download:

/quivings/Solara/raw/main/Files/SolaraB.zip

Full analysis: https://app.any.run/tasks/7040de35-392d-4c32-b76d-1788062c9b53
Verdict: Malicious activity
Analysis date: July 22, 2024, 23:31:11
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

4EC8143B6DBE27870CF8333711FF5096

SHA1:

693D467EBEC348469011FFEF1BD370B113653147

SHA256:

2510BE907EC476E8375AC7B5431536AE9A32BF99FE77AB695A5100852B111B96

SSDEEP:

96:EUqjU52FPuD85CRbXQSQ4Bl1ZP5MaOS5ZTDCJvuB66EFscY7LO4ivJEzmqAZdXRD:EU+FuNQt6JP5GS5NGMYE7TogARskfl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1264)
      • SolaraBootstrapper.exe (PID: 1504)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • SolaraBootstrapper.exe (PID: 1504)

    • Process drops legitimate windows executable

      • SolaraBootstrapper.exe (PID: 1504)

    • The process drops C-runtime libraries

      • SolaraBootstrapper.exe (PID: 1504)

    • Reads security settings of Internet Explorer

      • SolaraBootstrapper.exe (PID: 1504)
      • SolaraBootstrapper.exe (PID: 6284)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 5560)

    • Reads the date of Windows installation

      • SolaraBootstrapper.exe (PID: 1504)
      • SolaraBootstrapper.exe (PID: 6284)

    • Reads the BIOS version

      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 5560)

  • INFO

    • Manual execution by a user

      • SolaraBootstrapper.exe (PID: 1504)
      • SolaraBootstrapper.exe (PID: 6284)

    • Reads the software policy settings

      • slui.exe (PID: 1568)
      • SolaraBootstrapper.exe (PID: 1504)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 3336)
      • SolaraBootstrapper.exe (PID: 6284)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 5560)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1264)

    • Checks supported languages

      • SolaraBootstrapper.exe (PID: 1504)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 3336)
      • SolaraBootstrapper.exe (PID: 6284)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 5560)

    • Checks proxy server information

      • slui.exe (PID: 1568)
      • SolaraBootstrapper.exe (PID: 1504)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 3336)
      • SolaraBootstrapper.exe (PID: 6284)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 5560)

    • Reads the computer name

      • SolaraBootstrapper.exe (PID: 1504)
      • SolaraBootstrapper.exe (PID: 6284)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 3336)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 5560)

    • Reads the machine GUID from the registry

      • SolaraBootstrapper.exe (PID: 1504)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 3336)
      • SolaraBootstrapper.exe (PID: 6284)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 5560)

    • Reads Environment values

      • SolaraBootstrapper.exe (PID: 1504)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 3336)
      • SolaraBootstrapper.exe (PID: 6284)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 5560)

    • Disables trace logs

      • SolaraBootstrapper.exe (PID: 1504)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 3336)
      • SolaraBootstrapper.exe (PID: 6284)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 5560)

    • Create files in a temporary directory

      • SolaraBootstrapper.exe (PID: 1504)
      • SolaraBootstrapper.exe (PID: 6284)

    • Dropped object may contain TOR URL's

      • SolaraBootstrapper.exe (PID: 1504)

    • Process checks computer location settings

      • SolaraBootstrapper.exe (PID: 6284)
      • SolaraBootstrapper.exe (PID: 1504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:05:19 18:25:22
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: SolaraB/Solara/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
10
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe slui.exe no specs rundll32.exe no specs slui.exe solarabootstrapper.exe conhost.exe no specs cd57e4c171d6e8f5ea8b8f824a6a7316.exe solarabootstrapper.exe conhost.exe no specs cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Process information

PID
CMD
Path
Indicators
Parent process
1264"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\SolaraB.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1504"C:\Users\admin\Desktop\SolaraB\Solara\SolaraBootstrapper.exe" C:\Users\admin\Desktop\SolaraB\Solara\SolaraBootstrapper.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
SolaraBootstrapper
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\solarab\solara\solarabootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1568C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3336"C:\Users\admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe" C:\Users\admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
SolaraBootstrapper.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WpfApp1
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\solara.dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4940\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SolaraBootstrapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5032C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5276C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5560"C:\Users\admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe" C:\Users\admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
SolaraBootstrapper.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WpfApp1
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\solara.dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6284"C:\Users\admin\Desktop\SolaraB\Solara\SolaraBootstrapper.exe" C:\Users\admin\Desktop\SolaraB\Solara\SolaraBootstrapper.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
SolaraBootstrapper
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\solarab\solara\solarabootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
6944\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SolaraBootstrapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
17 531
Read events
17 478
Write events
53
Delete events
0

Modification events

(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\SolaraB.zip
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1504) SolaraBootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1504) SolaraBootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SolaraBootstrapper_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
Executable files
12
Suspicious files
173
Text files
9
Unknown types
9

Dropped files

PID
Process
Filename
Type
1504SolaraBootstrapper.exeC:\Users\admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dllexecutable
MD5:851FEE9A41856B588847CF8272645F58
SHA256:5E7FAEE6B8230CA3B97CE9542B914DB3ABBBD1CB14FD95A39497AAAD4C1094CA
1264WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1264.39342\SolaraB\Solara\SolaraBootstrapper.exeexecutable
MD5:6557BD5240397F026E675AFB78544A26
SHA256:A7FECFC225DFDD4E14DCD4D1B4BA1B9F8E4D1984F1CDD8CDA3A9987E5D53C239
1504SolaraBootstrapper.exeC:\Users\admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exeexecutable
MD5:D84E7F79F4F0D7074802D2D6E6F3579E
SHA256:DCFC2B4FA3185DF415855EC54395D9C36612F68100D046D8C69659DA01F7D227
1504SolaraBootstrapper.exeC:\Users\admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.dllexecutable
MD5:4D326696FFD80A5BEE016C8B397442C2
SHA256:DB03B4536FBFDCB570945F5942546A19AFE20A7826713BF12F34347EE618F2CA
1504SolaraBootstrapper.exeC:\Users\admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dllexecutable
MD5:34EC990ED346EC6A4F14841B12280C20
SHA256:1E987B22CD011E4396A0805C73539586B67DF172DF75E3DDED16A77D31850409
1504SolaraBootstrapper.exeC:\Users\admin\AppData\Local\Temp\Solara.Dir\bin\version.txttext
MD5:3FFB7E1BE9CDF02EA2F5C403BA1BB670
SHA256:604751D1D0DE6684FA3D1736599868B1BD8641615F1B1593EAC854CD4589CD27
1504SolaraBootstrapper.exeC:\Users\admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.WinForms.dllexecutable
MD5:4CF94FFA50FD9BDC0BB93CCEAEDE0629
SHA256:50B2E46C99076F6FA9C33E0A98F0FE3A2809A7C647BB509066E58F4C7685D7E6
1504SolaraBootstrapper.exeC:\Users\admin\AppData\Local\Temp\Solara.Dir\libcurl.dllexecutable
MD5:E31F5136D91BAD0FCBCE053AAC798A30
SHA256:EE94E2201870536522047E6D7FE7B903A63CD2E13E20C8FFFC86D0E95361E671
1504SolaraBootstrapper.exeC:\Users\admin\AppData\Local\Temp\Solara.zipcompressed
MD5:6C9278827B591E47A451829B8E781D41
SHA256:E2FDD98EF973F17B70D1B4319649F1C72DFF407F2A2C35CF051C2F5A23449449
1504SolaraBootstrapper.exeC:\Users\admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\lib\types\raw.jsbinary
MD5:ACB38E4FE575AFAF8D1A257E47C6E362
SHA256:4E9CC80A7EE8BD667C68C264B4C374B28E731246DDB6EC22C3968DAF837E30A2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
48
DNS requests
20
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
760
lsass.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2628
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6012
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3800
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4204
svchost.exe
4.208.221.206:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
7124
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1568
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1504
SolaraBootstrapper.exe
140.82.121.4:443
github.com
GITHUB
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.211.142.183
  • 40.127.240.158
whitelisted
google.com
  • 216.58.206.78
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
github.com
  • 140.82.121.4
shared
raw.githubusercontent.com
  • 185.199.109.133
  • 185.199.108.133
  • 185.199.111.133
  • 185.199.110.133
shared
www.bing.com
  • 2.23.209.149
  • 2.23.209.140
  • 2.23.209.182
  • 2.23.209.133
  • 2.23.209.130
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.14
  • 40.126.32.134
  • 40.126.32.74
  • 40.126.32.140
  • 20.190.160.17
  • 40.126.32.136
  • 40.126.32.138
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted

Threats

PID
Process
Class
Message
2284
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/quivings/Solara/raw/main/Files/SolaraB.zip