hxxps://raw[.]githubusercontent[.]com/ByterCode/Solara-Excutor/refs/heads/main/Solara%20NEW[.]zip

Resubmissions

24/10/2024, 19:59

241024-yqt7dsscpl6

24/10/2024, 19:55

24/10/2024, 19:54

24/10/2024, 12:40

24/10/2024, 12:34

24/10/2024, 12:24

22/10/2024, 13:05

Analysis

max time kernel
115s
max time network
117s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
24/10/2024, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://raw.githubusercontent.com/ByterCode/Solara-Excutor/refs/heads/main/Solara%20NEW.zip
Sample241024-yndfvssclj

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4240	powershell.exe
956	powershell.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	reg.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinSFX.exe	javaw.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinSFX.exe	javaw.exe

Executes dropped EXE 1 IoCs

pid	Process
4696	WinSFX.exe

Loads dropped DLL 1 IoCs

pid	Process
2884	javaw.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	javaw.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
18	discord.com
19	discord.com
20	discord.com
22	raw.githubusercontent.com
2	raw.githubusercontent.com
3	discord.com
4	raw.githubusercontent.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
2	ip-api.com
16	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara NEW.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
560	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Solara NEW.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
3760	msedge.exe
3760	msedge.exe
3280	msedge.exe
3280	msedge.exe
5088	msedge.exe
5088	msedge.exe
124	identity_helper.exe
124	identity_helper.exe
4508	msedge.exe
4508	msedge.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
956	powershell.exe
956	powershell.exe
4240	powershell.exe
4240	powershell.exe
956	powershell.exe
4240	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeBackupPrivilege	2884	javaw.exe
Token: SeBackupPrivilege	2884	javaw.exe
Token: SeSecurityPrivilege	2884	javaw.exe
Token: SeDebugPrivilege	2884	javaw.exe
Token: SeIncreaseQuotaPrivilege	2792	wmic.exe
Token: SeSecurityPrivilege	2792	wmic.exe
Token: SeTakeOwnershipPrivilege	2792	wmic.exe
Token: SeLoadDriverPrivilege	2792	wmic.exe
Token: SeSystemProfilePrivilege	2792	wmic.exe
Token: SeSystemtimePrivilege	2792	wmic.exe
Token: SeProfSingleProcessPrivilege	2792	wmic.exe
Token: SeIncBasePriorityPrivilege	2792	wmic.exe
Token: SeCreatePagefilePrivilege	2792	wmic.exe
Token: SeBackupPrivilege	2792	wmic.exe
Token: SeRestorePrivilege	2792	wmic.exe
Token: SeShutdownPrivilege	2792	wmic.exe
Token: SeDebugPrivilege	2792	wmic.exe
Token: SeSystemEnvironmentPrivilege	2792	wmic.exe
Token: SeRemoteShutdownPrivilege	2792	wmic.exe
Token: SeUndockPrivilege	2792	wmic.exe
Token: SeManageVolumePrivilege	2792	wmic.exe
Token: 33	2792	wmic.exe
Token: 34	2792	wmic.exe
Token: 35	2792	wmic.exe
Token: 36	2792	wmic.exe
Token: SeIncreaseQuotaPrivilege	2792	wmic.exe
Token: SeSecurityPrivilege	2792	wmic.exe
Token: SeTakeOwnershipPrivilege	2792	wmic.exe
Token: SeLoadDriverPrivilege	2792	wmic.exe
Token: SeSystemProfilePrivilege	2792	wmic.exe
Token: SeSystemtimePrivilege	2792	wmic.exe
Token: SeProfSingleProcessPrivilege	2792	wmic.exe
Token: SeIncBasePriorityPrivilege	2792	wmic.exe
Token: SeCreatePagefilePrivilege	2792	wmic.exe
Token: SeBackupPrivilege	2792	wmic.exe
Token: SeRestorePrivilege	2792	wmic.exe
Token: SeShutdownPrivilege	2792	wmic.exe
Token: SeDebugPrivilege	2792	wmic.exe
Token: SeSystemEnvironmentPrivilege	2792	wmic.exe
Token: SeRemoteShutdownPrivilege	2792	wmic.exe
Token: SeUndockPrivilege	2792	wmic.exe
Token: SeManageVolumePrivilege	2792	wmic.exe
