Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
46s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02/01/2025, 08:08
Static task
static1
General
-
Target
Bootstrapper.exe
-
Size
800KB
-
MD5
02c70d9d6696950c198db93b7f6a835e
-
SHA1
30231a467a49cc37768eea0f55f4bea1cbfb48e2
-
SHA256
8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
-
SHA512
431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
-
SSDEEP
12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Solara.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Solara.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Solara.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Bootstrapper.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation BootstrapperV2.11.exe -
Executes dropped EXE 2 IoCs
pid Process 2948 BootstrapperV2.11.exe 456 Solara.exe -
Loads dropped DLL 2 IoCs
pid Process 456 Solara.exe 456 Solara.exe -
resource yara_rule behavioral1/files/0x0007000000023e20-270.dat themida behavioral1/memory/456-273-0x0000000180000000-0x000000018108B000-memory.dmp themida behavioral1/memory/456-276-0x0000000180000000-0x000000018108B000-memory.dmp themida behavioral1/memory/456-275-0x0000000180000000-0x000000018108B000-memory.dmp themida behavioral1/memory/456-274-0x0000000180000000-0x000000018108B000-memory.dmp themida behavioral1/memory/456-402-0x0000000180000000-0x000000018108B000-memory.dmp themida -
Unexpected DNS network traffic destination 15 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Solara.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 35 discord.com 70 pastebin.com 71 pastebin.com 33 discord.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 456 Solara.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 4564 ipconfig.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4050598569-1597076380-177084960-1000\{FD4E2E4D-AC49-4C19-ACBA-94A57C6E8586} msedge.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 2948 BootstrapperV2.11.exe 1644 msedge.exe 1644 msedge.exe 2516 msedge.exe 2516 msedge.exe 4564 msedge.exe 4564 msedge.exe 1348 identity_helper.exe 1348 identity_helper.exe 456 Solara.exe 456 Solara.exe 456 Solara.exe 456 Solara.exe 456 Solara.exe 456 Solara.exe 456 Solara.exe 456 Solara.exe 456 Solara.exe 456 Solara.exe 456 Solara.exe 456 Solara.exe 456 Solara.exe 456 Solara.exe 456 Solara.exe 456 Solara.exe 456 Solara.exe 456 Solara.exe 456 Solara.exe 456 Solara.exe 456 Solara.exe 456 Solara.exe 456 Solara.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1588 WMIC.exe Token: SeSecurityPrivilege 1588 WMIC.exe Token: SeTakeOwnershipPrivilege 1588 WMIC.exe Token: SeLoadDriverPrivilege 1588 WMIC.exe Token: SeSystemProfilePrivilege 1588 WMIC.exe Token: SeSystemtimePrivilege 1588 WMIC.exe Token: SeProfSingleProcessPrivilege 1588 WMIC.exe Token: SeIncBasePriorityPrivilege 1588 WMIC.exe Token: SeCreatePagefilePrivilege 1588 WMIC.exe Token: SeBackupPrivilege 1588 WMIC.exe Token: SeRestorePrivilege 1588 WMIC.exe Token: SeShutdownPrivilege 1588 WMIC.exe Token: SeDebugPrivilege 1588 WMIC.exe Token: SeSystemEnvironmentPrivilege 1588 WMIC.exe Token: SeRemoteShutdownPrivilege 1588 WMIC.exe Token: SeUndockPrivilege 1588 WMIC.exe Token: SeManageVolumePrivilege 1588 WMIC.exe Token: 33 1588 WMIC.exe Token: 34 1588 WMIC.exe Token: 35 1588 WMIC.exe Token: 36 1588 WMIC.exe Token: SeIncreaseQuotaPrivilege 1588 WMIC.exe Token: SeSecurityPrivilege 1588 WMIC.exe Token: SeTakeOwnershipPrivilege 1588 WMIC.exe Token: SeLoadDriverPrivilege 1588 WMIC.exe Token: SeSystemProfilePrivilege 1588 WMIC.exe Token: SeSystemtimePrivilege 1588 WMIC.exe Token: SeProfSingleProcessPrivilege 1588 WMIC.exe Token: SeIncBasePriorityPrivilege 1588 WMIC.exe Token: SeCreatePagefilePrivilege 1588 WMIC.exe Token: SeBackupPrivilege 1588 WMIC.exe Token: SeRestorePrivilege 1588 WMIC.exe Token: SeShutdownPrivilege 1588 WMIC.exe Token: SeDebugPrivilege 1588 WMIC.exe Token: SeSystemEnvironmentPrivilege 1588 WMIC.exe Token: SeRemoteShutdownPrivilege 1588 WMIC.exe Token: SeUndockPrivilege 1588 WMIC.exe Token: SeManageVolumePrivilege 1588 WMIC.exe Token: 33 1588 WMIC.exe Token: 34 1588 WMIC.exe Token: 35 1588 WMIC.exe Token: 36 1588 WMIC.exe Token: SeDebugPrivilege 4056 Bootstrapper.exe Token: SeDebugPrivilege 2948 BootstrapperV2.11.exe Token: SeDebugPrivilege 456 Solara.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4056 wrote to memory of 1688 4056 Bootstrapper.exe 83 PID 4056 wrote to memory of 1688 4056 Bootstrapper.exe 83 PID 1688 wrote to memory of 4564 1688 cmd.exe 85 PID 1688 wrote to memory of 4564 1688 cmd.exe 85 PID 4056 wrote to memory of 4288 4056 Bootstrapper.exe 87 PID 4056 wrote to memory of 4288 4056 Bootstrapper.exe 87 PID 4288 wrote to memory of 1588 4288 cmd.exe 89 PID 4288 wrote to memory of 1588 4288 cmd.exe 89 PID 4056 wrote to memory of 2948 4056 Bootstrapper.exe 94 PID 4056 wrote to memory of 2948 4056 Bootstrapper.exe 94 PID 2948 wrote to memory of 2516 2948 BootstrapperV2.11.exe 96 PID 2948 wrote to memory of 2516 2948 BootstrapperV2.11.exe 96 PID 2516 wrote to memory of 3304 2516 msedge.exe 97 PID 2516 wrote to memory of 3304 2516 msedge.exe 97 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 3212 2516 msedge.exe 98 PID 2516 wrote to memory of 1644 2516 msedge.exe 99 PID 2516 wrote to memory of 1644 2516 msedge.exe 99 PID 2516 wrote to memory of 4516 2516 msedge.exe 100 PID 2516 wrote to memory of 4516 2516 msedge.exe 100 PID 2516 wrote to memory of 4516 2516 msedge.exe 100 PID 2516 wrote to memory of 4516 2516 msedge.exe 100 PID 2516 wrote to memory of 4516 2516 msedge.exe 100 PID 2516 wrote to memory of 4516 2516 msedge.exe 100 PID 2516 wrote to memory of 4516 2516 msedge.exe 100 PID 2516 wrote to memory of 4516 2516 msedge.exe 100 -
cURL User-Agent 6 IoCs
Uses User-Agent string associated with cURL utility.
description flow ioc HTTP User-Agent header 81 curl/8.9.1-DEV HTTP User-Agent header 84 curl/8.9.1-DEV HTTP User-Agent header 86 curl/8.9.1-DEV HTTP User-Agent header 87 curl/8.9.1-DEV HTTP User-Agent header 88 curl/8.9.1-DEV HTTP User-Agent header 89 curl/8.9.1-DEV
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SYSTEM32\cmd.exe"cmd" /c ipconfig /all2⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:4564
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")2⤵
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\System32\Wbem\WMIC.exewmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1588
-
-
-
C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.11.exe"C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.11.exe" --oldBootstrapper "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe" --isUpdate true2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/invite/8PgspRYAQu3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffda9d46f8,0x7fffda9d4708,0x7fffda9d47184⤵PID:3304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:24⤵PID:3212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:1644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:84⤵PID:4516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:14⤵PID:900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:14⤵PID:1204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:14⤵PID:1076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5148 /prefetch:84⤵PID:2728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4552 /prefetch:84⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 /prefetch:84⤵PID:1384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:1348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:14⤵PID:1028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:14⤵PID:4608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:14⤵PID:4564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2032067729074766188,8799136496442277207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:14⤵PID:5100
-
-
-
C:\ProgramData\Solara\Solara.exe"C:\ProgramData\Solara\Solara.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:456
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4360
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
557KB
MD5b037ca44fd19b8eedb6d5b9de3e48469
SHA11f328389c62cf673b3de97e1869c139d2543494e
SHA25611e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197
SHA512fa89ab3347fd57486cf3064ad164574f70e2c2b77c382785479bfd5ab50caa0881de3c2763a0932feac2faaf09479ef699a04ba202866dc7e92640246ba9598b
-
Filesize
50KB
MD5e107c88a6fc54cc3ceb4d85768374074
SHA1a8d89ae75880f4fca7d7167fae23ac0d95e3d5f6
SHA2568f821f0c818f8d817b82f76c25f90fde9fb73ff1ae99c3df3eaf2b955653c9c8
SHA512b39e07b0c614a0fa88afb1f3b0d9bb9ba9c932e2b30899002008220ccf1acb0f018d5414aee64d92222c2c39f3ffe2c0ad2d9962d23aaa4bf5750c12c7f3e6fe
-
Filesize
14KB
MD5fd98223d3a143a6a21aa648a38284761
SHA10ebe2f8e3f32757cb3acffef995232548952fa2d
SHA256e47ade9b6b7c60e2eaffaf4429683adc0a10e2c9cca3752583f672df40e0bd99
SHA512a4100bcc20dd8fd45bb853cbafc7bb1ce2a88c9809de7d67c6617d8b2dc01e2cba8170a8e1ac2716018f4796ee767a574853d52a557053a771add013f48990da
-
Filesize
14KB
MD5610eb8cecd447fcf97c242720d32b6bd
SHA14b094388e0e5135e29c49ce42ff2aa099b7f2d43
SHA256107d8d9d6c94d2a86ac5af4b4cec43d959c2e44d445017fea59e2e0a5efafdc7
SHA512cf15f49ef3ae578a5f725e24bdde86c33bbc4fd30a6eb885729fd3d9b151a4b13822fa8c35d3e0345ec43d567a246111764812596fd0ecc36582b8ee2a76c331
-
Filesize
695KB
MD5195ffb7167db3219b217c4fd439eedd6
SHA11e76e6099570ede620b76ed47cf8d03a936d49f8
SHA256e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
SHA51256eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
-
Filesize
613KB
MD5efa26a96b7af259f6682bc888a8b6a14
SHA19800a30228504c30e7d8aea873ded6a7d7d133bb
SHA25618f4dca864799d7cd00a26ae9fb7eccf5c7cf3883c51a5d0744fd92a60ca1953
SHA5127ca4539ab544aee162c7d74ac94b290b409944dd746286e35c8a2712db045d255b9907d1ebea6377d1406ddd87f118666121d0ec1abe0e9415de1bba6799f76e
-
Filesize
6.4MB
MD5ea941865c88edbc63d9f8e7f690cf03a
SHA1c3c2a6ab54b6ed8023fa492afa744ac15ae1f239
SHA2569d017e4532eb760a48aaf663fc70c732f06839a027c47b447f804fcb424e59bf
SHA5127383dcc92a9c8d469ed4c0d05240667d139c5b502ea80da521ed3750301fd0f805e38ba2df28e1dd45e359c7975314a5f99f17de69113e3ae34d9041ebbf07a7
-
Filesize
133KB
MD5a0bd0d1a66e7c7f1d97aedecdafb933f
SHA1dd109ac34beb8289030e4ec0a026297b793f64a3
SHA25679d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36
SHA5122a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50
-
Filesize
5.2MB
MD5aead90ab96e2853f59be27c4ec1e4853
SHA143cdedde26488d3209e17efff9a51e1f944eb35f
SHA25646cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed
SHA512f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d
-
Filesize
10KB
MD5c1cf9d93cb1e8978a0111aaffb5f3eea
SHA1c82955e1fccb9edb7188468d80dcf3f0f54ec31f
SHA256dcd9bfcb0f30c51f6cd667c3b0b3482df12f6a77cb2fbde432fea2810833efa7
SHA512e91f216cd065c6c1eecfea19502f4e7a5246e4e09e2cb19bfc309a0b723dfdae7f33acbb1d85bd2308b77421e681aada8df839b55e1b311565e74f30bb65a2b0
-
Filesize
152B
MD5e443ee4336fcf13c698b8ab5f3c173d0
SHA19bf70b16f03820cbe3158e1f1396b07b8ac9d75a
SHA25679e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b
SHA512cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd
-
Filesize
152B
MD556a4f78e21616a6e19da57228569489b
SHA121bfabbfc294d5f2aa1da825c5590d760483bc76
SHA256d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb
SHA512c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize576B
MD55da48a4ca490e23c4c64432459720b4c
SHA13c44fcd398d3e68574cbd52d75d93f38977f1b28
SHA25622234b4c55687fc246cadeba4c398ef072c9b552d765770ae06444be28c5a693
SHA512eb5ef243f1d8064e5362d5ac14fff0e0744b5631f64152668d9d211d0dc45fb2985f0dfc22f08d959a3c1e1c56e3bdeeffe451c2ec32be619735d7a46ba6483c
-
Filesize
255B
MD5ff9f825925f89085b6c4809612c14b39
SHA13cd291d4b9d7bfff93177f074aa75d7034ce0d4e
SHA256118d159f05b7fb0b7424c2374470d9e77857047f4a0663e944e2363ecf04b0fa
SHA512735ec4fd0c01534dd09a61b341ed00a0bbb7488c1e267d736041d96e0f6a62c8b4090ded41986464cf82b472831c6d10f9fbf688e20340f6c293ba5332e05d58
-
Filesize
5KB
MD51c40a849d9e2b1ddb64e086fffd9d970
SHA17e9aa32595750e09a236b2209c42ec909eb4ec49
SHA25636c78bdb7366aa9d2b2d94c6a5aa18238908e19f7f22ef6240ea4b080ab0ba02
SHA5121a19f08edfccb67812991876f319be313594175e660297485a414abf119c4ba65abf99814f3e7071d61fad2e9df2bbd7de76ffc4ff48a3babf3de437d560d1cc
-
Filesize
6KB
MD57b0529a0b1972f999d35af47162499fe
SHA1ea08e24dec525b0d6ebc28dd27c7d07295b4ddc2
SHA256abb143ff68f499293c418928a444bd570d3ed6d5b5cdd171a44669717bef73e7
SHA51277da25c58afe997a4af5ef869febf8f7e1e490ca45193b727e5059094e027d776c7a42429dc05b8b212e324b0a2d5b4d5b5fc7181c625efa5860c10bcec744b4
-
Filesize
6KB
MD5f4d1f1dd815e3996d77db8d02133cc61
SHA199745dc056cce17b9a9c18cbc502e21f4d55a483
SHA2564fbd15cba7b2fefe8120af1e831c3c67ae447b69fbddc825ac68bd4b1d34726a
SHA5124cca841924dbfa2f92f1e2e61b9ed85cc2cd47a55e80b8a04fe6f4d97a7f73416d468e01a9671429b781a108c3fa18bd4dcfb12c9aecece411a426c205580bd7
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD55cdc67519c9ba2c556e034eed245dff1
SHA159953b041f1d895e099cc17ff614ccf89ecb66b9
SHA2563113ae63cbca07aa0e462820d913e7243b69f4056cf78064441ed7795885a38a
SHA51227f336122ee08a6a0d03cccb7562b9c0ebdd90ba524517d3f7a77be102999dbfe407efb99ce0646047f87e21d5cb943bfba2b97a3b998a99bfef491646631e47
-
Filesize
2.9MB
MD56ba3f4d057686fee3f1f792df10d5869
SHA1ade4a1ada7886ca1bd4c8d7d1d3cba62f9e018a1
SHA2561aeba3aa813d2a63819a2051ff3a657cea022d4df5e6a6f88abe947d1db00177
SHA51279e93fba04fbdcad41b2b45462ee4994e08d8a63eee9fad2713a2b886d8fb4f697c489150466c883c3b0e039b4922b709fd1dbd4bc882cb16b9d9efc139a2285