hxxps://github[.]com/addi00000/empyrean

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\International\Geo\Nation	python-installer.exe

Executes dropped EXE 12 IoCs

pid	Process
5156	python-installer.exe
1524	python-installer.exe
3988	python-3.10.9-amd64.exe
3832	python.exe
5880	python.exe
4956	python.exe
2612	python.exe
1740	python.exe
1660	python.exe
5364	python-installer.exe
5628	python-installer.exe
2344	python.exe

Loads dropped DLL 41 IoCs

pid	Process
1524	python-installer.exe
1964	MsiExec.exe
3832	python.exe
3832	python.exe
3832	python.exe
3832	python.exe
3832	python.exe
3832	python.exe
5880	python.exe
5880	python.exe
5880	python.exe
5880	python.exe
5880	python.exe
5880	python.exe
5880	python.exe
5880	python.exe
5880	python.exe
5880	python.exe
5880	python.exe
5880	python.exe
5880	python.exe
5880	python.exe
5880	python.exe
5880	python.exe
5880	python.exe
5880	python.exe
5880	python.exe
5880	python.exe
5880	python.exe
4956	python.exe
4956	python.exe
2612	python.exe
2612	python.exe
1740	python.exe
1740	python.exe
1740	python.exe
1660	python.exe
1660	python.exe
5628	python-installer.exe
2344	python.exe
2344	python.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Windows\\pyshellext.amd64.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{e8531749-5517-4937-a722-a4052cb2d75e} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{e8531749-5517-4937-a722-a4052cb2d75e}\\python-3.10.9-amd64.exe\" /burn.runonce"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{e8531749-5517-4937-a722-a4052cb2d75e} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{e8531749-5517-4937-a722-a4052cb2d75e}\\python-3.10.9-amd64.exe\" /burn.runonce"	python-installer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Windows directory 58 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59c500.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBE49.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{35A2AF4F-C504-4D2A-A025-F69379ECDF07}\ARPIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e59c4dd.msi	msiexec.exe
File created	C:\Windows\Installer\e59c4e7.msi	msiexec.exe
File created	C:\Windows\Installer\e59c4f1.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1F097B66-81E9-46FB-BBAC-315C5F50CF94}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{92CFA54C-9CE5-4284-83FD-1D0B8AB2AB69}	msiexec.exe
File created	C:\Windows\py.exe	msiexec.exe
File created	C:\Windows\Installer\{35A2AF4F-C504-4D2A-A025-F69379ECDF07}\ARPIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e59c4ec.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0CBB496F-1D15-42F1-AA45-C01C95196EC8}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI649D.tmp	msiexec.exe
File created	C:\Windows\Installer\e59c4dd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID53A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59c4f6.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{067C6FFC-0FD1-4F3A-8E94-58F091BCC0D5}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{59ED0114-0C86-4B18-83E2-929AD7D232AD}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1C76.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E69.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59c505.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F115E5B8-9719-4BDF-8B0D-551809BB677D}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E2BC2EBD-7260-458B-A42C-3322DCB0B82F}	msiexec.exe
File created	C:\Windows\Installer\e59c4fb.msi	msiexec.exe
File created	C:\Windows\Installer\e59c4e6.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{35A2AF4F-C504-4D2A-A025-F69379ECDF07}	msiexec.exe
File created	C:\Windows\Installer\e59c504.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e59c4e1.msi	msiexec.exe
File created	C:\Windows\Installer\e59c4f6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59c500.msi	msiexec.exe
File created	C:\Windows\Installer\e59c4f0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59c4fb.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e59c4e2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59c4e2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICE53.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59c4ec.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6AE9.tmp	msiexec.exe