Token: 33	2792	wmic.exe
Token: 34	2792	wmic.exe
Token: 35	2792	wmic.exe
Token: 36	2792	wmic.exe
Token: SeDebugPrivilege	4240	powershell.exe
Token: SeDebugPrivilege	956	powershell.exe
Token: SeRestorePrivilege	2884	javaw.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
240	Solara NEW.exe
2884	javaw.exe
2884	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 1776	3280	msedge.exe	79
PID 3280 wrote to memory of 1776	3280	msedge.exe	79
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 4128	3280	msedge.exe	80
PID 3280 wrote to memory of 3760	3280	msedge.exe	81
PID 3280 wrote to memory of 3760	3280	msedge.exe	81
PID 3280 wrote to memory of 1140	3280	msedge.exe	82
PID 3280 wrote to memory of 1140	3280	msedge.exe	82
PID 3280 wrote to memory of 1140	3280	msedge.exe	82
PID 3280 wrote to memory of 1140	3280	msedge.exe	82
PID 3280 wrote to memory of 1140	3280	msedge.exe	82
PID 3280 wrote to memory of 1140	3280	msedge.exe	82
PID 3280 wrote to memory of 1140	3280	msedge.exe	82
PID 3280 wrote to memory of 1140	3280	msedge.exe	82
PID 3280 wrote to memory of 1140	3280	msedge.exe	82
PID 3280 wrote to memory of 1140	3280	msedge.exe	82
PID 3280 wrote to memory of 1140	3280	msedge.exe	82
PID 3280 wrote to memory of 1140	3280	msedge.exe	82
PID 3280 wrote to memory of 1140	3280	msedge.exe	82
PID 3280 wrote to memory of 1140	3280	msedge.exe	82
PID 3280 wrote to memory of 1140	3280	msedge.exe	82
PID 3280 wrote to memory of 1140	3280	msedge.exe	82
PID 3280 wrote to memory of 1140	3280	msedge.exe	82
PID 3280 wrote to memory of 1140	3280	msedge.exe	82
PID 3280 wrote to memory of 1140	3280	msedge.exe	82
PID 3280 wrote to memory of 1140	3280	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://raw.githubusercontent.com/ByterCode/Solara-Excutor/refs/heads/main/Solara%20NEW.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa9dd43cb8,0x7ffa9dd43cc8,0x7ffa9dd43cd8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,13348274961938684565,130258922997257091,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,13348274961938684565,130258922997257091,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,13348274961938684565,130258922997257091,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13348274961938684565,130258922997257091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13348274961938684565,130258922997257091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13348274961938684565,130258922997257091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13348274961938684565,130258922997257091,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13348274961938684565,130258922997257091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13348274961938684565,130258922997257091,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,13348274961938684565,130258922997257091,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,13348274961938684565,130258922997257091,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1872,13348274961938684565,130258922997257091,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13348274961938684565,130258922997257091,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=1872,13348274961938684565,130258922997257091,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13348274961938684565,130258922997257091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,13348274961938684565,130258922997257091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1872,13348274961938684565,130258922997257091,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4652 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3664

C:\Users\Admin\Downloads\Solara NEW\Solara NEW.exe
"C:\Users\Admin\Downloads\Solara NEW\Solara NEW.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:240
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\Solara NEW\Solara NEW.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2884
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKLM\HARDWARE\DESCRIPTION\System /v SystemBiosVersion
    3⤵
    - Checks BIOS information in registry
    - Modifies registry key
    PID:560
- - C:\Windows\System32\Wbem\wmic.exe
    wmic diskdrive get model
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:SystemDrive) -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:SystemDrive) -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:956
- - C:\Users\Admin\AppData\Roaming\WinSFXConnectDevicesPlatform\WinSFX.exe
    C:\Users\Admin\AppData\Roaming\WinSFXConnectDevicesPlatform\WinSFX.exe
    3⤵
    - Executes dropped EXE
    PID:4696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 53d69c9cc3c8aaf2c8b58ea6a2aa47c49c9ec11167dd9414cd9f4192f9978724
MD5 e1544690d41d950f9c1358068301cfb5
SHA1 ae3ff81363fcbe33c419e49cabef61fb6837bffa
SHA512 1e4f1fe2877f4f947d33490e65898752488e48de34d61e197e4448127d6b1926888de80b62349d5a88b96140eed0a5b952ef4dd7ca318689f76e12630c9029da
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e
MD5 9314124f4f0ad9f845a0d7906fd8dfd8
SHA1 0d4f67fb1a11453551514f230941bdd7ef95693c
SHA512 87b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 193B
SHA256 ee0d15dce841e092ad1a2d4346a612410f8f950fdb019bc7b768f6346f2b5248
MD5 62fc8758c85fb0d08cd24eeddafeda2c
SHA1 320fc202790b0ca6f65ff67e9397440c7d97eb20
SHA512 ca97e615bdcac137a936c10104a702e1529ed3470828f2c3a2f783345ebbef04cac8c051df636c714151671efea53a9b8912b6b0d0b5eafdac5fae1dfdc8f85d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 8904142d61d15415f253410d96e4a388e12bb9e2f091833de9aa946ce598e4c7
MD5 b4a2c7fcd49b700710817f5799b96c88
SHA1 0877ee9c218e44637910e06d6f5e3d40d5f3e9a1
SHA512 e75b5f98c675c518f12429dd1bb6570a974c3f9e801f8e75aa3f3c3c7341fee1f476058f2909ac12023b6ade14753f8475ddf503d7afe00a89d014d398e32a70
SSDEEP 96:nExk33UkB+MkvWkswSv0MoiVmdHIQJOHb0WQyV+VuziX3wI3:ngk31XkuPv0MAIm0LM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c46fa13319ebfe42f6d33c5e88cac621180b7ae4efce542c2fc797c64a928c3f
MD5 19661f2a2900abd88a15924d1f461142
SHA1 776d4df2701b5d3ac20d3335e454097ad66093c6
SHA512 7e5d409cb65e40e84e57385bbf0a0560fe790a0ad9d2fcbbe5f648078d6e71463426b1ffc8a52234ada066963894e645616dfe1bf23f67765a8ecc19a2722030
SSDEEP 96:nExk3SsQxUkB+MkvWkswSv0MoiVmdHIQJPHb0WQyV+VpAiX3wI3:ngk3iXkuPv0MAImzLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 09fe544b30deb90369a64e22b613e43cb5cc7fe8d1ff075a93d361ae35b12af2
MD5 3fa0649b0cbff05a79e7cd271be05e8e
SHA1 495a2a32f3d3811c6ff4c687f4c3e948861b8c6b
SHA512 01952740a66a162b913839d19ccd66f49838ed34b067783a96fcc38025eaadb740b9134a925da7089efb31abb53e378604b76e69db841c0aff55c13e433b0397
SSDEEP 192:uoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGSzzFSe2RUWkMRPhUma/OeAhw:69iIxuERzA83h09RZxASGMzOXPSPpAhw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0ede745d4ac3666adce3fc9891a44ece51ba4d7c2824ad150b50be361e3df0a4
MD5 30508921c05740374b43218eb6871d0d
SHA1 921d88a53fb9e7c499492f5f7c39227fe3ed6e41
SHA512 5de3f5e8011038129c87595732547ce86cd901af923c9ce7d7eb36e21a6dc7032112c37ba2e9840bfc6b19ab5288c7d2f70368c6e0fc7a90b988733f8106dbbe
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGSzzFSe2RUWkMRPhnma/OeAhw:M9iIxuERzA83h09RZxASGMzOXP5PpAhw
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
MD5 1a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA1 9910190edfaccece1dfcc1d92e357772f5dae8f7
SHA512 5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_hwgesp25.ypg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hwgesp25.ypg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

jna200918481818110607.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna200918481818110607.dll
Size 248KB
SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
MD5 719d6ba1946c25aa61ce82f90d77ffd5
SHA1 94d2191378cac5719daecc826fc116816284c406
SHA512 119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
SSDEEP 6144:tO+uZb5K8Dy+Zkt9dHlJ1ybBEleb906wslm/m+yygW:tO+MbMOEe3m
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinSFX.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinSFX.exe
Size 11.7MB
SHA256 9c64fd58c0b9cace7bc05861965db2cb55017d24096eebb4d1569a3b556969d4
MD5 428ffde3328ba281229a03357c965547
SHA1 72c6432ca8b64ac848ed2e85deeeb5ad0caaea7a
SHA512 1e0f5fb54d46a4bed2776fa7e7fbb44adb3267901fe99428947a32de8b914401084b080a913a6a1e20bfaf8d769df64c7d3d9ab039fdbd0aca9b5ec1ccb2822a
SSDEEP 196608:uNR3tX1nA7N1KnkdIO3MXcYObzlRO76KiviRlOF/TmoGbiA62vvcaN5EXxs9Hu4B:CR3nABaXO3ucVbzlw76RiSTmJbiAB5EE
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinSFX.exe

Path C:\Users\Admin\AppData\Roaming\WinSFXConnectDevicesPlatform\WinSFX.exe
Size 8.7MB
SHA256 582e5bb83b7cea2fb71a1b3bbefcf18d8dda8a719e31b4da14f886d2016c97bc
MD5 506777f1d2016f6cbd053caa8d5a9bc7
SHA1 c44d5eaf701a900982f51d0dfcb336c6eb507395
SHA512 6891eddd1218194378e762318fca8171465b2d663afae6c96a3092433c9bec911f87965dfa9ea932a0b32e31e8b7531328b89a4226ccbc98871e09367cfdb99d
SSDEEP 196608:uNR3tX1nA7N1KnkdIO3MXcYObzlRO76KiviRlOF/TmoGbiK:CR3nABaXO3ucVbzlw76RiSTmJbiK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Solara NEW.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Solara NEW.zip:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

Unconfirmed 414902.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 414902.crdownload
Size 6.3MB
SHA256 b48e4eab11480e04415e8f202a0efccbde9f3e841b19e9399e579b63f39b60c9
MD5 1ec1ed8bb2dcea1c3f9d9f7542dbe245
SHA1 d65d7a2fa1895d748194f560c757113ce903f088
SHA512 ebe51a8074b884d44963b7bf82ed6206d15fda297fcaf530f1811c211771732c451e2b02d623031129cd8a27d569d667b04cdcca9acdef519c9862c5e374f3b2
SSDEEP 196608:3Fg53AL9npU1+/xwEylyZy74C4oK+QrcRwryU:Vg6L96Ov074CZCceryU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/240-141-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/956-291-0x0000020576630000-0x0000020576652000-memory.dmp

Download

memory/2884-275-0x000001B52DBF0000-0x000001B52DBF1000-memory.dmp

Download

memory/2884-310-0x000001B52DBF0000-0x000001B52DBF1000-memory.dmp

Download

memory/2884-270-0x000001B52DBF0000-0x000001B52DBF1000-memory.dmp

Download

memory/2884-264-0x000001B52DBF0000-0x000001B52DBF1000-memory.dmp

Download

memory/2884-263-0x000001B52DBF0000-0x000001B52DBF1000-memory.dmp

Download

memory/2884-262-0x000001B52DBF0000-0x000001B52DBF1000-memory.dmp

Download

memory/2884-254-0x000001B52DBF0000-0x000001B52DBF1000-memory.dmp

Download

memory/2884-273-0x000001B52DBF0000-0x000001B52DBF1000-memory.dmp

Download

memory/2884-314-0x000001B52DBF0000-0x000001B52DBF1000-memory.dmp

Download

memory/2884-318-0x000001B52DBF0000-0x000001B52DBF1000-memory.dmp

Download

memory/2884-332-0x000001B52DBF0000-0x000001B52DBF1000-memory.dmp

Download

memory/2884-338-0x000001B52DBF0000-0x000001B52DBF1000-memory.dmp

Download

memory/2884-348-0x000001B52DBF0000-0x000001B52DBF1000-memory.dmp

Download

memory/2884-204-0x000001B52DBF0000-0x000001B52DBF1000-memory.dmp

Download

memory/2884-175-0x000001B52DBF0000-0x000001B52DBF1000-memory.dmp

Download