14cf7648123e018dcdfc2aa386135a0510a9f7b12b8bc125ad4e32fd7f16999c | Triage

Resubmissions

01-07-2024 16:01

240701-tf782ssbqj 3

01-07-2024 05:48

240701-ghphhaxfmh 10

Analysis

max time kernel
38s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 16:01

Sharing

Report Analysis Logs

General

Target

SolaraBootstrapper.exe
Size

13KB
MD5

8be476fb431fcf11156417f410acf978
SHA1

55a19def82358ffc006487e1f49be04277e12bd5
SHA256

14cf7648123e018dcdfc2aa386135a0510a9f7b12b8bc125ad4e32fd7f16999c
SHA512

cf747947ff0bedf87230e0fa08ee534f44f08962a52ae3dd0c0d734d6f4131456a0e2dc1ac230fa6500d5b254a64cae9e01161d1a690e26794c38d66e22cb5ed
SSDEEP

192:IUxOQrGVa/nHU0LgJ2jaVb4+LHdrDXy3pifUJ1hHxrWjd:hIQaVafU0LmqaVb4+xPy5ifU1hRyj

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2760 2532 WerFault.exe SolaraBootstrapper.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SolaraBootstrapper.exe

description pid process

Token: SeDebugPrivilege 2532 SolaraBootstrapper.exe

C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 1412
2⤵
- Program crash
PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2532 -ip 2532
1⤵
PID:4396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2532-0-0x000000007480E000-0x000000007480F000-memory.dmp

Filesize
4KB

Download
memory/2532-1-0x0000000000180000-0x000000000018A000-memory.dmp

Filesize
40KB

Download
memory/2532-2-0x0000000074800000-0x0000000074FB0000-memory.dmp

Filesize
7.7MB

Download
memory/2532-3-0x0000000074800000-0x0000000074FB0000-memory.dmp

Filesize
7.7MB

Download