File created	C:\Windows\Installer\e59c4fa.msi	msiexec.exe
File created	C:\Windows\Installer\e59c509.msi	msiexec.exe
File created	C:\Windows\Installer\e59c505.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE77B.tmp	msiexec.exe
File created	C:\Windows\Installer\e59c4f5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC922.tmp	msiexec.exe
File created	C:\Windows\Installer\e59c4ff.msi	msiexec.exe
File created	C:\Windows\Installer\e59c4eb.msi	msiexec.exe
File created	C:\Windows\pyshellext.amd64.dll	msiexec.exe
File created	C:\Windows\pyw.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9802C929-A3F0-480D-A4B2-DAD129F2236E}	msiexec.exe
File opened for modification	C:\Windows\Installer\e59c4e7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59c4f1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6A8A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDEE1.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000004e6fa88768ff2e40000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000004e6fa880000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090004e6fa88000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d04e6fa88000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000004e6fa8800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{F115E5B8-9719-4BDF-8B0D-551809BB677D}\Dependents\{e8531749-5517-4937-a722-a4052cb2d75e}	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\CPython-3.10\Dependents\{e8531749-5517-4937-a722-a4052cb2d75e}	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Python.File\Shell\editwithidle\shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{59ED0114-0C86-4B18-83E2-929AD7D232AD}\Version = "3.10.9150.0"	python-installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shellex	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit310	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{E2BC2EBD-7260-458B-A42C-3322DCB0B82F}\Version = "3.10.9150.0"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{0CBB496F-1D15-42F1-AA45-C01C95196EC8}	python-installer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pyz	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{067C6FFC-0FD1-4F3A-8E94-58F091BCC0D5}\Dependents\{e8531749-5517-4937-a722-a4052cb2d75e}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{067C6FFC-0FD1-4F3A-8E94-58F091BCC0D5}\Version = "3.10.9150.0"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{E2BC2EBD-7260-458B-A42C-3322DCB0B82F}\Dependents\{e8531749-5517-4937-a722-a4052cb2d75e}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Python.NoConFile\Shell\editwithidle\MUIVerb = "&Edit with IDLE"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{0CBB496F-1D15-42F1-AA45-C01C95196EC8}	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{9802C929-A3F0-480D-A4B2-DAD129F2236E}	python-installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F4FA2A53405CA2D40A526F3997CEFD70\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F4FA2A53405CA2D40A526F3997CEFD70\SourceList\PackageName = "launcher.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F4FA2A53405CA2D40A526F3997CEFD70\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Python.NoConFile\Shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{92CFA54C-9CE5-4284-83FD-1D0B8AB2AB69}\Dependents\{e8531749-5517-4937-a722-a4052cb2d75e}	python-installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pyw	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{1F097B66-81E9-46FB-BBAC-315C5F50CF94}\DisplayName = "Python 3.10.9 Utility Scripts (64-bit)"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\CPython-3.10\Dependents	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{F115E5B8-9719-4BDF-8B0D-551809BB677D}\DisplayName = "Python 3.10.9 Executables (64-bit)"	python-installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F4FA2A53405CA2D40A526F3997CEFD70\AssociateFiles	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{F115E5B8-9719-4BDF-8B0D-551809BB677D}\ = "{F115E5B8-9719-4BDF-8B0D-551809BB677D}"	python-installer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.CompiledFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.File\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Python.File	