discordrat | hxxps://www[.]mediafire[.]com/file/lwg6n17e2ihznl3/Xapse[.]zip/file

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Solara.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Solara.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Solara.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Solara.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Solara.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Solara.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Solara.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Solara.exe

Executes dropped EXE 20 IoCs

pid	Process
3472	node.exe
5836	Solara.exe
5480	node.exe
1004	node.exe
3880	Solara.exe
6416	node.exe
6504	node.exe
6560	Solara.exe
6584	node.exe
6640	node.exe
6736	Solara.exe
6828	Solara.exe
6820	Solara.exe
6940	node.exe
7088	node.exe
3412	node.exe
3328	node.exe
3996	node.exe
7092	Solara.exe
3124	node.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe

Loads dropped DLL 23 IoCs

pid	Process
5148	MsiExec.exe
5148	MsiExec.exe
5904	MsiExec.exe
5904	MsiExec.exe
5904	MsiExec.exe
5904	MsiExec.exe
5904	MsiExec.exe
5252	MsiExec.exe
5252	MsiExec.exe
5252	MsiExec.exe
5148	MsiExec.exe
5836	Solara.exe
5836	Solara.exe
6560	Solara.exe
6736	Solara.exe
6828	Solara.exe
6820	Solara.exe
6560	Solara.exe
6820	Solara.exe
6828	Solara.exe
6736	Solara.exe
7092	Solara.exe
7092	Solara.exe

Themida packer 31 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x00070000000241d3-3175.dat	themida
behavioral1/memory/5836-3177-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/5836-3180-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/5836-3179-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/5836-3186-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/5836-3205-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/5836-3208-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/6560-3226-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/6560-3225-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/6560-3227-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/6560-3228-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/6736-3231-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/6736-3232-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/6736-3233-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/6736-3234-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/6828-3235-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/6828-3237-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/6828-3238-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/6820-3239-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/6820-3240-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/6828-3236-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/6820-3241-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/6820-3242-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/6736-3265-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/6820-3267-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/6828-3266-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/6560-3268-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/7092-3270-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/7092-3272-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/7092-3271-0x0000000180000000-0x000000018109F000-memory.dmp	themida
behavioral1/memory/7092-3269-0x0000000180000000-0x000000018109F000-memory.dmp	themida

Blocklisted process makes network request 1 IoCs

flow	pid	Process
345	2876	msiexec.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Solara.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Solara.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Solara.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Solara.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Solara.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Solara.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 43 IoCs

Web Service

T1102

flow	ioc
363	discord.com
427	pastebin.com
325	discord.com
332	pastebin.com
399	discord.com
420	discord.com
438	pastebin.com
449	discord.com
526	raw.githubusercontent.com
324	discord.com
405	pastebin.com
410	discord.com
423	pastebin.com
467	discord.com
528	discord.com
333	pastebin.com
367	pastebin.com
374	pastebin.com
441	pastebin.com
477	discord.com
430	pastebin.com
431	pastebin.com
440	pastebin.com
364	discord.com
370	discord.com
372	discord.com
398	discord.com
401	discord.com
437	discord.com
482	pastebin.com
480	discord.com
435	discord.com
330	discord.com
369	discord.com
403	discord.com
409	pastebin.com
412	discord.com
418	pastebin.com
433	discord.com
442	pastebin.com
456	pastebin.com
481	discord.com
527	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
5836	Solara.exe
6560	Solara.exe
6736	Solara.exe
6828	Solara.exe
6820	Solara.exe
7092	Solara.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5704 set thread context of 5156	5704	botstrapper.exe	226

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\just-diff-apply\index.mjs	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\unpack.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\cacache\lib\entry-index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\identity\oauth.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\selectors\root.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\glob\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\tlog\verify\set.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\normalize-package-data\lib\fixer.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\lib\diff\json.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\store\public-good-instance-root.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-profile\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\normalize-windows-path.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@isaacs\string-locale-compare\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\types\sigstore\__generated__\google\protobuf\descriptor.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\tar.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man5\npm-shrinkwrap-json.5	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@tootallnate\once\dist\index.js.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-registry-fetch\lib\errors.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\merkle\digest.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\dist\yarn.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\safe-buffer\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@isaacs\string-locale-compare\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ms\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\sigstore-utils.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\access.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmexec\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmdiff\lib\format-diff.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\sortAscending.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\fs-minipass\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-fund.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\lib\get.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\minipass-fetch\lib\headers.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-adduser.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\update.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\tools\pretty_gyp.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\supports-color\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\make-fetch-happen\lib\options.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\ca\verify\chain.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\tuf\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-audit-report\lib\reporters\quiet.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-install-checks\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\tlog\types\__generated__\hashedrekord.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\types\sigstore\__generated__\sigstore_verification.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\query.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\promise-spawn\lib\escape.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\README.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\util\tar-create-options.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\internal\streams\lazy_transform.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\rcompare.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-flush\node_modules\minipass\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\encodings\dbcs-data.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\text-table\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\which\README.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\npm	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\bin.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\README.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\write-file-atomic\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\pnpx.cmd	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-explore.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\types\sigstore\__generated__\sigstore_bundle.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\whoami.js	msiexec.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI7050.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI93BB.tmp	msiexec.exe
File created	C:\Windows\Installer\e586220.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6667.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6677.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6B1D.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7030.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8BF7.tmp	msiexec.exe
File created	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8E0C.tmp	msiexec.exe
File created	C:\Windows\Installer\e586224.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI65D9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6B3D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8C85.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e586220.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI69B5.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bootstrapper.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 31 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\PackageCode = "347C7A52EDBDC9A498427C0BC7ABB536"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\PackageName = "node-v18.16.0-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPath	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Version = "303038464"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductName = "Node.js"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\DocumentationShortcuts	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\corepack	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeRuntime	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeEtwSupport = "NodeRuntime"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\npm	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductIcon = "C:\\Windows\\Installer\\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\\NodeIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\DeploymentFlags = "3"	msiexec.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
