hxxps://raw[.]githubusercontent[.]com/ByterCode/Solara-Excutor/refs/heads/main/Solara%20NEW[.]zip

Resubmissions

24/10/2024, 19:59

241024-yqt7dsscpl6

24/10/2024, 19:55

24/10/2024, 19:54

24/10/2024, 12:40

24/10/2024, 12:34

24/10/2024, 12:24

22/10/2024, 13:05

Analysis

max time kernel
32s
max time network
33s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
24/10/2024, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://raw.githubusercontent.com/ByterCode/Solara-Excutor/refs/heads/main/Solara%20NEW.zip
Sample241024-ymwk2ssckm

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4128	powershell.exe
1364	powershell.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
3836	javaw.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	javaw.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
39	discord.com
40	discord.com
43	discord.com
47	raw.githubusercontent.com
48	raw.githubusercontent.com
3	raw.githubusercontent.com
5	raw.githubusercontent.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
34	api.ipify.org
35	api.ipify.org
37	ip-api.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\b4536f52-1f51-42af-a867-db833cd41c04.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241024195454.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara NEW.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4856	reg.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
652	msedge.exe
652	msedge.exe
4232	msedge.exe
4232	msedge.exe
3372	identity_helper.exe
3372	identity_helper.exe
5068	msedge.exe
5068	msedge.exe
3836	javaw.exe
3836	javaw.exe
3836	javaw.exe
3836	javaw.exe
3836	javaw.exe
3836	javaw.exe
3836	javaw.exe
3836	javaw.exe
3836	javaw.exe
3836	javaw.exe
3836	javaw.exe
3836	javaw.exe
3836	javaw.exe
3836	javaw.exe
3836	javaw.exe
3836	javaw.exe
3836	javaw.exe
3836	javaw.exe
3836	javaw.exe
3836	javaw.exe
216	wmic.exe
216	wmic.exe
216	wmic.exe
216	wmic.exe
3836	javaw.exe
3836	javaw.exe
3836	javaw.exe
4128	powershell.exe
4128	powershell.exe
1364	powershell.exe
1364	powershell.exe
4128	powershell.exe
1364	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	3836	javaw.exe
Token: SeBackupPrivilege	3836	javaw.exe
Token: SeSecurityPrivilege	3836	javaw.exe
Token: SeDebugPrivilege	3836	javaw.exe
Token: SeIncreaseQuotaPrivilege	216	wmic.exe
Token: SeSecurityPrivilege	216	wmic.exe
Token: SeTakeOwnershipPrivilege	216	wmic.exe
Token: SeLoadDriverPrivilege	216	wmic.exe
Token: SeSystemProfilePrivilege	216	wmic.exe
Token: SeSystemtimePrivilege	216	wmic.exe
Token: SeProfSingleProcessPrivilege	216	wmic.exe
Token: SeIncBasePriorityPrivilege	216	wmic.exe
Token: SeCreatePagefilePrivilege	216	wmic.exe
Token: SeBackupPrivilege	216	wmic.exe
Token: SeRestorePrivilege	216	wmic.exe
Token: SeShutdownPrivilege	216	wmic.exe
Token: SeDebugPrivilege	216	wmic.exe
Token: SeSystemEnvironmentPrivilege	216	wmic.exe
Token: SeRemoteShutdownPrivilege	216	wmic.exe
Token: SeUndockPrivilege	216	wmic.exe
Token: SeManageVolumePrivilege	216	wmic.exe
Token: 33	216	wmic.exe
Token: 34	216	wmic.exe
Token: 35	216	wmic.exe
Token: 36	216	wmic.exe
Token: SeIncreaseQuotaPrivilege	216	wmic.exe
Token: SeSecurityPrivilege	216	wmic.exe
Token: SeTakeOwnershipPrivilege	216	wmic.exe
Token: SeLoadDriverPrivilege	216	wmic.exe
Token: SeSystemProfilePrivilege	216	wmic.exe
Token: SeSystemtimePrivilege	216	wmic.exe
Token: SeProfSingleProcessPrivilege	216	wmic.exe
Token: SeIncBasePriorityPrivilege	216	wmic.exe
Token: SeCreatePagefilePrivilege	216	wmic.exe
Token: SeBackupPrivilege	216	wmic.exe
Token: SeRestorePrivilege	216	wmic.exe
Token: SeShutdownPrivilege	216	wmic.exe
Token: SeDebugPrivilege	216	wmic.exe
Token: SeSystemEnvironmentPrivilege	216	wmic.exe
Token: SeRemoteShutdownPrivilege	216	wmic.exe
Token: SeUndockPrivilege	216	wmic.exe
Token: SeManageVolumePrivilege	216	wmic.exe
Token: 33	216	wmic.exe
Token: 34	216	wmic.exe
Token: 35	216	wmic.exe
Token: 36	216	wmic.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	1364	powershell.exe
Token: SeIncreaseQuotaPrivilege	1364	powershell.exe
Token: SeSecurityPrivilege	1364	powershell.exe
Token: SeTakeOwnershipPrivilege	1364	powershell.exe
Token: SeLoadDriverPrivilege	1364	powershell.exe
Token: SeSystemProfilePrivilege	1364	powershell.exe
Token: SeSystemtimePrivilege	1364	powershell.exe
Token: SeProfSingleProcessPrivilege	1364	powershell.exe
Token: SeIncBasePriorityPrivilege	1364	powershell.exe
Token: SeCreatePagefilePrivilege	1364	powershell.exe
Token: SeBackupPrivilege	1364	powershell.exe
Token: SeRestorePrivilege	1364	powershell.exe
Token: SeShutdownPrivilege	1364	powershell.exe
Token: SeDebugPrivilege	1364	powershell.exe
Token: SeSystemEnvironmentPrivilege	1364	powershell.exe
Token: SeRemoteShutdownPrivilege	1364	powershell.exe
Token: SeUndockPrivilege	1364	powershell.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1032	Solara NEW.exe
3836	javaw.exe
3836	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 4072	4232	msedge.exe	82
PID 4232 wrote to memory of 4072	4232	msedge.exe	82
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 2956	4232	msedge.exe	84
PID 4232 wrote to memory of 652	4232	msedge.exe	85
PID 4232 wrote to memory of 652	4232	msedge.exe	85
PID 4232 wrote to memory of 1472	4232	msedge.exe	86
PID 4232 wrote to memory of 1472	4232	msedge.exe	86
PID 4232 wrote to memory of 1472	4232	msedge.exe	86
PID 4232 wrote to memory of 1472	4232	msedge.exe	86
PID 4232 wrote to memory of 1472	4232	msedge.exe	86
PID 4232 wrote to memory of 1472	4232	msedge.exe	86
PID 4232 wrote to memory of 1472	4232	msedge.exe	86
PID 4232 wrote to memory of 1472	4232	msedge.exe	86
PID 4232 wrote to memory of 1472	4232	msedge.exe	86
PID 4232 wrote to memory of 1472	4232	msedge.exe	86
PID 4232 wrote to memory of 1472	4232	msedge.exe	86
PID 4232 wrote to memory of 1472	4232	msedge.exe	86
PID 4232 wrote to memory of 1472	4232	msedge.exe	86
PID 4232 wrote to memory of 1472	4232	msedge.exe	86
PID 4232 wrote to memory of 1472	4232	msedge.exe	86
PID 4232 wrote to memory of 1472	4232	msedge.exe	86
PID 4232 wrote to memory of 1472	4232	msedge.exe	86
PID 4232 wrote to memory of 1472	4232	msedge.exe	86
PID 4232 wrote to memory of 1472	4232	msedge.exe	86
PID 4232 wrote to memory of 1472	4232	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://raw.githubusercontent.com/ByterCode/Solara-Excutor/refs/heads/main/Solara%20NEW.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffc584846f8,0x7ffc58484708,0x7ffc58484718
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,3118015248944449990,991312820179093017,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,3118015248944449990,991312820179093017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,3118015248944449990,991312820179093017,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3118015248944449990,991312820179093017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3118015248944449990,991312820179093017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,3118015248944449990,991312820179093017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x10c,0x110,0x114,0x124,0x118,0x7ff7fe6a5460,0x7ff7fe6a5470,0x7ff7fe6a5480
    3⤵
    PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,3118015248944449990,991312820179093017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3118015248944449990,991312820179093017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3118015248944449990,991312820179093017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,3118015248944449990,991312820179093017,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3118015248944449990,991312820179093017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,3118015248944449990,991312820179093017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3118015248944449990,991312820179093017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3118015248944449990,991312820179093017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:2268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1640