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell\open\command\ = "\"C:\\Windows\\py.exe\" \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F4FA2A53405CA2D40A526F3997CEFD70\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{59ED0114-0C86-4B18-83E2-929AD7D232AD}\DisplayName = "Python 3.10.9 Add to Path (64-bit)"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{92CFA54C-9CE5-4284-83FD-1D0B8AB2AB69}\DisplayName = "Python 3.10.9 Tcl/Tk Support (64-bit)"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{59ED0114-0C86-4B18-83E2-929AD7D232AD}\ = "{59ED0114-0C86-4B18-83E2-929AD7D232AD}"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{F115E5B8-9719-4BDF-8B0D-551809BB677D}	python-installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\ = "Python File (no console)"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{067C6FFC-0FD1-4F3A-8E94-58F091BCC0D5}	python-installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{067C6FFC-0FD1-4F3A-8E94-58F091BCC0D5}\Dependents\{e8531749-5517-4937-a722-a4052cb2d75e}	python-installer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3350690463-3549324357-1323838019-1000\{2007C1C0-AD99-4685-B715-9EBEF9FD2072}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{59ED0114-0C86-4B18-83E2-929AD7D232AD}\DisplayName = "Python 3.10.9 Add to Path (64-bit)"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Python.File\Shell\editwithidle\shell\edit310\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Python310\\pythonw.exe\" -m idlelib \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Python.File\Shell\editwithidle\shell\edit310\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{59ED0114-0C86-4B18-83E2-929AD7D232AD}\Dependents	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{92CFA54C-9CE5-4284-83FD-1D0B8AB2AB69}	python-installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Python.File\Shell\editwithidle\shell\edit310	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit310\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\CPython-3.10\Version = "3.10.9150.0"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{0CBB496F-1D15-42F1-AA45-C01C95196EC8}\Version = "3.10.9150.0"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit310\MUIVerb = "Edit with IDLE 3.10 (64-bit)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F4FA2A53405CA2D40A526F3997CEFD70\DeploymentFlags = "2"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{1F097B66-81E9-46FB-BBAC-315C5F50CF94}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Installer\Dependencies\{067C6FFC-0FD1-4F3A-8E94-58F091BCC0D5}\Version = "3.10.9150.0"	python-installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.py\Content Type = "text/x-python"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConArchiveFile\shell\open\command	msiexec.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
3168	msedge.exe
3168	msedge.exe
456	identity_helper.exe
456	identity_helper.exe
4344	msedge.exe
4344	msedge.exe
5360	powershell.exe
5360	powershell.exe
5360	powershell.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
4784	msiexec.exe
4784	msiexec.exe
4784	msiexec.exe
4784	msiexec.exe
4784	msiexec.exe
4784	msiexec.exe
4784	msiexec.exe
4784	msiexec.exe
4784	msiexec.exe
4784	msiexec.exe
4784	msiexec.exe
4784	msiexec.exe
4784	msiexec.exe
4784	msiexec.exe
4784	msiexec.exe
4784	msiexec.exe
4784	msiexec.exe
4784	msiexec.exe
2472	msedge.exe
2472	msedge.exe
3008	msedge.exe
3008	msedge.exe
4004	powershell.exe
4004	powershell.exe
3436	msiexec.exe
3436	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5360	powershell.exe
Token: SeBackupPrivilege	3848	vssvc.exe
Token: SeRestorePrivilege	3848	vssvc.exe
Token: SeAuditPrivilege	3848	vssvc.exe
Token: SeShutdownPrivilege	1524	python-installer.exe
Token: SeIncreaseQuotaPrivilege	1524	python-installer.exe
Token: SeSecurityPrivilege	4784	msiexec.exe
Token: SeCreateTokenPrivilege	1524	python-installer.exe
Token: SeAssignPrimaryTokenPrivilege	1524	python-installer.exe
Token: SeLockMemoryPrivilege	1524	python-installer.exe
Token: SeIncreaseQuotaPrivilege	1524	python-installer.exe
Token: SeMachineAccountPrivilege	1524	python-installer.exe
Token: SeTcbPrivilege	1524	python-installer.exe
Token: SeSecurityPrivilege	1524	python-installer.exe
Token: SeTakeOwnershipPrivilege	1524	python-installer.exe
Token: SeLoadDriverPrivilege	1524	python-installer.exe
Token: SeSystemProfilePrivilege	1524	python-installer.exe
Token: SeSystemtimePrivilege	1524	python-installer.exe
Token: SeProfSingleProcessPrivilege	1524	python-installer.exe
Token: SeIncBasePriorityPrivilege	1524	python-installer.exe
Token: SeCreatePagefilePrivilege	1524	python-installer.exe
Token: SeCreatePermanentPrivilege	1524	python-installer.exe
Token: SeBackupPrivilege	1524	python-installer.exe
Token: SeRestorePrivilege	1524	python-installer.exe
Token: SeShutdownPrivilege	1524	python-installer.exe
Token: SeDebugPrivilege	1524	python-installer.exe
Token: SeAuditPrivilege	1524	python-installer.exe
Token: SeSystemEnvironmentPrivilege	1524	python-installer.exe
Token: SeChangeNotifyPrivilege	1524	python-installer.exe
Token: SeRemoteShutdownPrivilege	1524	python-installer.exe
Token: SeUndockPrivilege	1524	python-installer.exe
Token: SeSyncAgentPrivilege	1524	python-installer.exe
Token: SeEnableDelegationPrivilege	1524	python-installer.exe
Token: SeManageVolumePrivilege	1524	python-installer.exe
Token: SeImpersonatePrivilege	1524	python-installer.exe
Token: SeCreateGlobalPrivilege	1524	python-installer.exe
Token: SeRestorePrivilege	4784	msiexec.exe
Token: SeTakeOwnershipPrivilege	4784	msiexec.exe
Token: SeRestorePrivilege	4784	msiexec.exe
Token: SeTakeOwnershipPrivilege	4784	msiexec.exe
Token: SeRestorePrivilege	4784	msiexec.exe
Token: SeTakeOwnershipPrivilege	4784	msiexec.exe
Token: SeRestorePrivilege	4784	msiexec.exe
Token: SeTakeOwnershipPrivilege	4784	msiexec.exe
Token: SeRestorePrivilege	4784	msiexec.exe
Token: SeTakeOwnershipPrivilege	4784	msiexec.exe
Token: SeRestorePrivilege	4784	msiexec.exe
Token: SeTakeOwnershipPrivilege	4784	msiexec.exe
Token: SeRestorePrivilege	4784	msiexec.exe
Token: SeTakeOwnershipPrivilege	4784	msiexec.exe
Token: SeRestorePrivilege	4784	msiexec.exe
Token: SeTakeOwnershipPrivilege	4784	msiexec.exe
Token: SeRestorePrivilege	4784	msiexec.exe
Token: SeTakeOwnershipPrivilege	4784	msiexec.exe
Token: SeRestorePrivilege	4784	msiexec.exe
Token: SeTakeOwnershipPrivilege	4784	msiexec.exe
Token: SeRestorePrivilege	4784	msiexec.exe
Token: SeTakeOwnershipPrivilege	4784	msiexec.exe
Token: SeRestorePrivilege	4784	msiexec.exe
Token: SeTakeOwnershipPrivilege	4784	msiexec.exe
Token: SeRestorePrivilege	4784	msiexec.exe
Token: SeTakeOwnershipPrivilege	4784	msiexec.exe
Token: SeRestorePrivilege	4784	msiexec.exe
Token: SeTakeOwnershipPrivilege	4784	msiexec.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
1524	python-installer.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
5628	python-installer.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 2728	3168	msedge.exe	87
PID 3168 wrote to memory of 2728	3168	msedge.exe	87
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 2864	3168	msedge.exe	88
PID 3168 wrote to memory of 1612	3168	msedge.exe	89
PID 3168 wrote to memory of 1612	3168	msedge.exe	89
PID 3168 wrote to memory of 1164	3168	msedge.exe	90
PID 3168 wrote to memory of 1164	3168	msedge.exe	90
PID 3168 wrote to memory of 1164	3168	msedge.exe	90
PID 3168 wrote to memory of 1164	3168	msedge.exe	90
PID 3168 wrote to memory of 1164	3168	msedge.exe	90
PID 3168 wrote to memory of 1164	3168	msedge.exe	90
PID 3168 wrote to memory of 1164	3168	msedge.exe	90
PID 3168 wrote to memory of 1164	3168	msedge.exe	90
PID 3168 wrote to memory of 1164	3168	msedge.exe	90
PID 3168 wrote to memory of 1164	3168	msedge.exe	90
PID 3168 wrote to memory of 1164	3168	msedge.exe	90
PID 3168 wrote to memory of 1164	3168	msedge.exe	90
PID 3168 wrote to memory of 1164	3168	msedge.exe	90
PID 3168 wrote to memory of 1164	3168	msedge.exe	90
PID 3168 wrote to memory of 1164	3168	msedge.exe	90
PID 3168 wrote to memory of 1164	3168	msedge.exe	90
PID 3168 wrote to memory of 1164	3168	msedge.exe	90
PID 3168 wrote to memory of 1164	3168	msedge.exe	90
PID 3168 wrote to memory of 1164	3168	msedge.exe	90
PID 3168 wrote to memory of 1164	3168	msedge.exe	90

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/addi00000/empyrean
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd600646f8,0x7ffd60064708,0x7ffd60064718
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3516 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3528 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2392 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1776 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7008 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7036 /prefetch:8
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7536 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7388 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7564 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7964413840652605451,8755547482649337227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:4348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2180

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\empyrean-main\empyrean-main\build.bat" "
1⤵
PID:4884
- C:\Windows\system32\mode.com
  mode con: cols=100 lines=30
  2⤵
  PID:3832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\empyrean-main\empyrean-main\build.bat" "
1⤵
PID:5400
- C:\Windows\system32\mode.com
  mode con: cols=100 lines=30
  2⤵
  PID:5504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\empyrean-main\empyrean-main\build.bat" "
1⤵
PID:4588
- C:\Windows\system32\mode.com
  mode con: cols=100 lines=30
  2⤵
  PID:1692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\empyrean-main\empyrean-main\build.bat" "
1⤵
PID:416
- C:\Windows\system32\mode.com
  mode con: cols=100 lines=30
  2⤵
  PID:2664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\empyrean-main\empyrean-main\build.bat" "
1⤵
PID:5776
- C:\Windows\system32\mode.com
  mode con: cols=100 lines=30
  2⤵
  PID:5820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\empyrean-main\empyrean-main\build.bat" "
1⤵
PID:2780
- C:\Windows\system32\mode.com
  mode con: cols=100 lines=30
  2⤵
  PID:5840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\empyrean-main\empyrean-main\build.bat" "
1⤵
PID:5996
- C:\Windows\system32\mode.com
  mode con: cols=100 lines=30
  2⤵
  PID:5880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\empyrean-main\empyrean-main\install_python.bat" "
1⤵
PID:3444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest https://www.python.org/ftp/python/ -UseBasicParsing | Select-String -Pattern '3.10.[0-9]{1,2}' -AllMatches | Select-Object -ExpandProperty Matches | Select-Object -ExpandProperty Value | Sort-Object -Descending -Unique | Select-Object -First 1"
  2⤵
  PID:6072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest https://www.python.org/ftp/python/ -UseBasicParsing | Select-String -Pattern '3.10.[0-9]{1,2}' -AllMatches | Select-Object -ExpandProperty Matches | Select-Object -ExpandProperty Value | Sort-Object -Descending -Unique | Select-Object -First 1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5360
- C:\Windows\system32\curl.exe
  curl -L -o python-installer.exe https://www.python.org/ftp/python/3.10.9/python-3.10.9-amd64.exe
  2⤵
  PID:3800
- C:\Users\Admin\Downloads\empyrean-main\empyrean-main\python-installer.exe
  python-installer.exe /quiet /passive InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
  2⤵
  - Executes dropped EXE
  PID:5156
- - C:\Windows\Temp\{1F147179-12C7-4A14-81F6-04F9C8D69AE9}\.cr\python-installer.exe
    "C:\Windows\Temp\{1F147179-12C7-4A14-81F6-04F9C8D69AE9}\.cr\python-installer.exe" -burn.clean.room="C:\Users\Admin\Downloads\empyrean-main\empyrean-main\python-installer.exe" -burn.filehandle.attached=528 -burn.filehandle.self=556 /quiet /passive InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1524
  - - C:\Windows\Temp\{CEB82E0C-D505-49CA-89D8-26A5F4C1AA21}\.be\python-3.10.9-amd64.exe
      "C:\Windows\Temp\{CEB82E0C-D505-49CA-89D8-26A5F4C1AA21}\.be\python-3.10.9-amd64.exe" -q -burn.elevated BurnPipe.{2052EBD2-6516-47E7-967B-4628FD6224EC} {50BC3215-C998-4728-9DF7-14EDF6EC53EE} 1524
      4⤵
      Executes dropped EXE
      PID:3988

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3848

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:2812

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4784
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E9508E03CF519FB6615FF39A275E0B4D
  2⤵
  - Loads dropped DLL
  PID:1964
- - C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" -E -s -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3832
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpf082mc62\\setuptools-65.5.0-py3-none-any.whl', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpf082mc62\\pip-22.3.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpf082mc62', '--upgrade', 'setuptools', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5880
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:64

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\empyrean-main\empyrean-main\build.bat" "
1⤵
PID:6008
- C:\Windows\system32\mode.com
  mode con: cols=100 lines=30
  2⤵
  PID:3360
- C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe
  python --version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4956
- C:\Windows\system32\findstr.exe
  findstr " 3.11"
  2⤵
  PID:3684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\empyrean-main\empyrean-main\build.bat" "
1⤵
PID:2976
- C:\Windows\system32\mode.com
  mode con: cols=100 lines=30
  2⤵
  PID:5964
- C:\Windows\system32\findstr.exe
  findstr " 3.11"
  2⤵
  PID:5368
- C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe
  python --version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2612

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3b8 0x2f8
1⤵
PID:6000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\empyrean-main\empyrean-main\build.bat" "
1⤵
PID:3756
- C:\Windows\system32\mode.com
  mode con: cols=100 lines=30
  2⤵
  PID:5036
- C:\Windows\system32\findstr.exe
  findstr " 3.11"
  2⤵
  PID:2044
- C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe
  python --version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\empyrean-main\empyrean-main\build.bat" "
1⤵
PID:3804
- C:\Windows\system32\mode.com
  mode con: cols=100 lines=30
  2⤵
  PID:2136
- C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe
  python --version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1660
- C:\Windows\system32\findstr.exe
  findstr " 3.11"
  2⤵
  PID:2592

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\empyrean-main\empyrean-main\requirements.txt
1⤵
PID:1700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\empyrean-main\empyrean-main\install_python.bat" "
1⤵
PID:2664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest https://www.python.org/ftp/python/ -UseBasicParsing | Select-String -Pattern '3.10.[0-9]{1,2}' -AllMatches | Select-Object -ExpandProperty Matches | Select-Object -ExpandProperty Value | Sort-Object -Descending -Unique | Select-Object -First 1"
  2⤵
  PID:3884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest https://www.python.org/ftp/python/ -UseBasicParsing | Select-String -Pattern '3.10.[0-9]{1,2}' -AllMatches | Select-Object -ExpandProperty Matches | Select-Object -ExpandProperty Value | Sort-Object -Descending -Unique | Select-Object -First 1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:4004
- C:\Windows\system32\curl.exe
  curl -L -o python-installer.exe https://www.python.org/ftp/python/3.10.9/python-3.10.9-amd64.exe
  2⤵
  PID:2108
- C:\Users\Admin\Downloads\empyrean-main\empyrean-main\python-installer.exe
  python-installer.exe /quiet /passive InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
  2⤵
  - Executes dropped EXE
  PID:5364
- - C:\Windows\Temp\{3593F377-AAEA-4282-BB70-CD8276910FCC}\.cr\python-installer.exe
    "C:\Windows\Temp\{3593F377-AAEA-4282-BB70-CD8276910FCC}\.cr\python-installer.exe" -burn.clean.room="C:\Users\Admin\Downloads\empyrean-main\empyrean-main\python-installer.exe" -burn.filehandle.attached=552 -burn.filehandle.self=560 /quiet /passive InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:5628

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\empyrean-main\empyrean-main\build.bat" "
1⤵
PID:3756
- C:\Windows\system32\mode.com
  mode con: cols=100 lines=30
  2⤵
  PID:1932
- C:\Windows\system32\findstr.exe
  findstr " 3.11"
  2⤵
  PID:2136
- C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe
  python --version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery