Malware analysis BootstrapperV1.23.exe Malicious activity

Add for printing

File name:	BootstrapperV1.23.exe
Full analysis:	https://app.any.run/tasks/1cfff816-59e1-4805-b50d-f4bb8abfa0be
Verdict:	Malicious activity
Analysis date:	November 15, 2024, 10:09:49
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	qrcode phishing pastebin arch-scr arch-doc
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows, 3 sections
MD5:	02C70D9D6696950C198DB93B7F6A835E
SHA1:	30231A467A49CC37768EEA0F55F4BEA1CBFB48E2
SHA256:	8F2E28588F2303BD8D7A9B0C3FF6A9CB16FA93F8DDC9C5E0666A8C12D6880EE3
SSDEEP:	6144:tXxndGsQZDAvUHFLRSZ3e82Zavp/ijHrGEW1NhVhOQNaDffKTghOpDozwKdVuaQ:tf3gAvUlLvocaPhOmTghOpDkwKdw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 180 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 120 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- PHISHING has been detected (SURICATA)
  - svchost.exe (PID: 2172)
SUSPICIOUS
- Starts CMD.EXE for commands execution
  - BootstrapperV1.23.exe (PID: 4548)
  - BootstrapperV1.23.exe (PID: 6512)
- Uses WMIC.EXE to obtain information about the network interface controller
  - cmd.exe (PID: 3644)
- Process uses IPCONFIG to discover network configuration
  - cmd.exe (PID: 6736)
  - cmd.exe (PID: 5284)
- Uses WEVTUTIL.EXE to install publishers and event logs from the manifest
  - msiexec.exe (PID: 6668)
  - wevtutil.exe (PID: 1584)
- The process drops C-runtime libraries
  - BootstrapperV1.23.exe (PID: 4548)
- Process drops legitimate windows executable
  - BootstrapperV1.23.exe (PID: 4548)
- Executable content was dropped or overwritten
  - BootstrapperV1.23.exe (PID: 4548)
- Executes application which crashes
  - Solara.exe (PID: 2780)
INFO
- Executable content was dropped or overwritten
  - msiexec.exe (PID: 6956)
- Application launched itself
  - msiexec.exe (PID: 6956)
- Manual execution by a user
  - BootstrapperV1.23.exe (PID: 4380)
  - BootstrapperV1.23.exe (PID: 6512)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win64 Executable (generic) (87.3)
.exe	\|	Generic Win/DOS Executable (6.3)
.exe	\|	DOS Executable Generic (6.3)

EXIF

EXE

MachineType:	AMD AMD64
TimeStamp:	2024:11:13 21:07:39+00:00
ImageFileCharacteristics:	Executable, Large address aware
PEType:	PE32+
LinkerVersion:	8
CodeSize:	816640
InitializedDataSize:	2048
UninitializedDataSize:	-
EntryPoint:	0xc948a
OSVersion:	4
ImageVersion:	-
SubsystemVersion:	4
Subsystem:	Windows command line
FileVersionNumber:	1.0.0.0
ProductVersionNumber:	1.0.0.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Unicode
Comments:	-
CompanyName:	-
FileDescription:	SolaraBootstrapper
FileVersion:	1.0.0.0
InternalName:	SolaraBootstrapper.exe
LegalCopyright:	Copyright © 2024
LegalTrademarks:	-
OriginalFileName:	SolaraBootstrapper.exe
ProductName:	SolaraBootstrapper
ProductVersion:	1.0.0.0
AssemblyVersion:	1.0.0.0

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

176

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

1584

"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"

C:\Windows\SysWOW64\wevtutil.exe

—

msiexec.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Eventing Command Line Utility

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\wevtutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcp_win.dll
c:\windows\syswow64\ucrtbase.dll

2172

C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

services.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Host Process for Windows Services

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll

2780

"C:\ProgramData\Solara\Solara.exe"

C:\ProgramData\Solara\Solara.exe

BootstrapperV1.23.exe

User:

admin

Company:

CMD Softworks

Integrity Level:

HIGH

Description:

Solara V3

Exit code:

3762504530

Version:

3.0.0.0

Modules

Images
c:\programdata\solara\solara.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll

3644

"cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")

C:\Windows\System32\cmd.exe

—

BootstrapperV1.23.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll

3676

C:\Windows\System32\MsiExec.exe -Embedding F4648D0C672BD786CB5DBAE7B7735BA0

C:\Windows\System32\msiexec.exe

—

msiexec.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows® installer

Exit code:

Version:

5.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

3936

"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64

C:\Windows\System32\wevtutil.exe

—

wevtutil.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Eventing Command Line Utility

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\wevtutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\combase.dll
c:\windows\system32\sechost.dll

3952

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

wevtutil.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

4072

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

4380

"C:\Users\admin\Downloads\BootstrapperV1.23.exe"

C:\Users\admin\Downloads\BootstrapperV1.23.exe

—

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Description:

SolaraBootstrapper

Exit code:

3221226540

Version:

1.0.0.0

Modules

Images
c:\users\admin\downloads\bootstrapperv1.23.exe
c:\windows\system32\ntdll.dll

4548

"C:\Users\admin\Downloads\BootstrapperV1.23.exe"

C:\Users\admin\Downloads\BootstrapperV1.23.exe

explorer.exe

User:

admin

Integrity Level:

HIGH

Description:

SolaraBootstrapper

Exit code:

Version:

1.0.0.0

Modules

Images
c:\users\admin\downloads\bootstrapperv1.23.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll

Add for printing

Total events

23 125

Read events

20 151

Write events

2 963

Delete events

Modification events


(PID) Process:	(4548) BootstrapperV1.23.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperV1_RASAPI32
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(4548) BootstrapperV1.23.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperV1_RASAPI32
Operation:	write	Name:	EnableAutoFileTracing
Value: 0
(PID) Process:	(4548) BootstrapperV1.23.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperV1_RASAPI32
Operation:	write	Name:	EnableConsoleTracing
Value: 0
(PID) Process:	(4548) BootstrapperV1.23.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperV1_RASAPI32
Operation:	write	Name:	FileTracingMask
Value:
(PID) Process:	(4548) BootstrapperV1.23.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperV1_RASAPI32
Operation:	write	Name:	ConsoleTracingMask
Value:
(PID) Process:	(4548) BootstrapperV1.23.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperV1_RASAPI32
Operation:	write	Name:	MaxFileSize
Value: 1048576
(PID) Process:	(4548) BootstrapperV1.23.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperV1_RASAPI32
Operation:	write	Name:	FileDirectory
Value: %windir%\tracing
(PID) Process:	(4548) BootstrapperV1.23.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperV1_RASMANCS
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(4548) BootstrapperV1.23.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperV1_RASMANCS
Operation:	write	Name:	EnableAutoFileTracing
Value: 0
(PID) Process:	(4548) BootstrapperV1.23.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperV1_RASMANCS
Operation:	write	Name:	EnableConsoleTracing
Value: 0

Add for printing

Executable files

Suspicious files

1 744

Text files

743

Unknown types

Dropped files

PID	Process	Filename		Type
4548	BootstrapperV1.23.exe	C:\Users\admin\AppData\Local\Temp\node-v18.16.0-x64.msi		—
		MD5:—	SHA256:—
6956	msiexec.exe	C:\Windows\Installer\9065d.msi		—
		MD5:—	SHA256:—
4548	BootstrapperV1.23.exe	C:\Users\admin\Downloads\DISCORD		binary
		MD5:B016DAFCA051F817C6BA098C096CB450	SHA256:B03C8C2D2429E9DBC7920113DEDF6FC09095AB39421EE0CC8819AD412E5D67B9
6956	msiexec.exe	C:\Windows\Installer\MSI2787.tmp		executable
		MD5:A3AE5D86ECF38DB9427359EA37A5F646	SHA256:C8D190D5BE1EFD2D52F72A72AE9DFA3940AB3FACEB626405959349654FE18B74
6956	msiexec.exe	C:\Windows\Installer\inprogressinstallinfo.ipi		binary
		MD5:0FE5093AC8060D273F6520F024818B4E	SHA256:AFEE344A2A80BE2CFD22C7BDA57B0A5E83465A9D1E6CAE2492EB0BE4C69CD1D3
6956	msiexec.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5		binary
		MD5:7E2A1FCEB38FBF275328817DF32A1E37	SHA256:A440FBCFCCD4AB72493E35D1EDCBBC8627F22D54B956A604DAD8835D39180EC4
6956	msiexec.exe	C:\Program Files\nodejs\corepack		text
		MD5:1A27E3E2F449816F5FFCDD57703A3F78	SHA256:DCEF0A787C4654AC5C085FAFA3A1E12D60D6F42E0D259C38378B61EF64295FA2
6956	msiexec.exe	C:\Windows\Installer\MSI1535.tmp		binary
		MD5:E43049A5BB9E2264AEFFC021B53FD22D	SHA256:EBCCC825DF0AFFDE248C1B31F0BBDEC0DE80F8031C9E3A7DF454E4BF6CF3ED3C
6956	msiexec.exe	C:\Windows\Installer\MSIA46.tmp		executable
		MD5:9FE9B0ECAEA0324AD99036A91DB03EBB	SHA256:E2CCE64916E405976A1D0C522B44527D12B1CBA19DE25DA62121CF5F41D184C9
6956	msiexec.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_CEA48AEE703922244E2530F7A011BBC6		binary
		MD5:90FECC54870537D229DC7462B0CC1536	SHA256:62DD87F4D4E67451431014997BA540D6A68F40759B4A3777129581A5935CA4BF

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
4360	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
6956	msiexec.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAOO2y%2FG5AVzGnYPFRYUTIU%3D	unknown	—	—	whitelisted
5488	MoUsoCoreWorker.exe	GET	200	2.16.164.59:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5488	MoUsoCoreWorker.exe	GET	200	88.221.169.152:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
6956	msiexec.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D	unknown	—	—	whitelisted
2364	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
4348	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
4360	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D	unknown	—	—	whitelisted
4360	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
5232	SIHClient.exe	GET	200	88.221.169.152:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
4360	SearchApp.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
6944	svchost.exe	20.73.194.208:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1248	RUXIMICS.exe	20.73.194.208:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
5488	MoUsoCoreWorker.exe	20.73.194.208:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
2172	svchost.exe	224.0.0.251:5353	—	—	—	unknown
2172	svchost.exe	224.0.0.252:5355	—	—	—	whitelisted
4548	BootstrapperV1.23.exe	172.67.203.125:443	getsolara.dev	CLOUDFLARENET	US	malicious
2364	svchost.exe	40.126.32.72:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted

DNS requests

Domain	IP	Reputation
ocsp.digicert.com	192.229.221.95	whitelisted
getsolara.dev	172.67.203.125 104.21.93.27	malicious
login.live.com	40.126.32.72 20.190.160.20 40.126.32.134 40.126.32.74 40.126.32.68 20.190.160.14 40.126.32.138 40.126.32.133 40.126.31.69 20.190.159.75 20.190.159.73 40.126.31.71 20.190.159.23 20.190.159.64 40.126.31.67 20.190.159.2	whitelisted
www.bing.com	2.23.209.186 2.23.209.193 2.23.209.185 2.23.209.183 2.23.209.135 2.23.209.130 2.23.209.187 2.23.209.133 2.23.209.189 2.23.209.150 2.23.209.141 2.23.209.140 2.23.209.143 2.23.209.137 2.23.209.144 2.23.209.149 2.23.209.154 2.23.209.142	whitelisted
go.microsoft.com	184.28.89.167	whitelisted
th.bing.com	2.23.209.175 2.23.209.181 2.23.209.182 2.23.209.183 2.23.209.179 2.23.209.185 2.23.209.162 2.23.209.177 2.23.209.186	whitelisted
clientsettings.roblox.com	128.116.44.3 128.116.44.4	whitelisted
www.nodejs.org	104.20.23.46 104.20.22.46	whitelisted
nodejs.org	104.20.22.46 104.20.23.46	whitelisted
settings-win.data.microsoft.com	51.104.136.2	whitelisted

Threats

PID	Process	Class	Message
2172	svchost.exe	Possible Social Engineering Attempted	PHISHING [ANY.RUN] Suspected Phishing domain by CrossDomain ( .solaraweb-alj .pages .dev)
2172	svchost.exe	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Pages platform for frontend developers to collaborate and deploy websites (pages .dev)
2172	svchost.exe	Not Suspicious Traffic	INFO [ANY.RUN] Online Pastebin Text Storage

Add for printing

No debug info

General Info

BootstrapperV1.23.exe

02C70D9D6696950C198DB93B7F6A835E

30231A467A49CC37768EEA0F55F4BEA1CBFB48E2

8F2E28588F2303BD8D7A9B0C3FF6A9CB16FA93F8DDC9C5E0666A8C12D6880EE3

6144:tXxndGsQZDAvUHFLRSZ3e82Zavp/ijHrGEW1NhVhOQNaDffKTghOpDozwKdVuaQ:tf3gAvUlLvocaPhOmTghOpDkwKdw

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

PHISHING has been detected (SURICATA)

SUSPICIOUS

Starts CMD.EXE for commands execution

Uses WMIC.EXE to obtain information about the network interface controller

Process uses IPCONFIG to discover network configuration

Uses WEVTUTIL.EXE to install publishers and event logs from the manifest

The process drops C-runtime libraries

Process drops legitimate windows executable

Executable content was dropped or overwritten

Executes application which crashes

INFO

Executable content was dropped or overwritten

Application launched itself

Manual execution by a user

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings