8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3

Analysis

max time kernel
364s
max time network
311s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
30-12-2024 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper.exe
Size

800KB
MD5

02c70d9d6696950c198db93b7f6a835e
SHA1

30231a467a49cc37768eea0f55f4bea1cbfb48e2
SHA256

8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
SHA512

431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
SSDEEP

12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2468	BootstrapperV2.08.exe
4460	Solara.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
37	4504	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
9	discord.com
9	pastebin.com
10	discord.com
41	pastebin.com
4	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2100	ipconfig.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E06DA0877BF7D4A4E9CEC9E32741B859\npm	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\ProductName = "Node.js"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\PackageCode = "0120A6FC5971D8146A4C60F9F9CC1DB7"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E06DA0877BF7D4A4E9CEC9E32741B859	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4248760313-3670024077-2384670640-1000\{0D5A6B4C-E651-4B4D-8769-AF12BC2FF069}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E06DA0877BF7D4A4E9CEC9E32741B859\NodeRuntime	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E06DA0877BF7D4A4E9CEC9E32741B859\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E06DA0877BF7D4A4E9CEC9E32741B859\EnvironmentPath	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E06DA0877BF7D4A4E9CEC9E32741B859\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\Version = "369885184"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\ProductIcon = "C:\\Windows\\Installer\\{780AD60E-7FB7-4A4D-9EEC-9C3E72148B95}\\NodeIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\E06DA0877BF7D4A4E9CEC9E32741B859	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E06DA0877BF7D4A4E9CEC9E32741B859\DocumentationShortcuts	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E06DA0877BF7D4A4E9CEC9E32741B859\corepack	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\SourceList\PackageName = "node-v22.12.0-x64.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E06DA0877BF7D4A4E9CEC9E32741B859\Clients = 3a0000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
2224	msedge.exe
2224	msedge.exe
3164	msedge.exe
3164	msedge.exe
3124	msedge.exe
3124	msedge.exe
716	identity_helper.exe
716	identity_helper.exe
4460	Solara.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3124	WMIC.exe
Token: SeSecurityPrivilege	3124	WMIC.exe
Token: SeTakeOwnershipPrivilege	3124	WMIC.exe
Token: SeLoadDriverPrivilege	3124	WMIC.exe
Token: SeSystemProfilePrivilege	3124	WMIC.exe
Token: SeSystemtimePrivilege	3124	WMIC.exe
Token: SeProfSingleProcessPrivilege	3124	WMIC.exe
Token: SeIncBasePriorityPrivilege	3124	WMIC.exe
Token: SeCreatePagefilePrivilege	3124	WMIC.exe
Token: SeBackupPrivilege	3124	WMIC.exe
Token: SeRestorePrivilege	3124	WMIC.exe
Token: SeShutdownPrivilege	3124	WMIC.exe
Token: SeDebugPrivilege	3124	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3124	WMIC.exe
Token: SeRemoteShutdownPrivilege	3124	WMIC.exe
Token: SeUndockPrivilege	3124	WMIC.exe
Token: SeManageVolumePrivilege	3124	WMIC.exe
Token: 33	3124	WMIC.exe
Token: 34	3124	WMIC.exe
Token: 35	3124	WMIC.exe
Token: 36	3124	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3124	WMIC.exe
Token: SeSecurityPrivilege	3124	WMIC.exe
Token: SeTakeOwnershipPrivilege	3124	WMIC.exe
Token: SeLoadDriverPrivilege	3124	WMIC.exe
Token: SeSystemProfilePrivilege	3124	WMIC.exe
Token: SeSystemtimePrivilege	3124	WMIC.exe
Token: SeProfSingleProcessPrivilege	3124	WMIC.exe
Token: SeIncBasePriorityPrivilege	3124	WMIC.exe
Token: SeCreatePagefilePrivilege	3124	WMIC.exe
Token: SeBackupPrivilege	3124	WMIC.exe
Token: SeRestorePrivilege	3124	WMIC.exe
Token: SeShutdownPrivilege	3124	WMIC.exe
Token: SeDebugPrivilege	3124	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3124	WMIC.exe
Token: SeRemoteShutdownPrivilege	3124	WMIC.exe
Token: SeUndockPrivilege	3124	WMIC.exe
Token: SeManageVolumePrivilege	3124	WMIC.exe
Token: 33	3124	WMIC.exe
Token: 34	3124	WMIC.exe
Token: 35	3124	WMIC.exe
Token: 36	3124	WMIC.exe
Token: SeDebugPrivilege	4580	Bootstrapper.exe
Token: SeDebugPrivilege	2468	BootstrapperV2.08.exe
Token: SeShutdownPrivilege	3340	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3340	msiexec.exe
Token: SeCreateTokenPrivilege	3340	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3340	msiexec.exe
Token: SeLockMemoryPrivilege	3340	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3340	msiexec.exe
Token: SeMachineAccountPrivilege	3340	msiexec.exe
Token: SeTcbPrivilege	3340	msiexec.exe
Token: SeSecurityPrivilege	3340	msiexec.exe
Token: SeTakeOwnershipPrivilege	3340	msiexec.exe
Token: SeLoadDriverPrivilege	3340	msiexec.exe
Token: SeSystemProfilePrivilege	3340	msiexec.exe
Token: SeSystemtimePrivilege	3340	msiexec.exe
Token: SeProfSingleProcessPrivilege	3340	msiexec.exe
Token: SeIncBasePriorityPrivilege	3340	msiexec.exe
Token: SeCreatePagefilePrivilege	3340	msiexec.exe
Token: SeCreatePermanentPrivilege	3340	msiexec.exe
Token: SeBackupPrivilege	3340	msiexec.exe
Token: SeRestorePrivilege	3340	msiexec.exe
Token: SeShutdownPrivilege	3340	msiexec.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 3476	4580	Bootstrapper.exe	78
PID 4580 wrote to memory of 3476	4580	Bootstrapper.exe	78
PID 3476 wrote to memory of 2100	3476	cmd.exe	80
PID 3476 wrote to memory of 2100	3476	cmd.exe	80
PID 4580 wrote to memory of 4284	4580	Bootstrapper.exe	81
PID 4580 wrote to memory of 4284	4580	Bootstrapper.exe	81
PID 4284 wrote to memory of 3124	4284	cmd.exe	83
PID 4284 wrote to memory of 3124	4284	cmd.exe	83
PID 4580 wrote to memory of 2468	4580	Bootstrapper.exe	85
PID 4580 wrote to memory of 2468	4580	Bootstrapper.exe	85
PID 2468 wrote to memory of 2224	2468	BootstrapperV2.08.exe	86
PID 2468 wrote to memory of 2224	2468	BootstrapperV2.08.exe	86
PID 2224 wrote to memory of 4672	2224	msedge.exe	87
PID 2224 wrote to memory of 4672	2224	msedge.exe	87
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 400	2224	msedge.exe	88
PID 2224 wrote to memory of 1532	2224	msedge.exe	89
PID 2224 wrote to memory of 1532	2224	msedge.exe	89
PID 2224 wrote to memory of 2264	2224	msedge.exe	90
PID 2224 wrote to memory of 2264	2224	msedge.exe	90
PID 2224 wrote to memory of 2264	2224	msedge.exe	90
PID 2224 wrote to memory of 2264	2224	msedge.exe	90
PID 2224 wrote to memory of 2264	2224	msedge.exe	90
PID 2224 wrote to memory of 2264	2224	msedge.exe	90
PID 2224 wrote to memory of 2264	2224	msedge.exe	90
PID 2224 wrote to memory of 2264	2224	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2100
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3124
- C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.08.exe
  "C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.08.exe" --oldBootstrapper "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe" --isUpdate true
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/invite/8PgspRYAQu
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff842553cb8,0x7ff842553cc8,0x7ff842553cd8
      4⤵
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,8120221192905769816,7569072176604022930,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
      4⤵
      PID:400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,8120221192905769816,7569072176604022930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,8120221192905769816,7569072176604022930,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
      4⤵
      PID:2264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8120221192905769816,7569072176604022930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
      4⤵
      PID:3108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8120221192905769816,7569072176604022930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
      4⤵
      PID:2812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8120221192905769816,7569072176604022930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1904,8120221192905769816,7569072176604022930,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4548 /prefetch:8
      4⤵
      PID:3688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1904,8120221192905769816,7569072176604022930,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4628 /prefetch:8
      4⤵
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,8120221192905769816,7569072176604022930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,8120221192905769816,7569072176604022930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5880 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8120221192905769816,7569072176604022930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
      4⤵
      PID:4020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8120221192905769816,7569072176604022930,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8120221192905769816,7569072176604022930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
      4⤵
      PID:3616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8120221192905769816,7569072176604022930,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
      4⤵
      PID:2868
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C node -v
    3⤵
    PID:4900
- - C:\Windows\SYSTEM32\msiexec.exe
    "msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v22.12.0-x64.msi" /quiet /norestart
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3340
- - C:\ProgramData\Solara\Solara.exe
    "C:\ProgramData\Solara\Solara.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4504
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding C4C35D6010AFDFBC9D99ED636908EB5C
  2⤵
  PID:2800
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A16CEF2431109A90A29FF7BB8FCF90BD E Global\MSI0000
  2⤵
  PID:5072
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0B86DCCE7C16DC396FC4AD6CCD3B88CC
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4668

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

Filesize
168B

MD5
d6379e007090480d77959aec07b6417e

SHA1
98eecef8fe63445674124fd32598555c70824080

SHA256
4ca85bbe1d76aa3ac41fd9c939ed731dbee8db9ead4e48d42c0350a0e843ee1f

SHA512
e0f5d61dbbc96801ecfcec709a44c6a231b3358266688be684b883e9114c32301783796a2df26f4cc81a420bd36f365bddc0df7cdc27011b85c21a1a32e10d0a

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

Filesize
133B

MD5
35b86e177ab52108bd9fed7425a9e34a

SHA1
76a1f47a10e3ab829f676838147875d75022c70c

SHA256
afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

SHA512
3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

Download Submit
C:\ProgramData\Solara\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\ProgramData\Solara\Solara.exe

Filesize
133KB

MD5
c6f770cbb24248537558c1f06f7ff855

SHA1
fdc2aaae292c32a58ea4d9974a31ece26628fdd7

SHA256
d1e4a542fa75f6a6fb636b5de6f7616e2827a79556d3d9a4afc3ecb47f0beb2b

SHA512
cac56c58bd01341ec3ff102fe04fdb66625baad1d3dd7127907cd8453d2c6e2226ad41033e16ba20413a509fc7c826e4fdc0c0d553175eb6f164c2fc0906614a

Download Submit
C:\ProgramData\Solara\Wpf.Ui.dll

Filesize
5.2MB

MD5
aead90ab96e2853f59be27c4ec1e4853

SHA1
43cdedde26488d3209e17efff9a51e1f944eb35f

SHA256
46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

SHA512
f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7bed1eca5620a49f52232fd55246d09a

SHA1
e429d9d401099a1917a6fb31ab2cf65fcee22030

SHA256
49c484f08c5e22ee6bec6d23681b26b0426ee37b54020f823a2908ab7d0d805e

SHA512
afc8f0b5b95d593f863ad32186d1af4ca333710bcfba86416800e79528616e7b15f8813a20c2cfa9d13688c151bf8c85db454a9eb5c956d6e49db84b4b222ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5431d6602455a6db6e087223dd47f600

SHA1
27255756dfecd4e0afe4f1185e7708a3d07dea6e

SHA256
7502d9453168c86631fb40ec90567bf80404615d387afc7ec2beb7a075bcc763

SHA512
868f6dcf32ef80459f3ea122b0d2c79191193b5885c86934a97bfec7e64250e10c23e4d00f34c6c2387a04a15f3f266af96e571bbe37077fb374d6d30f35b829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
f53cf287cc608c68a2ad054000d31d9f

SHA1
ccb0d6951b41ce41eb91f622336decc3e1e41dd5

SHA256
0e978c886cecf3a8a2b8dae337b1cb7a3e2dbda887537869c18bdce5ea2d9b05

SHA512
54dddd4f96e41a82389ae033be08b2c6ababede44cd84d8ca4361bb9ee4c34b6f29306616a89faf272b8ee80a801316838fd17617029ce2662811acff12eabfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
255B

MD5
ff9f825925f89085b6c4809612c14b39

SHA1
3cd291d4b9d7bfff93177f074aa75d7034ce0d4e

SHA256
118d159f05b7fb0b7424c2374470d9e77857047f4a0663e944e2363ecf04b0fa

SHA512
735ec4fd0c01534dd09a61b341ed00a0bbb7488c1e267d736041d96e0f6a62c8b4090ded41986464cf82b472831c6d10f9fbf688e20340f6c293ba5332e05d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
54c89b3279aed737e792b9b6b953236e

SHA1
ebcebac1ba5a06ee891e027fe87eb1ac19a226ea

SHA256
41d787421fad54673dc44b598edf2c693097ba046eb5ae6508fa1abe2b1f0825

SHA512
06c80f85a48a2cb6aff491ae17ee5d4924847c9f1c4abfe5c4ac73ba84177ad59ca09961d5e9ded32c371ccbddc2f7c62b7f745bd85b8f55d0a4b003edc8464f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fcf6ad1a2707916686cc865d132c3980

SHA1
78ae94690ed3abb2240ac4db349dcaee6806a508

SHA256
42c64488562096dc113dbad81b991de320102799d67bd06f66cf25b4f45eaf56

SHA512
7e23ee568a2ff5009db1a26ed48c0ed3c448bfba733b5e18d329c61f65c359fc7e3eb2363b2aa8a96a43709eebeabfbd10f48edc91c8965f98a433fb88554fe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
65276a6807a94cb6bcd564f191a6c5d3

SHA1
71ee9e43ffb1df560ea90529ba731612872bf584

SHA256
5aed106b6c05efe9b4b628c2e58fe915626b40cc8e8b9081d797ca0f176e5124

SHA512
55584708c0f3f9c138464a6d63380ed20e8d7d177bf65c1758e5653397a4dc544b6ccb0bef22a4d0e383dca4118c168bac48b7bb31649b69012b62cd40efa7e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f54113e4173376f049deb9e45cc20d03

SHA1
7221c743fc025d6194af960493a6575c2c1ea7c4

SHA256
d959e95e0b01bfc80cf7bb4dcadff5c738079696c822843d3d9d5a001df382e3

SHA512
e53ffc741cf700a60f9b6de3344488fde078d8272406cbc5f557c402de9eab221e7fd8bf7eb0bb4260ce1fea43cc34016bc2c12ea1af32b84daebcdd3471eee0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8fabd2a5bdd1cd45f2e2773c060afe5e

SHA1
6a3906834905c90980eb695807f282ad2a8c2099

SHA256
1d166f37651fb5445c76d92c433977cac6cae8bdec4c0c59b8c58a827b58056d

SHA512
384f13df2567f21dfdc51423b1a093897fdeadc70cd7cce4c7c493d69a87f3637e105cc627743aff1e2c0353135a738f6bc637b3c67f8ac892794adbaf674af7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1f46b7e81d442c9100cb29445b5289bc

SHA1
73f099902dc87f22801a223192aa419e5d828178

SHA256
9ed316235ec210f0f14d47b9e3b6dc8fa77a55e9f11c45011b61c32448a8d7c8

SHA512
81866aa505b54c2e979e26646817b49dad8cdc06c76000acc07c1248dffdc5cc761db3f1f5c2e6d3c7238dd1316eded61094961a09b53513aee25ca104307a31

Download Submit
C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.08.exe

Filesize
2.9MB

MD5
3f960b403cd616c9f59b3c22fc69aeca

SHA1
c9878d8dd7cada17525d0fb41626ef10387cb624

SHA256
8d0e9176ab99c1c4442f8529a5e06a84cf4573b79d21c15022f825ad9c36c84a

SHA512
bd48219ce56276114a411d4a3b19ff723cf20fe75571faebd43c2567b2a6cc73b77ffe5858ac5f80cec32d79ae3df84ebfc42b80b38af14691727f2c08399761

Download Submit
C:\Users\Admin\AppData\Local\Temp\node-v22.12.0-x64.msi

Filesize
29.4MB

MD5
106167d55e0bbfc7e2428f9aac1ef688

SHA1
b5c9f1b0cba46c3cdd3cd2e44c0404aa6aebe084

SHA256
5fa43604523be95f8e73c4c98337a5c2bf02450a6525ad25ec2926e464e6bcef

SHA512
064826799079725655b93abd7a3f5cf0e47c673e5f5b1b1951b2cadb8e3723bd80943e58c4d87ec0888c5f443d0093c8a39f09e21b3e7550928b1904b1181ba4

Download Submit
memory/2468-26-0x0000012737110000-0x0000012737136000-memory.dmp

Filesize
152KB

Download
memory/2468-364-0x000001277ED40000-0x000001277EDF2000-memory.dmp

Filesize
712KB

Download
memory/2468-25-0x00000127370C0000-0x00000127370CA000-memory.dmp

Filesize
40KB

Download
memory/2468-28-0x0000012737860000-0x0000012737876000-memory.dmp

Filesize
88KB

Download
memory/2468-24-0x0000012737760000-0x0000012737860000-memory.dmp

Filesize
1024KB

Download
memory/2468-23-0x00000127370A0000-0x00000127370AE000-memory.dmp

Filesize
56KB

Download
memory/2468-22-0x00000127370D0000-0x0000012737108000-memory.dmp

Filesize
224KB

Download
memory/2468-21-0x0000012737050000-0x0000012737058000-memory.dmp

Filesize
32KB

Download
memory/2468-27-0x0000012737150000-0x0000012737158000-memory.dmp

Filesize
32KB

Download
memory/2468-20-0x000001271A880000-0x000001271A890000-memory.dmp

Filesize
64KB

Download
memory/2468-31-0x0000012737890000-0x0000012737898000-memory.dmp

Filesize
32KB

Download
memory/2468-369-0x0000012774AE0000-0x0000012774AF2000-memory.dmp

Filesize
72KB

Download
memory/2468-18-0x00000127186E0000-0x00000127189C2000-memory.dmp

Filesize
2.9MB

Download
memory/2468-30-0x00000127370B0000-0x00000127370BA000-memory.dmp

Filesize
40KB

Download
memory/2468-29-0x0000012737140000-0x000001273714A000-memory.dmp

Filesize
40KB

Download
memory/2468-367-0x0000012774860000-0x000001277486A000-memory.dmp

Filesize
40KB

Download
memory/2468-366-0x0000012774840000-0x000001277485E000-memory.dmp

Filesize
120KB

Download
memory/4460-785-0x0000020CE76B0000-0x0000020CE76D4000-memory.dmp

Filesize
144KB

Download
memory/4460-788-0x0000020CE9E80000-0x0000020CE9F3A000-memory.dmp

Filesize
744KB

Download
memory/4460-790-0x0000020CE9FC0000-0x0000020CEA072000-memory.dmp

Filesize
712KB

Download
memory/4460-787-0x0000020CEA500000-0x0000020CEAA3C000-memory.dmp

Filesize
5.2MB

Download
memory/4580-0-0x00007FF834CF3000-0x00007FF834CF5000-memory.dmp

Filesize
8KB

Download
memory/4580-2-0x00007FF834CF0000-0x00007FF8357B2000-memory.dmp

Filesize
10.8MB

Download
memory/4580-4-0x00007FF834CF3000-0x00007FF834CF5000-memory.dmp

Filesize
8KB

Download
memory/4580-5-0x000001C5DEB20000-0x000001C5DEB42000-memory.dmp

Filesize
136KB

Download
memory/4580-1-0x000001C5C23C0000-0x000001C5C248E000-memory.dmp

Filesize
824KB

Download
memory/4580-19-0x00007FF834CF0000-0x00007FF8357B2000-memory.dmp

Filesize
10.8MB

Download