Analysis

  • max time kernel
    1213s
  • max time network
    1771s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    08/11/2024, 21:55

General

  • Target

    Solara New Bootstrapper_10282148.exe

  • Size

    5.7MB

  • MD5

    15d1c495ff66bf7cea8a6d14bfdf0a20

  • SHA1

    942814521fa406a225522f208ac67f90dbde0ae7

  • SHA256

    61c2c4a5d7c14f77ee88871ded4cc7f1e49dae3e4ef209504c66fedf4d22de42

  • SHA512

    063169f22108ac97a3ccb6f8e97380b1e48eef7a07b8fb20870b9bd5f03d7279d3fb10a69c09868beb4a1672ebe826198ae2d0ea81df4d29f9a288ea4f2b98d8

  • SSDEEP

    98304:+j8ab67Ht6RL8xpH4Tv7wPV6osBsBpPj7cZ+KCojTeEL78rqNkIi+bn:+j8aatLPV6oPrk38rqNj

Score
6/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 42 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Solara New Bootstrapper_10282148.exe
    "C:\Users\Admin\AppData\Local\Temp\Solara New Bootstrapper_10282148.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2992
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt
      2⤵
      • System Location Discovery: System Language Discovery
      • Opens file in notepad (likely ransom note)
      PID:2160
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:532
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6c39758,0x7fef6c39768,0x7fef6c39778
      2⤵
        PID:856
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1236,i,17908230913079343417,15417248264660525737,131072 /prefetch:2
        2⤵
          PID:908
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1540 --field-trial-handle=1236,i,17908230913079343417,15417248264660525737,131072 /prefetch:8
          2⤵
            PID:1320
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1236,i,17908230913079343417,15417248264660525737,131072 /prefetch:8
            2⤵
              PID:2644
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1528 --field-trial-handle=1236,i,17908230913079343417,15417248264660525737,131072 /prefetch:1
              2⤵
                PID:2716
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2192 --field-trial-handle=1236,i,17908230913079343417,15417248264660525737,131072 /prefetch:1
                2⤵
                  PID:2608
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1464 --field-trial-handle=1236,i,17908230913079343417,15417248264660525737,131072 /prefetch:2
                  2⤵
                    PID:852
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1332 --field-trial-handle=1236,i,17908230913079343417,15417248264660525737,131072 /prefetch:1
                    2⤵
                      PID:2872
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3416 --field-trial-handle=1236,i,17908230913079343417,15417248264660525737,131072 /prefetch:8
                      2⤵
                        PID:2448
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3544 --field-trial-handle=1236,i,17908230913079343417,15417248264660525737,131072 /prefetch:8
                        2⤵
                          PID:2980
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3524 --field-trial-handle=1236,i,17908230913079343417,15417248264660525737,131072 /prefetch:1
                          2⤵
                            PID:828
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3360 --field-trial-handle=1236,i,17908230913079343417,15417248264660525737,131072 /prefetch:8
                            2⤵
                              PID:1748
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3396 --field-trial-handle=1236,i,17908230913079343417,15417248264660525737,131072 /prefetch:8
                              2⤵
                                PID:2768
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4180 --field-trial-handle=1236,i,17908230913079343417,15417248264660525737,131072 /prefetch:8
                                2⤵
                                  PID:2884
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4116 --field-trial-handle=1236,i,17908230913079343417,15417248264660525737,131072 /prefetch:8
                                  2⤵
                                    PID:2516
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4084 --field-trial-handle=1236,i,17908230913079343417,15417248264660525737,131072 /prefetch:8
                                    2⤵
                                    • Loads dropped DLL
                                    PID:2288
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4124 --field-trial-handle=1236,i,17908230913079343417,15417248264660525737,131072 /prefetch:8
                                    2⤵
                                    • Loads dropped DLL
                                    PID:1172
                                  • C:\Users\Admin\Downloads\Bootstrapper 3.exe
                                    "C:\Users\Admin\Downloads\Bootstrapper 3.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2596
                                    • C:\Windows\system32\WerFault.exe
                                      C:\Windows\system32\WerFault.exe -u -p 2596 -s 976
                                      3⤵
                                      • Loads dropped DLL
                                      PID:1724
                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                  1⤵
                                    PID:3004

                                  Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

                                          Filesize

                                          854B

                                          MD5

                                          e935bc5762068caf3e24a2683b1b8a88

                                          SHA1

                                          82b70eb774c0756837fe8d7acbfeec05ecbf5463

                                          SHA256

                                          a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

                                          SHA512

                                          bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                          Filesize

                                          1KB

                                          MD5

                                          04aa1b25f53682aa1f27b48d0115d3c5

                                          SHA1

                                          20f5ab3031f8d17a834977341eb8d62576286625

                                          SHA256

                                          0630fe3c74cf55473780bdcb0faa1f8c3c1be86375341d2fd143ee8722dcd663

                                          SHA512

                                          7e1da3066e73145782a00fd77f3b6be1c494c7f866785995065348bd6a0cf6e263e2335b723158eeb1edfef3658ab1c980f7a6dd5830055fc37d4a1f72616c2c

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

                                          Filesize

                                          170B

                                          MD5

                                          44cb3e168a31a4aa989a25fd50ae2d7c

                                          SHA1

                                          13916ceed04ba893e55b7672c09788ca6d3a28b5

                                          SHA256

                                          1d29580c50744e2548c792029c0af17e81889ba2f5679382f12b9835a0d7ec0c

                                          SHA512

                                          258dae21de8c8597d90c8c6bb1ff48d2df8ce358f2d06f35759be4e0eb9a566993247384304a4884185d9b2b8f22bf5e63da341e76dfe302724e258a965a8820

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                          Filesize

                                          410B

                                          MD5

                                          e4973c1d19da5e051ced993810ec4ab1

                                          SHA1

                                          11673afbe9a2b996de4795ac11da53e660ab45fa

                                          SHA256

                                          0d9a04838c0c56943ef125422f34bdf8b2b0774fc62007da4cf51732692b5bd0

                                          SHA512

                                          feae66646d33bb3be7a95c2f1422927674e3aece1d609007a80d5da324505bf12e7c513c0f5ef0fe888c43593270362a97513f1c7d924c6258762afb69648e23

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                          Filesize

                                          264KB

                                          MD5

                                          f50f89a0a91564d0b8a211f8921aa7de

                                          SHA1

                                          112403a17dd69d5b9018b8cede023cb3b54eab7d

                                          SHA256

                                          b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                          SHA512

                                          bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                          Filesize

                                          1KB

                                          MD5

                                          6966dfe4baf55f092e1e9db47cd399d4

                                          SHA1

                                          68aba61a342f24ea69587d3d45052a31a02fbb6a

                                          SHA256

                                          331b47fe538e84deddeeeac8c0e267e60fb528823a32adf099e0a46b030d58db

                                          SHA512

                                          8e73db79addf80402b7e3c52bd52c82453cf41ea69e52ce70f2b31a42f45c3a252a083b2ad59255ce7a10b5cdc48cb5e1d9e89b3ac110313f0faeaf0b04cc092

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                          Filesize

                                          1KB

                                          MD5

                                          ef6c7d67008a8ff377696c7aea6581ef

                                          SHA1

                                          eb867fc3f78574caf103a0ff56e80983c2629f3d

                                          SHA256

                                          dd03584e1f5f7855f64de4895b8ee0280a0cd0bda55b794b6f1b1f0e35c9934f

                                          SHA512

                                          d6acc3f6e2b20aa7ec322e5dd922fec98670e1146f8fe39dc3742d153f22aad9dcc257ad104a158d47a2b3888d98f4a1e10c0656c86bdd6c7726284b0e4c3824

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          4KB

                                          MD5

                                          0761d2862b137a678d6a8a9db673e138

                                          SHA1

                                          df5fb0ff21fc8c289ba533f3b4c8f10dc461bc2e

                                          SHA256

                                          530e76d0be66c04ab0fa8453e8808abddd043c5166c9c2dcbcd7118330aac29b

                                          SHA512

                                          7bd6cebeecd55c5f41b1f3f9ff3ec773eba95c52201f645f0ae91ce58dfa578aa44e04a7547794d9975cdaec677111f0aed3e863d5191edde46afa94ddf9df59

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          4KB

                                          MD5

                                          4a63d08970d64e1116f48f9f9f8c03b7

                                          SHA1

                                          46d3a7affef66cac6fb7e7067081d39dd9db32a3

                                          SHA256

                                          0742801439d5d2ffe72326b759e170f9823bde0bef2663b24180865285489edd

                                          SHA512

                                          13ca3fe8cc44222dc780c57098a71bc336db98c9a851293ec1ed005aab74575e932a902d96cca47bfac17a9c7ccd9c55af403dafc01072c49305913b57a69798

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          4KB

                                          MD5

                                          6829f567fc29249f0d305ca6a91096a1

                                          SHA1

                                          89ea569f90c50e07fe2b0840bdbd5787fbc82441

                                          SHA256

                                          378ac81875dd77041e14e887386a41997d3c5c61f2032a9bef7abbd8bfa22691

                                          SHA512

                                          28707f92ce450eaf0824c916b1608192aa2b84761260ec70c25c4e9ca07c7c187fbe2b28c74a8eafb22f43403fbde9a84e7798febf5cf106a8c5ad2942377d56

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

                                          Filesize

                                          16B

                                          MD5

                                          18e723571b00fb1694a3bad6c78e4054

                                          SHA1

                                          afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                          SHA256

                                          8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                          SHA512

                                          43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          331KB

                                          MD5

                                          68116845df6e3ad7119469535a7b6d96

                                          SHA1

                                          9308d7bc61e55bb4f2c8235b2cd7cc95709de49e

                                          SHA256

                                          130103e644946964a4d032322863398fb943914970fa3b7f117783aa1f6ff587

                                          SHA512

                                          8b564c32d4958c8680ff5aac561f105fb43632cbb355db435d9a634701d1f649fc06a22bc9bfeb808b0eb75ad37ab82bd2d8c292cf3b64bd0a8af2d6feeab41d

                                        • C:\Users\Admin\AppData\Local\Temp\CabCF14.tmp

                                          Filesize

                                          70KB

                                          MD5

                                          49aebf8cbd62d92ac215b2923fb1b9f5

                                          SHA1

                                          1723be06719828dda65ad804298d0431f6aff976

                                          SHA256

                                          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                          SHA512

                                          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                        • C:\Users\Admin\AppData\Local\Temp\TarCFB3.tmp

                                          Filesize

                                          181KB

                                          MD5

                                          4ea6026cf93ec6338144661bf1202cd1

                                          SHA1

                                          a1dec9044f750ad887935a01430bf49322fbdcb7

                                          SHA256

                                          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                          SHA512

                                          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                        • C:\Users\Admin\AppData\Local\link.txt

                                          Filesize

                                          57B

                                          MD5

                                          0ed76d0a948f021916b8c255fb16ba99

                                          SHA1

                                          1f3af610b441cb151f89009d4d1343be66c875cd

                                          SHA256

                                          eca0a517e62a864b0e05633b9bf1a14b401e350d3788a17569569b8076ddba99

                                          SHA512

                                          a0259b538e8931ca4505224e5070b30ee202d6529d41a032b2921a26be8868eeb4403d9da582bae9478b53ed7a5e8b4325f681d03a5726b981686b0ffaa46b25

                                        • C:\Users\Admin\Downloads\Bootstrapper 3.exe

                                          Filesize

                                          796KB

                                          MD5

                                          4b94b989b0fe7bec6311153b309dfe81

                                          SHA1

                                          bb50a4bb8a66f0105c5b74f32cd114c672010b22

                                          SHA256

                                          7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659

                                          SHA512

                                          fbbe60cf3e5d028d906e7d444b648f7dff8791c333834db8119e0a950532a75fda2e9bd5948f0b210904667923eb7b2c0176140babc497955d227e7d80fb109d

                                        • memory/2596-326-0x0000000000890000-0x000000000095E000-memory.dmp

                                          Filesize

                                          824KB