Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28/01/2025, 16:15 UTC
General
-
Target
Bootstrapper.exe
-
Size
800KB
-
MD5
02c70d9d6696950c198db93b7f6a835e
-
SHA1
30231a467a49cc37768eea0f55f4bea1cbfb48e2
-
SHA256
8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
-
SHA512
431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
-
SSDEEP
12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 44 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c ipconfig /all2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.18.exe"C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.18.exe" --oldBootstrapper "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe" --isUpdate true2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
-
DNS133.211.185.52.in-addr.arpaRemote address:8.8.8.8:53Request133.211.185.52.in-addr.arpaIN PTRResponse -
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
DNS13.153.16.2.in-addr.arpaRemote address:8.8.8.8:53Request13.153.16.2.in-addr.arpaIN PTRResponse13.153.16.2.in-addr.arpaIN PTRa2-16-153-13deploystaticakamaitechnologiescom
-
DNS167.173.78.104.in-addr.arpaRemote address:8.8.8.8:53Request167.173.78.104.in-addr.arpaIN PTRResponse167.173.78.104.in-addr.arpaIN PTRa104-78-173-167deploystaticakamaitechnologiescom
-
DNS4.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request4.159.190.20.in-addr.arpaIN PTRResponse
-
DNSgetsolara.devRemote address:1.1.1.1:53Requestgetsolara.devIN AResponsegetsolara.devIN A172.67.203.125getsolara.devIN A104.21.93.27 -
GEThttps://getsolara.dev/asset/discord.jsonRemote address:172.67.203.125:443RequestGET /asset/discord.json HTTP/1.1
Host: getsolara.dev
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Date: Tue, 28 Jan 2025 16:16:15 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=0, must-revalidate
ETag: W/"fc6947083d8e1302fbe09d3898ba6361"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kLDQkDGaqht8%2FO%2BwvfRZKq6gpTUYirM6Fy89eIYDCRCEa0YiQADVtjmlbnodbNbJDvfzEvY%2BRsXX7BZlCNwOlgMrTV0yGaL7qkNdc4alcVP%2FtYNJ4cH2iFHOxU5NBNDg"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
cf-cache-status: DYNAMIC
Strict-Transport-Security: max-age=0
Server: cloudflare
CF-RAY: 909249302bb86525-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=28130&min_rtt=26573&rtt_var=7929&sent=6&recv=6&lost=0&retrans=0&sent_bytes=2975&recv_bytes=378&delivery_rate=137001&cwnd=253&unsent_bytes=0&cid=b0c7caced8f87651&ts=114&x=0"
-
GEThttps://getsolara.dev/api/endpoint.jsonRemote address:172.67.203.125:443RequestGET /api/endpoint.json HTTP/1.1
Host: getsolara.dev
ResponseHTTP/1.1 200 OK
Date: Tue, 28 Jan 2025 16:16:17 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=0, must-revalidate
ETag: W/"8c459db729c1035143f867d3805c8d99"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8LIIpa%2FeRZ%2FPoNlkOUUxoK0yBM3Z1ThvrwzO9%2FjNRL8fypNstvYm%2FMs8KYC%2B1%2FSAGaIZdM3k4PhRaWB7L%2BrLYak%2FkgIiIE5HF5zISW1TIKAwZhKImxCL8GW660K4yLNs"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
cf-cache-status: DYNAMIC
Strict-Transport-Security: max-age=0
Server: cloudflare
CF-RAY: 9092493d7c1e6525-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=27939&min_rtt=26529&rtt_var=6328&sent=9&recv=8&lost=0&retrans=0&sent_bytes=4196&recv_bytes=463&delivery_rate=137001&cwnd=255&unsent_bytes=0&cid=b0c7caced8f87651&ts=2233&x=0"
-
DNS125.203.67.172.in-addr.arpaRemote address:1.1.1.1:53Request125.203.67.172.in-addr.arpaIN PTRResponse
-
DNSb44d28a3.solaraweb-alj.pages.devRemote address:1.1.1.1:53Requestb44d28a3.solaraweb-alj.pages.devIN AResponseb44d28a3.solaraweb-alj.pages.devIN A172.66.47.197b44d28a3.solaraweb-alj.pages.devIN A172.66.44.59
-
GEThttps://b44d28a3.solaraweb-alj.pages.dev/download/static/files/BootstrapperNew.exeRemote address:172.66.47.197:443RequestGET /download/static/files/BootstrapperNew.exe HTTP/1.1
Host: b44d28a3.solaraweb-alj.pages.dev
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Date: Tue, 28 Jan 2025 16:16:18 GMT
Content-Type: application/octet-stream
Content-Length: 3004416
Connection: keep-alive
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=0, must-revalidate
ETag: "8e709e57be966fad0b70aa9dcf62441e"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
x-robots-tag: noindex
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i9K5Ve%2F66osLXINC89MSCLAH%2B2qINbjmu4OyMJmGp8ejftB1Tk8Zx63eNkefo8Rk14ZG8y9ILN6LcJxUsuAmyt%2F9hwdoFAhyEqFHhJkr0YJtqz9CriT1OQO9EpxzuCVxYW6S87u8l%2FAjbFAVvZGkfLMMlA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 90924942780e63e4-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=26913&min_rtt=26186&rtt_var=6440&sent=6&recv=6&lost=0&retrans=0&sent_bytes=3021&recv_bytes=439&delivery_rate=134926&cwnd=232&unsent_bytes=0&cid=2c057f3cd5a52254&ts=121&x=0"
-
DNS197.47.66.172.in-addr.arpaRemote address:1.1.1.1:53Request197.47.66.172.in-addr.arpaIN PTRResponse
-
DNS241.150.49.20.in-addr.arpaRemote address:1.1.1.1:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
DNS53.210.109.20.in-addr.arpaRemote address:1.1.1.1:53Request53.210.109.20.in-addr.arpaIN PTRResponse
-
DNS206.23.85.13.in-addr.arpaRemote address:1.1.1.1:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
DNS167.190.18.2.in-addr.arpaRemote address:1.1.1.1:53Request167.190.18.2.in-addr.arpaIN PTRResponse167.190.18.2.in-addr.arpaIN PTRa2-18-190-167deploystaticakamaitechnologiescom
-
DNS21.49.80.91.in-addr.arpaRemote address:1.1.1.1:53Request21.49.80.91.in-addr.arpaIN PTRResponse
-
DNS172.210.232.199.in-addr.arpaRemote address:1.1.1.1:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
172.67.203.125:443https://getsolara.dev/api/endpoint.jsontls, http
HTTP Request
GET https://getsolara.dev/asset/discord.jsonHTTP Response
200HTTP Request
GET https://getsolara.dev/api/endpoint.jsonHTTP Response
200 -
127.0.0.1:6463 -
172.66.47.197:443https://b44d28a3.solaraweb-alj.pages.dev/download/static/files/BootstrapperNew.exetls, http
HTTP Request
GET https://b44d28a3.solaraweb-alj.pages.dev/download/static/files/BootstrapperNew.exeHTTP Response
200
-
8.8.8.8:53133.211.185.52.in-addr.arpadns
DNS Request
133.211.185.52.in-addr.arpa
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
-
8.8.8.8:5313.153.16.2.in-addr.arpadns
DNS Request
13.153.16.2.in-addr.arpa
-
8.8.8.8:53167.173.78.104.in-addr.arpadns
DNS Request
167.173.78.104.in-addr.arpa
-
8.8.8.8:534.159.190.20.in-addr.arpadns
DNS Request
4.159.190.20.in-addr.arpa
-
224.0.0.251:5353
-
1.1.1.1:53getsolara.devdns
DNS Request
getsolara.dev
DNS Response
172.67.203.125104.21.93.27
-
1.1.1.1:53125.203.67.172.in-addr.arpadns
DNS Request
125.203.67.172.in-addr.arpa
-
1.1.1.1:53b44d28a3.solaraweb-alj.pages.devdns
DNS Request
b44d28a3.solaraweb-alj.pages.dev
DNS Response
172.66.47.197172.66.44.59
-
1.1.1.1:53197.47.66.172.in-addr.arpadns
DNS Request
197.47.66.172.in-addr.arpa
-
1.1.1.1:53241.150.49.20.in-addr.arpadns
DNS Request
241.150.49.20.in-addr.arpa
-
1.1.1.1:5353.210.109.20.in-addr.arpadns
DNS Request
53.210.109.20.in-addr.arpa
-
1.1.1.1:53206.23.85.13.in-addr.arpadns
DNS Request
206.23.85.13.in-addr.arpa
-
1.1.1.1:53167.190.18.2.in-addr.arpadns
DNS Request
167.190.18.2.in-addr.arpa
-
1.1.1.1:5321.49.80.91.in-addr.arpadns
DNS Request
21.49.80.91.in-addr.arpa
-
1.1.1.1:53172.210.232.199.in-addr.arpadns
DNS Request
172.210.232.199.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD54d207914ab7b161d4a8e6bf45cd27de4
SHA1accd340b49754a770fd8debc10a379fe587336f6
SHA2563c4dcf944e748c91df983422349e3a10f8271d3ef77ceee73d071b3d5e764f1b
SHA5127df470c7c3b1f695289202363826d86af5e878138aa7c50a5d678df1ee95c0e9e2e87dc913be007e212519b05ab56146766768fbe00c583f5b57b905fbbf3f19
-
Filesize
8KB
-
Filesize
824KB
-
Filesize
10.8MB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
2.9MB
-
Filesize
224KB
-
Filesize
56KB
-
Filesize
1024KB
-
Filesize
40KB
-
Filesize
152KB
-
Filesize
32KB
-
Filesize
88KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
32KB