6940	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
3432	msedge.exe
3432	msedge.exe
4332	identity_helper.exe
4332	identity_helper.exe
5748	msedge.exe
5748	msedge.exe
5376	bootstraper.exe
5376	bootstraper.exe
5376	bootstraper.exe
2876	msiexec.exe
2876	msiexec.exe
4832	bootstraper.exe
4832	bootstraper.exe
4832	bootstraper.exe
5836	Solara.exe
5836	Solara.exe
5836	Solara.exe
5836	Solara.exe
5836	Solara.exe
5836	Solara.exe
5836	Solara.exe
5836	Solara.exe
5836	Solara.exe
5836	Solara.exe
5836	Solara.exe
5836	Solara.exe
5836	Solara.exe
5836	Solara.exe
5836	Solara.exe
5836	Solara.exe
5836	Solara.exe
5836	Solara.exe
5836	Solara.exe
5836	Solara.exe
5836	Solara.exe
5836	Solara.exe
5836	Solara.exe
4260	bootstraper.exe
4260	bootstraper.exe
4260	bootstraper.exe
1172	bootstraper.exe
1172	bootstraper.exe
1172	bootstraper.exe
2620	bootstraper.exe
2620	bootstraper.exe
2620	bootstraper.exe
4944	bootstraper.exe
4944	bootstraper.exe
4944	bootstraper.exe
4592	bootstraper.exe
4592	bootstraper.exe
4592	bootstraper.exe
6560	Solara.exe
6560	Solara.exe
6736	Solara.exe
6736	Solara.exe
6820	Solara.exe
6820	Solara.exe
6828	Solara.exe
6828	Solara.exe
5288	msedge.exe
5288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5380	botstrapper.exe
Token: SeDebugPrivilege	5376	bootstraper.exe
Token: SeShutdownPrivilege	5352	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5352	msiexec.exe
Token: SeSecurityPrivilege	2876	msiexec.exe
Token: SeCreateTokenPrivilege	5352	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5352	msiexec.exe
Token: SeLockMemoryPrivilege	5352	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5352	msiexec.exe
Token: SeMachineAccountPrivilege	5352	msiexec.exe
Token: SeTcbPrivilege	5352	msiexec.exe
Token: SeSecurityPrivilege	5352	msiexec.exe
Token: SeTakeOwnershipPrivilege	5352	msiexec.exe
Token: SeLoadDriverPrivilege	5352	msiexec.exe
Token: SeSystemProfilePrivilege	5352	msiexec.exe
Token: SeSystemtimePrivilege	5352	msiexec.exe
Token: SeProfSingleProcessPrivilege	5352	msiexec.exe
Token: SeIncBasePriorityPrivilege	5352	msiexec.exe
Token: SeCreatePagefilePrivilege	5352	msiexec.exe
Token: SeCreatePermanentPrivilege	5352	msiexec.exe
Token: SeBackupPrivilege	5352	msiexec.exe
Token: SeRestorePrivilege	5352	msiexec.exe
Token: SeShutdownPrivilege	5352	msiexec.exe
Token: SeDebugPrivilege	5352	msiexec.exe
Token: SeAuditPrivilege	5352	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5352	msiexec.exe
Token: SeChangeNotifyPrivilege	5352	msiexec.exe
Token: SeRemoteShutdownPrivilege	5352	msiexec.exe
Token: SeUndockPrivilege	5352	msiexec.exe
Token: SeSyncAgentPrivilege	5352	msiexec.exe
Token: SeEnableDelegationPrivilege	5352	msiexec.exe
Token: SeManageVolumePrivilege	5352	msiexec.exe
Token: SeImpersonatePrivilege	5352	msiexec.exe
Token: SeCreateGlobalPrivilege	5352	msiexec.exe
Token: SeRestorePrivilege	2876	msiexec.exe
Token: SeTakeOwnershipPrivilege	2876	msiexec.exe
Token: SeRestorePrivilege	2876	msiexec.exe
Token: SeTakeOwnershipPrivilege	2876	msiexec.exe
Token: SeRestorePrivilege	2876	msiexec.exe
Token: SeTakeOwnershipPrivilege	2876	msiexec.exe
Token: SeRestorePrivilege	2876	msiexec.exe
Token: SeTakeOwnershipPrivilege	2876	msiexec.exe
Token: SeRestorePrivilege	2876	msiexec.exe
Token: SeTakeOwnershipPrivilege	2876	msiexec.exe
Token: SeRestorePrivilege	2876	msiexec.exe
Token: SeTakeOwnershipPrivilege	2876	msiexec.exe
Token: SeRestorePrivilege	2876	msiexec.exe
Token: SeTakeOwnershipPrivilege	2876	msiexec.exe
Token: SeRestorePrivilege	2876	msiexec.exe
Token: SeTakeOwnershipPrivilege	2876	msiexec.exe
Token: SeRestorePrivilege	2876	msiexec.exe
Token: SeTakeOwnershipPrivilege	2876	msiexec.exe
Token: SeRestorePrivilege	2876	msiexec.exe
Token: SeTakeOwnershipPrivilege	2876	msiexec.exe
Token: SeRestorePrivilege	2876	msiexec.exe
Token: SeTakeOwnershipPrivilege	2876	msiexec.exe
Token: SeSecurityPrivilege	6076	wevtutil.exe
Token: SeBackupPrivilege	6076	wevtutil.exe
Token: SeSecurityPrivilege	6136	wevtutil.exe
Token: SeBackupPrivilege	6136	wevtutil.exe
Token: SeRestorePrivilege	2876	msiexec.exe
Token: SeTakeOwnershipPrivilege	2876	msiexec.exe
Token: SeRestorePrivilege	2876	msiexec.exe
Token: SeTakeOwnershipPrivilege	2876	msiexec.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
5836	Solara.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 3784	3432	msedge.exe	83
PID 3432 wrote to memory of 3784	3432	msedge.exe	83
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 2784	3432	msedge.exe	84
PID 3432 wrote to memory of 4924	3432	msedge.exe	85
PID 3432 wrote to memory of 4924	3432	msedge.exe	85
PID 3432 wrote to memory of 2500	3432	msedge.exe	86
PID 3432 wrote to memory of 2500	3432	msedge.exe	86
PID 3432 wrote to memory of 2500	3432	msedge.exe	86
PID 3432 wrote to memory of 2500	3432	msedge.exe	86
PID 3432 wrote to memory of 2500	3432	msedge.exe	86
PID 3432 wrote to memory of 2500	3432	msedge.exe	86
PID 3432 wrote to memory of 2500	3432	msedge.exe	86
PID 3432 wrote to memory of 2500	3432	msedge.exe	86
PID 3432 wrote to memory of 2500	3432	msedge.exe	86
PID 3432 wrote to memory of 2500	3432	msedge.exe	86
PID 3432 wrote to memory of 2500	3432	msedge.exe	86
PID 3432 wrote to memory of 2500	3432	msedge.exe	86
PID 3432 wrote to memory of 2500	3432	msedge.exe	86
PID 3432 wrote to memory of 2500	3432	msedge.exe	86
PID 3432 wrote to memory of 2500	3432	msedge.exe	86
PID 3432 wrote to memory of 2500	3432	msedge.exe	86
PID 3432 wrote to memory of 2500	3432	msedge.exe	86
PID 3432 wrote to memory of 2500	3432	msedge.exe	86
PID 3432 wrote to memory of 2500	3432	msedge.exe	86
PID 3432 wrote to memory of 2500	3432	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

cURL User-Agent 42 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	446	curl/8.9.1-DEV
HTTP User-Agent header	462	curl/8.9.1-DEV
HTTP User-Agent header	475	curl/8.9.1-DEV
HTTP User-Agent header	514	curl/8.9.1-DEV
HTTP User-Agent header	523	curl/8.9.1-DEV
HTTP User-Agent header	376	curl/8.9.1-DEV
HTTP User-Agent header	447	curl/8.9.1-DEV
HTTP User-Agent header	468	curl/8.9.1-DEV
HTTP User-Agent header	469	curl/8.9.1-DEV
HTTP User-Agent header	522	curl/8.9.1-DEV
HTTP User-Agent header	525	curl/8.9.1-DEV
HTTP User-Agent header	459	curl/8.9.1-DEV
HTTP User-Agent header	464	curl/8.9.1-DEV
HTTP User-Agent header	472	curl/8.9.1-DEV
HTTP User-Agent header	476	curl/8.9.1-DEV
HTTP User-Agent header	513	curl/8.9.1-DEV
HTTP User-Agent header	465	curl/8.9.1-DEV
HTTP User-Agent header	381	curl/8.9.1-DEV
HTTP User-Agent header	384	curl/8.9.1-DEV
HTTP User-Agent header	394	curl/8.9.1-DEV
HTTP User-Agent header	454	curl/8.9.1-DEV
HTTP User-Agent header	461	curl/8.9.1-DEV
HTTP User-Agent header	453	curl/8.9.1-DEV
HTTP User-Agent header	458	curl/8.9.1-DEV
HTTP User-Agent header	463	curl/8.9.1-DEV
HTTP User-Agent header	484	curl/8.9.1-DEV
HTTP User-Agent header	519	curl/8.9.1-DEV
HTTP User-Agent header	385	curl/8.9.1-DEV
HTTP User-Agent header	452	curl/8.9.1-DEV
HTTP User-Agent header	470	curl/8.9.1-DEV
HTTP User-Agent header	471	curl/8.9.1-DEV
HTTP User-Agent header	474	curl/8.9.1-DEV
HTTP User-Agent header	460	curl/8.9.1-DEV
HTTP User-Agent header	466	curl/8.9.1-DEV
HTTP User-Agent header	473	curl/8.9.1-DEV
HTTP User-Agent header	386	curl/8.9.1-DEV
HTTP User-Agent header	448	curl/8.9.1-DEV
HTTP User-Agent header	450	curl/8.9.1-DEV
HTTP User-Agent header	451	curl/8.9.1-DEV
HTTP User-Agent header	457	curl/8.9.1-DEV
HTTP User-Agent header	382	curl/8.9.1-DEV
HTTP User-Agent header	455	curl/8.9.1-DEV

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:64
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{e7a98292-4214-4735-8d1f-6c3abca6a139}
  2⤵
  PID:5156

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1124
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1420
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1600

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1852
- C:\Windows\system32\AUDIODG.EXE
  C:\Windows\system32\AUDIODG.EXE 0x380 0x424
  2⤵
  PID:4856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2064

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2284

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2772

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2904

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3140

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/lwg6n17e2ihznl3/Xapse.zip/file
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83a3746f8,0x7ff83a374708,0x7ff83a374718
    3⤵
    PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
    3⤵
    PID:2784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
    3⤵
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
    3⤵
    PID:1808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
    3⤵
    PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
    3⤵
    PID:1008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
    3⤵
    PID:2608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
    3⤵
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6200 /prefetch:8
    3⤵
    PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
    3⤵
    PID:5736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6188 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2168 /prefetch:1
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
    3⤵
    PID:5972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
    3⤵
    PID:5264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7200 /prefetch:1
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10931739821663335497,15571295982395333218,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4756 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5288
- C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe
  "C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4132
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3C97.tmp\3C98.tmp\3C99.bat C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe"
    3⤵
    PID:4440
  - - C:\Users\Admin\Downloads\Xapse\Solara\bootstraper.exe
      bootstraper.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5376
    - - C:\Windows\System32\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5352
  - - C:\Users\Admin\Downloads\Xapse\Solara\botstrapper.exe
      botstrapper.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5380
- C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe
  "C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4340
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\F48C.tmp\F48D.tmp\F48E.bat C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe"
    3⤵
    PID:5952
  - - C:\Users\Admin\Downloads\Xapse\Solara\bootstraper.exe
      bootstraper.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4832
    - - C:\Program Files\nodejs\node.exe
        
        "node" -v
        5⤵
        Executes dropped EXE
        
        PID:3472
    - - C:\ProgramData\Solara\Solara.exe
        
        "C:\ProgramData\Solara\Solara.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:5836
      - C:\Program Files\nodejs\node.exe
        
        "node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" dc854d076d2a4d27
        6⤵
        Executes dropped EXE
        
        PID:5480
  - - C:\Users\Admin\Downloads\Xapse\Solara\botstrapper.exe
      botstrapper.exe
      4⤵
      PID:2764
- C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe
  "C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4808
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\35EB.tmp\35EC.tmp\35ED.bat C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe"
    3⤵
    PID:5896
  - - C:\Users\Admin\Downloads\Xapse\Solara\bootstraper.exe
      bootstraper.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4260
    - - C:\Program Files\nodejs\node.exe
        
        "node" -v
        5⤵
        Executes dropped EXE
        
        PID:1004
    - - C:\ProgramData\Solara\Solara.exe
        
        "C:\ProgramData\Solara\Solara.exe"
        5⤵
        Executes dropped EXE
        
        PID:3880
  - - C:\Users\Admin\Downloads\Xapse\Solara\botstrapper.exe
      botstrapper.exe
      4⤵
      PID:4112
- C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe
  "C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6132
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\424F.tmp\4250.tmp\4251.bat C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe"
    3⤵
    PID:4316
  - - C:\Users\Admin\Downloads\Xapse\Solara\bootstraper.exe
      bootstraper.exe
      4⤵
      PID:3472
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4488
  - - C:\Users\Admin\Downloads\Xapse\Solara\botstrapper.exe
      botstrapper.exe
      4⤵
      PID:3972
- C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe
  "C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6032
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4C61.tmp\4C62.tmp\4C63.bat C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe"
    3⤵
    PID:5900
  - - C:\Users\Admin\Downloads\Xapse\Solara\bootstraper.exe
      bootstraper.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1172
    - - C:\Program Files\nodejs\node.exe
        
        "node" -v
        5⤵
        Executes dropped EXE
        
        PID:6416
    - - C:\ProgramData\Solara\Solara.exe
        
        "C:\ProgramData\Solara\Solara.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:6560
      - C:\Program Files\nodejs\node.exe
        
        "node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" 245b7bcaf2514ad1
        6⤵
        Executes dropped EXE
        
