Resubmissions

24-08-2024 20:55

240824-zqsh8syfqf 10

24-08-2024 20:52

240824-zn52jszhrm 10

Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    24-08-2024 20:52

General

  • Target

    https://GETSOLARA.DEV/

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://GETSOLARA.DEV/
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5080
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e4d0cc40,0x7ff9e4d0cc4c,0x7ff9e4d0cc58
      2⤵
        PID:1464
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1864,i,13069509141354854122,16563979898139703414,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1860 /prefetch:2
        2⤵
          PID:1876
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1424,i,13069509141354854122,16563979898139703414,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2132 /prefetch:3
          2⤵
            PID:4076
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2192,i,13069509141354854122,16563979898139703414,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2420 /prefetch:8
            2⤵
              PID:4696
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3092,i,13069509141354854122,16563979898139703414,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3172 /prefetch:1
              2⤵
                PID:2556
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,13069509141354854122,16563979898139703414,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3196 /prefetch:1
                2⤵
                  PID:3892
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4552,i,13069509141354854122,16563979898139703414,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4572 /prefetch:8
                  2⤵
                    PID:3744
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=212,i,13069509141354854122,16563979898139703414,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4572 /prefetch:8
                    2⤵
                      PID:1480
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4724,i,13069509141354854122,16563979898139703414,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4788 /prefetch:8
                      2⤵
                        PID:4084
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4788,i,13069509141354854122,16563979898139703414,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4320 /prefetch:8
                        2⤵
                        • Drops file in System32 directory
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3800
                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                      1⤵
                        PID:1712
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                        1⤵
                          PID:4844

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                          Filesize

                          64KB

                          MD5

                          b5ad5caaaee00cb8cf445427975ae66c

                          SHA1

                          dcde6527290a326e048f9c3a85280d3fa71e1e22

                          SHA256

                          b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

                          SHA512

                          92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

                        • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                          Filesize

                          4B

                          MD5

                          f49655f856acb8884cc0ace29216f511

                          SHA1

                          cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                          SHA256

                          7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                          SHA512

                          599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                        • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                          Filesize

                          1008B

                          MD5

                          d222b77a61527f2c177b0869e7babc24

                          SHA1

                          3f23acb984307a4aeba41ebbb70439c97ad1f268

                          SHA256

                          80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

                          SHA512

                          d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6d2c40e7-2982-447d-a8d0-c85a3fb171b6.tmp

                          Filesize

                          101KB

                          MD5

                          e74e1d8f9c5b5e404851e5af1868c3d5

                          SHA1

                          3d766ab403572af446e3c9e21ea67c1b050692be

                          SHA256

                          44db877c74458bd54b3b7eaa6e2246de56b0ae72ad6819aa4ce22b8d4cf5bf89

                          SHA512

                          1e7f08e2fc9417f763ba4b1b950ed0fbcfad57302e4dbe57ab5ea92b16a52efe395d0d4c572ccbfdb85a00273dbe4f881909f11b10c548a231f6ff83f6167154

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                          Filesize

                          649B

                          MD5

                          e096617296e6b21c770307b7b37dd3f5

                          SHA1

                          b5447e29597f06533729cc7d0035e8b68ad4ad71

                          SHA256

                          86b787f25064773e373d6c8cfee79fc0ab169d2c5f8b91b66c08377a2da30676

                          SHA512

                          32a2022113e6373def19dc089026b44caeea1b359bb93d404d1c777f6630856aa6f36b4032751c63296ef1cb9194162083a03f713b84fce12de277b4dccea0ac

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          1KB

                          MD5

                          eb81dec3967626408e328a8c85ef4147

                          SHA1

                          fc44e41c9d36d6f952c9224746b7ad60b692aeae

                          SHA256

                          13bf542e863ca39ae02424f048404979f86268e841e5904c32c64379fe6e4e75

                          SHA512

                          0459442a0a407f5510673bc5c72e8c65e7effda79a023311bb079069e2f7375b8d952eb70779d37b3f71252bb68a2201e26ddc0ee67d715ff1873948031568d6

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                          Filesize

                          2B

                          MD5

                          d751713988987e9331980363e24189ce

                          SHA1

                          97d170e1550eee4afc0af065b78cda302a97674c

                          SHA256

                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                          SHA512

                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          356B

                          MD5

                          a523280964bfd0e899c1e4ac0f61f353

                          SHA1

                          eba08f5a049a2afe8de1c5f7a34c3dc080723b73

                          SHA256

                          09381179c98098c7ce4cd4d5a18c5463ba2b507d2855daecbd8cc335296b7053

                          SHA512

                          71cbbed45ca696e462e896ebce92188ed53cfb24130ed63cb791e4a0ca80f7fa899068a791eafb2e9a983883ce72136d401e66095ea7961428fc8b38067e26e0

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          00e027787514b1738970c7f323e8d1f9

                          SHA1

                          5457e3793b40dbf867cb76bb7931c1e3fac33363

                          SHA256

                          813bdbde9e0128bf3635245f957f8d0fb9e35eb6bba8f19cd0d228e0bf9f5446

                          SHA512

                          e37a1418b62fe5b1fa08c31f9020f7c6adcd9ec019b31b2825fe53f119c46763f649ee1d8701c19ecfa63c73860df4089f886fa432448fb9366b8f196b550223

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          1df329af8d323972a8af462adf7e6ccf

                          SHA1

                          fba29f4e6a79ffe460a789cf100a3d96cdc0a2d5

                          SHA256

                          400cebd085839ce494486a38c616ad2c1362e50e6d99ee1b2f831686f18c3474

                          SHA512

                          fd04261a0ff0893a8798b6a37092e9ac45eb240d3708d566dff4af7d0e1dafca99c7925be56201c19d597329b350518dd73821699ba45a8974c61216acfed547

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          38ccad696541b9d2cff49b2544b3c176

                          SHA1

                          1875828642c3682c143c7312c7f95f50c18e7840

                          SHA256

                          ea07c9e8aa35aae4db7762d4731bf6c2d1dd408f88eccfa781793f2724be1140

                          SHA512

                          cf65d970c286db5725ec2e9692ade24a675e92222a784a0651da0d43f51c06cbe289788a596edb83fb13775077012d2ca6e95f3ee4db17d3890f88061deac4b7

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          4fc6f00bd8b95c8d6bbe43d5a7eb0bb0

                          SHA1

                          acce7e987d4dc71c3726794836ad2276cd6af990

                          SHA256

                          b18484ca42d231372af120af4f2a19bdcf51de966daa50117decb1d548f661c2

                          SHA512

                          d4f3448d4172c719801691b272cbc7c248a79f77a090bb00c6197de029615fcd8c056f590cb59fc6b0860143b2e72c1c6e47562a26475331f8bf8847a850e743

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          5a97d8da6c3548baaeff0debf50c058c

                          SHA1

                          94f1f036ee0d15197e0dd0075226e00046e2a786

                          SHA256

                          422d12bfec0095a7fbfd9e9b30cf7077dc4b9af104d1c088aa34b4dec7b26cb6

                          SHA512

                          068553bd047681ac8a1f7fa3df75083d982b411c517f9521e37e5fcb7f26c4df4d6be215cd5f0add61c46b6785c55e6b4a3caca62ffcc7bfaccfd66ff6dca6ee

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          8b8a6ccc1983579ba37804a8eb324b07

                          SHA1

                          a9e220af93cbffa18109770aac52a7e11a4f6338

                          SHA256

                          688582c6423e66451dd1fd7100f8bfc01c34a21b9e8dc57f3f4a4b5ae782916d

                          SHA512

                          fc7e80aa8498cea4849e019fa0a06677b44530d4116e2687ff0094bf022a3a738b2c2975b1c0a96ced5ece5fd59e94bdb6c8d5e08c2009010a563548ee11a536

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          70061f3d34e11648fc4e6f087ec21568

                          SHA1

                          74bd21d804f70a11b1e1ad7079ad091647b4a9bc

                          SHA256

                          4ae2c632b711807eb579acff23db853455955f0ff6f5d2f1d2da803bf0d32b77

                          SHA512

                          ea2601de54302af8e1bcf1543a82f3fe175518e3d0c9898fb659b71f5a21fd0d5aaf53dc24bf0b466827db9deef91381023b78b036f1dd0ce17102d110ebb1f2

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          992ef168e6ae8b8afae8a0cbe80de4f1

                          SHA1

                          1698aa55b39c167a98865aa83bbf3f146b8e4798

                          SHA256

                          5c67d85dab16d8cee8b44605d426ba91854120c669285af0e73ce55056386e89

                          SHA512

                          3b900087b822a2fb37faa2602aff20d752329bd1c170f2d5d829f1e8bacefce6a93338844bf288da714a6933e6bbeef7c8e9e6bb6794e4264c03eddee8d3d28e

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          130KB

                          MD5

                          db9f215c88977c7e789c2003aa441091

                          SHA1

                          01e57c6ec8701cb19eba29d6b9c3589e1c251c53

                          SHA256

                          98f8ba8ea72fdb2d7501ede8e6fd9a2d05dd465871da1680024d782ae433cd7f

                          SHA512

                          d533297c0a8cd9578b39094949f6409bf4a8a0e3a0cddb92c3060c06089671c425a572466d0e31a3a6610df6daa5003449693688f52c22a0d1fa1870e97c4585

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          101KB

                          MD5

                          cea4ed4fb59ee7d5f1e2323140ccae88

                          SHA1

                          226e66c93aa93175480aea39e41c176d08144a8a

                          SHA256

                          4b6bc90772d6a4b082af3d67eababbbe5069bc2036e916fb8cdba8e023ba90ee

                          SHA512

                          f0146cfe42548be8a588f377678956b6769c78883dc5121f4ff0cdedfa9cc33425e0278c35a250f07cbc247a23ceb206898e0862cac357ef5a073f378d2d8cbe

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          101KB

                          MD5

                          7219a004f234b481b2a45f021bd3f21f

                          SHA1

                          17fc8cd650af53202f3e55cd2cab0e720a42431f

                          SHA256

                          c31b883299464239952e818a7bfe9839f12c74404a51c919092aa54f947181eb

                          SHA512

                          b36e13815b19b77385effce1cbe2cb1f07768e7b2a483d5eadee1bd814b3bcf2b22135052d31aa3bcad42b821ac629e12b97906c9ff94df91125ad13755d92a6

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d55ad2b6-c137-4801-be7c-712701759290.tmp

                          Filesize

                          101KB

                          MD5

                          de9934914dffb9d449a0dc17d9c55b9f

                          SHA1

                          88fcb0b857711c911790aaba66fd43bc9cda2898

                          SHA256

                          5dbdbdc94e94a4beba110a58466c6254a3cecfa6f86e754c5eb81676ed8c240e

                          SHA512

                          627c8036c00124ea205f2f7ff2bd3451c72110d22f81b5cb5c9dc928294fc6b345d20a05a273bd0c59d1eb3cf8a902684db26f4224d76e7c13dac489cecf55eb

                        • \??\pipe\crashpad_5080_TIRUIRYAVKIWUKVN

                          MD5

                          d41d8cd98f00b204e9800998ecf8427e

                          SHA1

                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                          SHA256

                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                          SHA512

                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e