa695bf28f4764f4875c7568a54337f2df70f

SHA512
832391afcac34fc6c949dee8120f2a5f83ca68c159ff707751d844b085c7496930f0c8fd8313fd8f10a5f5725138be651953934aa79b087ba3c6dd22eaa49c72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
f1df23ccaa8dc543ad07e8aa44575086

SHA1
745080a62e3b86f474946810e4bccf54a5c639f9

SHA256
f649b7a4aac81a9e6372e621ac1cc1b5d3c43c546b0a82f4ce123f03fef11092

SHA512
0fa5b240abf9799c128da85fc4733367f3c9316afd580468e785fb7b80fb95a3fa89aa75306e019a81555f92cdde390bf7e65feee7d85868e948b23ee3294245

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e0f8af2cadf7eff799f80293fe64fc98

SHA1
81352d689d2a65a334e9e74366258f3cfc93cc59

SHA256
554681047a7997f273398a3a64edb4a02576523d02141a5c85ba6f83a9c0e740

SHA512
a7c0a098428985ffd7b03b4e03d67ebd87fe8c4a6d053306a4986506b42206bdb006b7b25e17efdc824515d54b7cd5ba8b2b271c94ddcfe8d01913df7579ab45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d8304af2e981542b1d53b927ae175e85

SHA1
690d26a0d4999a4d8eb0bb12fa58e2a960e6a699

SHA256
203b54735fa903873bd253a7e0b390dd7a439bb3ce9713eefc29b0a454b81149

SHA512
a10ec44892587d6d0f1cec592a5b8dc15152922847e9940707fac9d01002603685f0291b1d464781a95e87b63a187783cd0dab4812fb985448bc7d4ae3412c0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5611f7398ff1cc300f5d8c0992805d82

SHA1
bb275167504b39ec1dc854e5437d242515675922

SHA256
4ec60ed6b9d62f84f6a9dab813b925ef04c2fc85aa2f6d104eeca45221affcfe

SHA512
e80ce1a614003f4948a5dbfea2cd65bd2c67b8218f2949abd51d8ff872cc5371b515c412a7d24fd8c00d246c2d3de3312f9f684057acfe877b435fb8735934c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9326aafa4da33de52a1ca765510e5039

SHA1
cd74b48f5c77cd142853b0bf7e57e06061b87db4

SHA256
5a0a6b0d721df14b77285bb43a3a4db8c3deabbf8f9d581d5ca67fde1688d1ec

SHA512
a4bdb8ca3565fb0bcf2c079d313c2a6a464461e67fe06bd87af240d932e65ad5eca0f1dad8254c4465a19322015dc36ba2943d4335cfb97140cf8a179b4ab537

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
47c86f5f608539a64b1d0cd8003cddf7

SHA1
961947bc3e33df012b47f42039618ebae1033d32

SHA256
16413e4b3280458cfcc20164ff173b50399c50719034f033cfbdd18941fa5ab5

SHA512
c60b18a88ea6a69c6ad808a4c0a7f828551887e9dc4459b4eedf00c82fb7115fb931567f7173fa9bf778a280ff53be049846408285e281dc482212d339b42eea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a333b232fd5099aa51bd696561a503e0

SHA1
32b7d9c10a6a6c3fb967e199dbf0c2f9d59123db

SHA256
024e3925e8abdec1a4785ef51dcf433f92eddf8f1fb67d41a6d7ca3e3eff0950

SHA512
65f4a8fbbb07cffcdb4852f4bded3d9f94d3c5dc06bf6d8090087fd8a811455b5138346e80a74feac607f0f7a680bdbdd22e463be761e5b1b89d1541c1f2cda0

Download Submit