File name:

Bootstrapper.exe

Full analysis: https://app.any.run/tasks/52f1ee0e-12ec-40e7-a5ef-c667cfb79b1e
Verdict: Malicious activity
Analysis date: July 31, 2024, 20:43:46
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
pastebin
qrcode
github
themida
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

365971E549352A15E150B60294EC2E57

SHA1:

2932242B427E81B1B4AC8C11FB17793EAE0939F7

SHA256:

FAAD2BC8E61B75E595A80FF2B6D150FF8B27187A8BA426CC1E5E38E193AB6D42

SSDEEP:

24576:YcAThIl1hqmoeQMhK5Y3/eZFPDVbb3ygK:lboeQMhgY3/eZFPDq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Bootstrapper.exe (PID: 6444)
      • msiexec.exe (PID: 3188)
      • Bootstrapper.exe (PID: 1076)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Bootstrapper.exe (PID: 1076)

    • Process drops legitimate windows executable

      • Bootstrapper.exe (PID: 1076)

    • The process drops C-runtime libraries

      • Bootstrapper.exe (PID: 1076)

    • Uses WEVTUTIL.EXE to install publishers and event logs from the manifest

      • wevtutil.exe (PID: 6832)
      • msiexec.exe (PID: 3672)

    • Executes script using NodeJS

      • node.exe (PID: 3904)
      • node.exe (PID: 6684)

  • INFO

    • Reads Environment values

      • Bootstrapper.exe (PID: 6444)

    • Disables trace logs

      • Bootstrapper.exe (PID: 6444)

    • Reads the machine GUID from the registry

      • Bootstrapper.exe (PID: 6444)

    • Checks proxy server information

      • Bootstrapper.exe (PID: 6444)

    • Reads the computer name

      • Bootstrapper.exe (PID: 6444)

    • Create files in a temporary directory

      • Bootstrapper.exe (PID: 6444)

    • Checks supported languages

      • Bootstrapper.exe (PID: 6444)

    • Reads the software policy settings

      • Bootstrapper.exe (PID: 6444)

    • Application launched itself

      • msiexec.exe (PID: 3188)
      • firefox.exe (PID: 2360)
      • firefox.exe (PID: 3508)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3188)

    • Manual execution by a user

      • Bootstrapper.exe (PID: 1076)
      • Taskmgr.exe (PID: 3028)
      • Bootstrapper.exe (PID: 4232)
      • Bootstrapper.exe (PID: 6676)
      • Bootstrapper.exe (PID: 6260)
      • Bootstrapper.exe (PID: 4344)
      • firefox.exe (PID: 2360)
      • Taskmgr.exe (PID: 936)

    • Dropped object may contain TOR URL's

      • Bootstrapper.exe (PID: 1076)

    • Themida protector has been detected

      • Solara.exe (PID: 2088)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:29 21:02:19+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 812032
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0xc81fa
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows command line
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: SolaraBootstrapper
FileVersion: 1.0.0.0
InternalName: SolaraBootstrapper.exe
LegalCopyright: Copyright © 2024
LegalTrademarks: -
OriginalFileName: SolaraBootstrapper.exe
ProductName: SolaraBootstrapper
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
193
Monitored processes
50
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start bootstrapper.exe conhost.exe no specs msiexec.exe no specs shellexperiencehost.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs rundll32.exe no specs rundll32.exe no specs bootstrapper.exe conhost.exe no specs msiexec.exe no specs taskmgr.exe no specs taskmgr.exe msiexec.exe no specs wevtutil.exe no specs conhost.exe no specs wevtutil.exe no specs bootstrapper.exe no specs bootstrapper.exe conhost.exe no specs node.exe no specs conhost.exe no specs solara.exe no specs node.exe no specs conhost.exe no specs bootstrapper.exe no specs bootstrapper.exe conhost.exe no specs node.exe no specs conhost.exe no specs THREAT solara.exe no specs node.exe no specs conhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs textinputhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs bootstrapper.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
360"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5588 -childID 3 -isForBrowser -prefsHandle 5580 -prefMapHandle 4572 -prefsLen 31161 -prefMapSize 244343 -jsInitHandle 1504 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce070870-1704-477d-b9e0-d53d5435b5fc} 3508 "\\.\pipe\gecko-crash-server-pipe.3508" 1ff92046690 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
123.0
644\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—node.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
752\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Bootstrapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
936"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Version:
10.0.19041.3636 (WinBuild.160101.0800)
1076"C:\Users\admin\Desktop\Bootstrapper.exe" C:\Users\admin\Desktop\Bootstrapper.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
SolaraBootstrapper
Exit code:
0
Version:
1.0.0.0
1292"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1300 -childID 4 -isForBrowser -prefsHandle 5572 -prefMapHandle 5628 -prefsLen 31161 -prefMapSize 244343 -jsInitHandle 1504 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a64d1f5-8398-4e39-8d84-fa1ff9a12b3e} 3508 "\\.\pipe\gecko-crash-server-pipe.3508" 1ff92046850 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
1664\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Bootstrapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
2088"C:\ProgramData\Solara\Solara.exe" C:\ProgramData\Solara\Solara.exe
Bootstrapper.exe
User:
admin
Integrity Level:
HIGH
Description:
WpfApp1
Version:
1.0.0.0
2180C:\Windows\System32\MsiExec.exe -Embedding 5C2C5B15B26D05330A44CC7AAB2C43BEC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
2360"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Total events
1 120
Read events
1 105
Write events
15
Delete events
0

Modification events

(PID) Process:(6444) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6444) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6444) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6444) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6444) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6444) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6444) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6444) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6444) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6444) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
36
Suspicious files
544
Text files
2 140
Unknown types
5

Dropped files

PID
Process
Filename
Type
6444Bootstrapper.exeC:\Users\admin\AppData\Local\Temp\node-v18.16.0-x64.msi —
MD5:—
SHA256:—
3188msiexec.exeC:\Windows\Installer\ecafc.msi —
MD5:—
SHA256:—
3188msiexec.exeC:\Windows\Installer\MSICF44.tmpexecutable
MD5:A3AE5D86ECF38DB9427359EA37A5F646
SHA256:C8D190D5BE1EFD2D52F72A72AE9DFA3940AB3FACEB626405959349654FE18B74
3188msiexec.exeC:\Program Files\nodejs\corepacktext
MD5:1A27E3E2F449816F5FFCDD57703A3F78
SHA256:DCEF0A787C4654AC5C085FAFA3A1E12D60D6F42E0D259C38378B61EF64295FA2
3188msiexec.exeC:\Windows\Temp\~DF1DF67AC860CEDAE0.TMPbinary
MD5:84AF1FAFA30EF2F9E8A3D431716EF69A
SHA256:82C393924C15836B14AB710892D904E4126F691482AE02AF1C133C9D811AFBDB
3188msiexec.exeC:\Program Files\nodejs\corepack.cmdtext
MD5:C046E14548EBB384EF71C0EFEA0E857A
SHA256:920630A1D1EC47AEDEA7345E3C868ECDC07E191373497BBF47FBBF5942FBAD4F
3188msiexec.exeC:\Windows\Installer\MSIE176.tmpexecutable
MD5:7A86CE1A899262DD3C1DF656BFF3FB2C
SHA256:B8F2D0909D7C2934285A8BE010D37C0609C7854A36562CBFCBCE547F4F4C7B0C
3188msiexec.exeC:\Windows\Installer\MSIE1E5.tmpexecutable
MD5:A3AE5D86ECF38DB9427359EA37A5F646
SHA256:C8D190D5BE1EFD2D52F72A72AE9DFA3940AB3FACEB626405959349654FE18B74
3188msiexec.exeC:\Windows\Installer\MSICF24.tmpexecutable
MD5:9FE9B0ECAEA0324AD99036A91DB03EBB
SHA256:E2CCE64916E405976A1D0C522B44527D12B1CBA19DE25DA62121CF5F41D184C9
3188msiexec.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.logtext
MD5:FA9B841BA6B04546C4C41E14CF54667E
SHA256:A9FBF32198661FF92E036536A15D3474CD3E2C295D0192B86C4E55819CF5F06A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
36
TCP/UDP connections
194
DNS requests
253
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
200
23.32.238.27:80
http://r10.o.lencr.org/
unknown
—
—
unknown
—
—
POST
200
23.32.238.27:80
http://r10.o.lencr.org/
unknown
—
—
unknown
—
—
POST
200
142.250.186.35:80
http://o.pki.goog/wr2
unknown
—
—
unknown
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAOO2y%2FG5AVzGnYPFRYUTIU%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D
unknown
—
—
whitelisted
—
—
POST
200
23.32.238.27:80
http://r11.o.lencr.org/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
239.255.255.250:1900
—
—
—
whitelisted
4056
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4936
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
6444
Bootstrapper.exe
172.67.19.24:443
pastebin.com
CLOUDFLARENET
US
unknown
6444
Bootstrapper.exe
128.116.21.4:443
clientsettings.roblox.com
ROBLOX-PRODUCTION
US
unknown
4056
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
6444
Bootstrapper.exe
104.20.22.46:443
www.nodejs.org
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.238
whitelisted
pastebin.com
  • 172.67.19.24
  • 104.20.3.235
  • 104.20.4.235
shared
clientsettings.roblox.com
  • 128.116.21.4
whitelisted
www.nodejs.org
  • 104.20.22.46
  • 104.20.23.46
whitelisted
nodejs.org
  • 104.20.22.46
  • 104.20.23.46
whitelisted
www.bing.com
  • 104.126.37.185
  • 104.126.37.177
  • 104.126.37.162
  • 104.126.37.144
  • 104.126.37.123
  • 104.126.37.136
  • 104.126.37.176
  • 104.126.37.137
  • 104.126.37.163
  • 104.126.37.139
  • 104.126.37.147
  • 104.126.37.152
  • 104.126.37.155
  • 104.126.37.154
  • 104.126.37.160
  • 104.126.37.153
  • 104.126.37.131
whitelisted
ocsp.digicert.com
  • 192.229.221.95
unknown
client.wns.windows.com
  • 40.113.110.67
unknown
login.live.com
  • 20.190.160.22
  • 20.190.160.17
  • 40.126.32.74
  • 20.190.160.20
  • 20.190.160.14
  • 40.126.32.140
  • 40.126.32.76
  • 40.126.32.136
unknown

Threats

PID
Process
Class
Message
2256
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
—
—
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Bootstrapper.exe