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\76983565-5f4b-48ef-a483-563feacc988d_Solara NEW.zip.88d\ВАЖНО!.txt
1⤵
PID:5104

C:\Users\Admin\AppData\Local\Temp\998d6a40-a505-4531-a144-b106cd21a35b_Solara NEW.zip.35b\Solara NEW.exe
"C:\Users\Admin\AppData\Local\Temp\998d6a40-a505-4531-a144-b106cd21a35b_Solara NEW.zip.35b\Solara NEW.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1032
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\998d6a40-a505-4531-a144-b106cd21a35b_Solara NEW.zip.35b\Solara NEW.exe"
  2⤵
  - Loads dropped DLL
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3836
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKLM\HARDWARE\DESCRIPTION\System /v SystemBiosVersion
    3⤵
    - Checks BIOS information in registry
    - Modifies registry key
    PID:4856
- - C:\Windows\System32\Wbem\wmic.exe
    wmic diskdrive get model
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:SystemDrive) -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:SystemDrive) -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
MD5 3eb3833f769dd890afc295b977eab4b4
SHA1 e857649b037939602c72ad003e5d3698695f436f
SHA512 c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 692f41363d887f712ab0862a8c317e4b62ba6a0294b238ea8c1ad4ac0fbcda7a
MD5 843402bd30bd238629acedf42a0dcb51
SHA1 050e6aa6f2c5b862c224e5852cdfb84db9a79bbc
SHA512 977ec0f2943ad3adb9cff7e964d73f3dadc53283329248994f8c6246dfafbf2af3b25818c54f94cc73cd99f01888e84254d5435e28961db40bccbbf24e966167
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 83cb7d7b4f4a9b084202fef8723df5c5b78f2af1a60e5a4c25a8ed407b5bf53b
MD5 557df060b24d910f788843324c70707a
SHA1 e5d15be40f23484b3d9b77c19658adcb6e1da45c
SHA512 78df1a48eed7d2d297aa87b41540d64a94f5aa356b9fc5c97b32ab4d58a8bc3ba02ce829aed27d693f7ab01d31d5f2052c3ebf0129f27dd164416ea65edc911c
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
MD5 e5e3377341056643b0494b6842c0b544
SHA1 d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA512 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
SSDEEP 1536:vAlMWz7vLDtDSVlXXwpFlorgLUxF+D4n6owPFCawP/:vvuWAUxFaoGw/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c677d18fcf253740288be7ac18f1ca94225f186dd92849d9fd2576c5b8a3a591
MD5 7c518c4f8eca7a73a95de9350abf7c5c
SHA1 b3e88956d7ffec03728ed73d86313305a7a3a5f7
SHA512 c5658282746b9cd6748c2227d952cec4b69aff6241188cfbff8a150e50fdf4261300ece646396d2e917c56b55d606c49cfa2fcc2331dab7da81b450c7fde52e1
SSDEEP 96:nEVDsQSYgm/49mqUU1pXtuwpvWMoiVmdeHo7LVUWQyV+VD7AiEwb:ngJdu3X0GWMX0rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 973cc3fb871d291dae03074b931b09fde88d0ca8874e7ee93445eea79e870258
MD5 c16364e1c56fd94902445db1bb2c9fb8
SHA1 b1ca8faac724887bb577837c1d66f1a2ad640144
SHA512 110d159e46fe317f95970db6b012d68caa84bd7b4e3c3600c756f1f04a8a11a5a719fc8c8c0edd84812dbc72bfb7a69ec776036d6b857e0839d5ce0671a15a1c
SSDEEP 96:nEVDsQSYgm/4smqUU1pXtuwpvWMoiVmdeHoh7qLVUWQyV+VD7AiEwb:ngJau3X0GWMXFrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 88e4f25bdac2379d9bcca1ea180a44aa2602f4dd5b16fa42a2ae6a1fed554b72
MD5 8660349030802373ea9a19ebb7f24b11
SHA1 8a5f6e090525c48119735d9c543a8c2606410030
SHA512 cb64972e10d6f19944d1a6660ad08ba770175f427220a00926a623d6a200bc10cb5f5a07f6c54b8f45eab1913b167fd66ce8b207d8290dff4f45f25efea6e2a8
SSDEEP 96:nEjtYgm/4QYmqUU1pXtuwpvWMoiVmdeHo7LVUWQyV+VDCAia:n2Sdu3X0GWMX0re
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 7d7e7b38664d625a0bbffbcb7882b175709e92987bf9da113c4745fafbbc361d
MD5 74d9eb5260fef5b115bec73a0af9ac54
SHA1 18862574f0044f4591a2c3cf156db8f237787acf
SHA512 b85917201b1d4b4542a4424ce40ddd083ddbd0e230e1931fe6f7cdd2aa3d8a0eec8daa743ddc5467f0a92da5594144c602081d941b216ca9cafdfd3c150d32d2
SSDEEP 768:nR+WsY8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGLl+krU872D:nR+WsYu1jajLY84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 faa79ba7dfd140106187ab50f14aa7cca13650f94f796419bc0a44d7a2b79d5f
MD5 952a6e3cbc50f011cf2f04c9470080ff
SHA1 a0d6a2509af73e523c970f6e4351861bde63d6db
SHA512 7955092a6086f05268e4b0f88648d9275020b6cad83f81c90eac5a7cd994cc243b8dfab579d4335db62f3577fd2d8a7fbefcad6cc615e2bcf1d014115056cde4
SSDEEP 768:p+WsY8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGLl+krUb72v:p+WsYu1jajLYbc
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a8ddb0c15ccedac88266dddc80a01bd5a4bca1a05a596e01790f69208ffcc442
MD5 2a56d99cda3c72c7b2b4000eacea9f3a
SHA1 2f594daf481302c9db10531a6e552619e9d6c705
SHA512 2dcb88d8bce7aa76cbf1d987027e6ad6228e0b68525f0f4eb92742de7c1770873cbc55ad4ce0ef4e9c551a7092323042e5727f98b35c9c2860f473c67a3de7be
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSHt++e2RUp3fYQ0W50u:N9iIxuERzA83h09RZxYSN+gqA4au
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 be21fc3ce00b0d53a5a5e155e2e7c4b717dafd3874d48c4f1f2724119e47bb11
MD5 97302fbbe9c035c31841374443953f08
SHA1 5aad8b9c1ea32a6a2ac511b632c1f18479ef712b
SHA512 e16ee94da5b6bd2d20045596bc13332ba516d6282454e44352c59fe1daa5457f52e2e79946231318c030e4c6e768c253f81c324320502dcd19da755525062f7c
SSDEEP 192:8oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupS+Yt++e2RUp3fYQ0W41K3e:s9iIxuERzA83h09RZxYS+O+gqA48Knu
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e3b30f16d41f94cba2b8a75f35c91ae7418465abfbfe5477ec0551d1952b2fdb
MD5 60b3262c3163ee3d466199160b9ed07d
SHA1 994ece4ea4e61de0be2fdd580f87e3415f9e1ff6
SHA512 081d2015cb94477eb0fbc38f44b6d9b4a3204fb3ad0b7d0e146a88ab4ab9a0d475207f1adae03f4a81ccc5beb7568dc8be1249f69e32fe56efd9ee2f6ee3b1af
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_pspkeai4.25h.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pspkeai4.25h.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

jna1138045657984430948.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna1138045657984430948.dll
Size 248KB
SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
MD5 719d6ba1946c25aa61ce82f90d77ffd5
SHA1 94d2191378cac5719daecc826fc116816284c406
SHA512 119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
SSDEEP 6144:tO+uZb5K8Dy+Zkt9dHlJ1ybBEleb906wslm/m+yygW:tO+MbMOEe3m
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 2b7a5e192d8b4487dfe786b6b1a161be23cadf52449fccbe69a22acad277200e
MD5 17e01f11ea453dd860d704bd9d070a00
SHA1 ec84283342a18ff14e764e85ad93fb94751983ac
SHA512 f9a7c68165dd4b19014f38c0dfb625a2dd4a76fddc327b5119ad88fa079313b9f959d72b8029768320c16965c4edf2082de015e069a435014c979d6092a30bd9
MD5 SHA1 SHA512

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 421f1a4e49cd2c5d99d4355f81549f505c6e071bf6148bfdf93cd099b07cb141
MD5 ab3221bd3eca84071f11eba90d578563
SHA1 ee382aee385d2e2fc91d69810d0fe014ae03f74a
SHA512 c0266761954ff810e36908448b0c7caeee2fd6435fe70407c3eb74948b501738cdc862d96687f1330729549cda9745410bc6c4b5d0d6d1626b197b99646e0951
MD5 SHA1 SHA512

Submit Download

Solara NEW.zip

Path C:\Users\Admin\Downloads\Solara NEW.zip
Size 6.3MB
SHA256 b48e4eab11480e04415e8f202a0efccbde9f3e841b19e9399e579b63f39b60c9
MD5 1ec1ed8bb2dcea1c3f9d9f7542dbe245
SHA1 d65d7a2fa1895d748194f560c757113ce903f088
SHA512 ebe51a8074b884d44963b7bf82ed6206d15fda297fcaf530f1811c211771732c451e2b02d623031129cd8a27d569d667b04cdcca9acdef519c9862c5e374f3b2
SSDEEP 196608:3Fg53AL9npU1+/xwEylyZy74C4oK+QrcRwryU:Vg6L96Ov074CZCceryU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1032-191-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/3836-361-0x0000020479CC0000-0x0000020479CC1000-memory.dmp

Download

memory/3836-332-0x0000020479CC0000-0x0000020479CC1000-memory.dmp

Download

memory/3836-238-0x0000020479CC0000-0x0000020479CC1000-memory.dmp

Download

memory/3836-322-0x0000020479CC0000-0x0000020479CC1000-memory.dmp

Download

memory/3836-317-0x0000020479CC0000-0x0000020479CC1000-memory.dmp

Download

memory/3836-370-0x0000020479CC0000-0x0000020479CC1000-memory.dmp

Download

memory/3836-373-0x0000020479CC0000-0x0000020479CC1000-memory.dmp

Download

memory/3836-377-0x0000020479CC0000-0x0000020479CC1000-memory.dmp

Download

memory/3836-380-0x0000020479CC0000-0x0000020479CC1000-memory.dmp

Download

memory/4128-351-0x000001BB7F5E0000-0x000001BB7F602000-memory.dmp

Download