        PID:6940
  - - C:\Users\Admin\Downloads\Xapse\Solara\botstrapper.exe
      botstrapper.exe
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Suspicious use of SetThreadContext
      PID:5704
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "$77botstrapper.exe" /tr "'C:\Users\Admin\Downloads\Xapse\Solara\botstrapper.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6940
- C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe
  "C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4852
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4C62.tmp\4C62.tmp\4C63.bat C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe"
    3⤵
    PID:1536
  - - C:\Users\Admin\Downloads\Xapse\Solara\bootstraper.exe
      bootstraper.exe
      4⤵
      PID:5736
    - - C:\Program Files\nodejs\node.exe
        
        "node" -v
        5⤵
        Executes dropped EXE
        
        PID:3996
    - - C:\ProgramData\Solara\Solara.exe
        
        "C:\ProgramData\Solara\Solara.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:7092
      - C:\Program Files\nodejs\node.exe
        
        "node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" 84b98eaed9a84831
        6⤵
        Executes dropped EXE
        
        PID:3124
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1372
  - - C:\Users\Admin\Downloads\Xapse\Solara\botstrapper.exe
      botstrapper.exe
      4⤵
      PID:5256
- C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe
  "C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1372
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4D1C.tmp\4D1D.tmp\4D1E.bat C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe"
    3⤵
    PID:2152
  - - C:\Users\Admin\Downloads\Xapse\Solara\bootstraper.exe
      bootstraper.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2620
    - - C:\Program Files\nodejs\node.exe
        
        "node" -v
        5⤵
        Executes dropped EXE
        
        PID:6504
    - - C:\ProgramData\Solara\Solara.exe
        
        "C:\ProgramData\Solara\Solara.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:6736
      - C:\Program Files\nodejs\node.exe
        
        "node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" 27b2a73b76854098
        6⤵
        Executes dropped EXE
        
        PID:7088
  - - C:\Users\Admin\Downloads\Xapse\Solara\botstrapper.exe
      botstrapper.exe
      4⤵
      PID:1176
- C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe
  "C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5436
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4DB9.tmp\4DBA.tmp\4DBB.bat C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe"
    3⤵
    PID:4532
  - - C:\Users\Admin\Downloads\Xapse\Solara\bootstraper.exe
      bootstraper.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4944
    - - C:\Program Files\nodejs\node.exe
        
        "node" -v
        5⤵
        Executes dropped EXE
        
        PID:6584
    - - C:\ProgramData\Solara\Solara.exe
        
        "C:\ProgramData\Solara\Solara.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:6828
      - C:\Program Files\nodejs\node.exe
        
        "node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" ee2ef6c299d044f7
        6⤵
        Executes dropped EXE
        
        PID:3412
  - - C:\Users\Admin\Downloads\Xapse\Solara\botstrapper.exe
      botstrapper.exe
      4⤵
      PID:6056
- C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe
  "C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4700
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4EA3.tmp\4EA4.tmp\4EA5.bat C:\Users\Admin\Downloads\Xapse\Solara\bootstrapper.exe"
    3⤵
    PID:5796
  - - C:\Users\Admin\Downloads\Xapse\Solara\bootstraper.exe
      bootstraper.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4592
    - - C:\Program Files\nodejs\node.exe
        
        "node" -v
        5⤵
        Executes dropped EXE
        
        PID:6640
    - - C:\ProgramData\Solara\Solara.exe
        
        "C:\ProgramData\Solara\Solara.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:6820
      - C:\Program Files\nodejs\node.exe
        
        "node" "C:\ProgramData\Solara\Monaco\fileaccess\index.js" 30b31766735e44b1
        6⤵
        Executes dropped EXE
        
        PID:3328
  - - C:\Users\Admin\Downloads\Xapse\Solara\botstrapper.exe
      botstrapper.exe
      4⤵
      PID:6044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3700

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3896

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4064

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:5004

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:464

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1772

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:5000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3600

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:2756

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:4516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4372

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6076

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:5300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:5568

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2876
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 8F864B2FBCFCD143BEDFDDBEC254AAF4
  2⤵
  - Loads dropped DLL
  PID:5148
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AA5F007F8E79041E2D6D065ED828E129
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5904
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DB1D595D9B45CB8210F4ACA1F31BFAF9 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5252
- - C:\Windows\SysWOW64\wevtutil.exe
    "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6076
  - - C:\Windows\System32\wevtutil.exe
      "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery