File name:

Bootstrapper.exe

Full analysis: https://app.any.run/tasks/52f1ee0e-12ec-40e7-a5ef-c667cfb79b1e
Verdict: Malicious activity
Analysis date: July 31, 2024, 20:43:46
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
pastebin
qrcode
github
themida
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

365971E549352A15E150B60294EC2E57

SHA1:

2932242B427E81B1B4AC8C11FB17793EAE0939F7

SHA256:

FAAD2BC8E61B75E595A80FF2B6D150FF8B27187A8BA426CC1E5E38E193AB6D42

SSDEEP:

24576:YcAThIl1hqmoeQMhK5Y3/eZFPDVbb3ygK:lboeQMhgY3/eZFPDq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Bootstrapper.exe (PID: 6444)
      • msiexec.exe (PID: 3188)
      • Bootstrapper.exe (PID: 1076)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • Bootstrapper.exe (PID: 1076)

    • Executable content was dropped or overwritten

      • Bootstrapper.exe (PID: 1076)

    • The process drops C-runtime libraries

      • Bootstrapper.exe (PID: 1076)

    • Uses WEVTUTIL.EXE to install publishers and event logs from the manifest

      • msiexec.exe (PID: 3672)
      • wevtutil.exe (PID: 6832)

    • Executes script using NodeJS

      • node.exe (PID: 6684)
      • node.exe (PID: 3904)

  • INFO

    • Reads the computer name

      • Bootstrapper.exe (PID: 6444)

    • Reads the machine GUID from the registry

      • Bootstrapper.exe (PID: 6444)

    • Disables trace logs

      • Bootstrapper.exe (PID: 6444)

    • Checks supported languages

      • Bootstrapper.exe (PID: 6444)

    • Checks proxy server information

      • Bootstrapper.exe (PID: 6444)

    • Reads Environment values

      • Bootstrapper.exe (PID: 6444)

    • Create files in a temporary directory

      • Bootstrapper.exe (PID: 6444)

    • Reads the software policy settings

      • Bootstrapper.exe (PID: 6444)

    • Application launched itself

      • msiexec.exe (PID: 3188)
      • firefox.exe (PID: 2360)
      • firefox.exe (PID: 3508)

    • Manual execution by a user

      • Taskmgr.exe (PID: 936)
      • Bootstrapper.exe (PID: 1076)
      • Taskmgr.exe (PID: 3028)
      • Bootstrapper.exe (PID: 4232)
      • Bootstrapper.exe (PID: 6260)
      • Bootstrapper.exe (PID: 4344)
      • Bootstrapper.exe (PID: 6676)
      • firefox.exe (PID: 2360)

    • Dropped object may contain TOR URL's

      • Bootstrapper.exe (PID: 1076)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3188)

    • Themida protector has been detected

      • Solara.exe (PID: 2088)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:29 21:02:19+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 812032
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0xc81fa
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows command line
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: SolaraBootstrapper
FileVersion: 1.0.0.0
InternalName: SolaraBootstrapper.exe
LegalCopyright: Copyright © 2024
LegalTrademarks: -
OriginalFileName: SolaraBootstrapper.exe
ProductName: SolaraBootstrapper
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
193
Monitored processes
50
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start bootstrapper.exe conhost.exe no specs msiexec.exe no specs shellexperiencehost.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs rundll32.exe no specs rundll32.exe no specs bootstrapper.exe conhost.exe no specs msiexec.exe no specs taskmgr.exe no specs taskmgr.exe msiexec.exe no specs wevtutil.exe no specs conhost.exe no specs wevtutil.exe no specs bootstrapper.exe no specs bootstrapper.exe conhost.exe no specs node.exe no specs conhost.exe no specs solara.exe no specs node.exe no specs conhost.exe no specs bootstrapper.exe no specs bootstrapper.exe conhost.exe no specs node.exe no specs conhost.exe no specs THREAT solara.exe no specs node.exe no specs conhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs textinputhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs bootstrapper.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
360"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5588 -childID 3 -isForBrowser -prefsHandle 5580 -prefMapHandle 4572 -prefsLen 31161 -prefMapSize 244343 -jsInitHandle 1504 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce070870-1704-477d-b9e0-d53d5435b5fc} 3508 "\\.\pipe\gecko-crash-server-pipe.3508" 1ff92046690 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
123.0
644\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—node.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
752\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Bootstrapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
936"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Version:
10.0.19041.3636 (WinBuild.160101.0800)
1076"C:\Users\admin\Desktop\Bootstrapper.exe" C:\Users\admin\Desktop\Bootstrapper.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
SolaraBootstrapper
Exit code:
0
Version:
1.0.0.0
1292"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1300 -childID 4 -isForBrowser -prefsHandle 5572 -prefMapHandle 5628 -prefsLen 31161 -prefMapSize 244343 -jsInitHandle 1504 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a64d1f5-8398-4e39-8d84-fa1ff9a12b3e} 3508 "\\.\pipe\gecko-crash-server-pipe.3508" 1ff92046850 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
1664\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Bootstrapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
2088"C:\ProgramData\Solara\Solara.exe" C:\ProgramData\Solara\Solara.exe
Bootstrapper.exe
User:
admin
Integrity Level:
HIGH
Description:
WpfApp1
Version:
1.0.0.0
2180C:\Windows\System32\MsiExec.exe -Embedding 5C2C5B15B26D05330A44CC7AAB2C43BEC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
2360"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Total events
1 120
Read events
1 105
Write events
15
Delete events
0

Modification events

(PID) Process:(6444) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6444) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6444) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6444) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6444) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6444) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6444) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6444) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6444) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6444) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
36
Suspicious files
544
Text files
2 140
Unknown types
5

Dropped files

PID
Process
Filename
Type
6444Bootstrapper.exeC:\Users\admin\AppData\Local\Temp\node-v18.16.0-x64.msi —
MD5:—
SHA256:—
3188msiexec.exeC:\Windows\Installer\ecafc.msi —
MD5:—
SHA256:—
3188msiexec.exeC:\Windows\Installer\MSIE176.tmpexecutable
MD5:7A86CE1A899262DD3C1DF656BFF3FB2C
SHA256:B8F2D0909D7C2934285A8BE010D37C0609C7854A36562CBFCBCE547F4F4C7B0C
3188msiexec.exeC:\Windows\Temp\~DFBC7A53A89919B749.TMPbinary
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
3188msiexec.exeC:\Windows\Installer\MSIE1E5.tmpexecutable
MD5:A3AE5D86ECF38DB9427359EA37A5F646
SHA256:C8D190D5BE1EFD2D52F72A72AE9DFA3940AB3FACEB626405959349654FE18B74
3188msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5binary
MD5:35FE9028D2B40AE33AF0286588B5BB91
SHA256:A2DD4FD8558FFAD708784B43DEEC6837777C4116065FFB3D16FCBA0A7347A4CA
3188msiexec.exeC:\Windows\Installer\MSIF63A.tmpexecutable
MD5:7A86CE1A899262DD3C1DF656BFF3FB2C
SHA256:B8F2D0909D7C2934285A8BE010D37C0609C7854A36562CBFCBCE547F4F4C7B0C
3188msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_CEA48AEE703922244E2530F7A011BBC6binary
MD5:5FBB9D3F53B9E75961CDE4C4AE192F11
SHA256:1B7913EB4ACA0361F89AD066CCA94EC0DD775FD4C71621E0CA7CA873CDF38B99
3188msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_CEA48AEE703922244E2530F7A011BBC6binary
MD5:19DD65DC3E1AEFB514ECD7807E1A4170
SHA256:8BEC46F5622F51E02B720A89F620D11BF6D877E0C8AA5565EA25B2F6831FDACC
3188msiexec.exeC:\Windows\Installer\MSICF24.tmpexecutable
MD5:9FE9B0ECAEA0324AD99036A91DB03EBB
SHA256:E2CCE64916E405976A1D0C522B44527D12B1CBA19DE25DA62121CF5F41D184C9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
36
TCP/UDP connections
194
DNS requests
253
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAOO2y%2FG5AVzGnYPFRYUTIU%3D
unknown
—
—
whitelisted
—
—
POST
200
23.32.238.27:80
http://r10.o.lencr.org/
unknown
—
—
unknown
—
—
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
—
—
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
—
—
POST
200
23.32.238.27:80
http://r11.o.lencr.org/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
239.255.255.250:1900
—
—
—
whitelisted
4056
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4936
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
6444
Bootstrapper.exe
172.67.19.24:443
pastebin.com
CLOUDFLARENET
US
unknown
6444
Bootstrapper.exe
128.116.21.4:443
clientsettings.roblox.com
ROBLOX-PRODUCTION
US
unknown
4056
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
6444
Bootstrapper.exe
104.20.22.46:443
www.nodejs.org
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.238
whitelisted
pastebin.com
  • 172.67.19.24
  • 104.20.3.235
  • 104.20.4.235
shared
clientsettings.roblox.com
  • 128.116.21.4
whitelisted
www.nodejs.org
  • 104.20.22.46
  • 104.20.23.46
whitelisted
nodejs.org
  • 104.20.22.46
  • 104.20.23.46
whitelisted
www.bing.com
  • 104.126.37.185
  • 104.126.37.177
  • 104.126.37.162
  • 104.126.37.144
  • 104.126.37.123
  • 104.126.37.136
  • 104.126.37.176
  • 104.126.37.137
  • 104.126.37.163
  • 104.126.37.139
  • 104.126.37.147
  • 104.126.37.152
  • 104.126.37.155
  • 104.126.37.154
  • 104.126.37.160
  • 104.126.37.153
  • 104.126.37.131
whitelisted
ocsp.digicert.com
  • 192.229.221.95
unknown
client.wns.windows.com
  • 40.113.110.67
unknown
login.live.com
  • 20.190.160.22
  • 20.190.160.17
  • 40.126.32.74
  • 20.190.160.20
  • 20.190.160.14
  • 40.126.32.140
  • 40.126.32.76
  • 40.126.32.136
unknown

Threats

PID
Process
Class
Message
2256
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
—
—
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Bootstrapper.exe