Analysis
-
max time kernel
1799s -
max time network
1685s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
27-04-2024 22:11
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/addi00000/empyrean
Resource
win11-20240426-en
General
-
Target
https://github.com/addi00000/empyrean
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
Processes:
flow ioc 20 camo.githubusercontent.com 21 camo.githubusercontent.com 22 camo.githubusercontent.com 2 raw.githubusercontent.com 13 camo.githubusercontent.com 17 camo.githubusercontent.com 18 camo.githubusercontent.com 19 camo.githubusercontent.com -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133587305118669336" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 3928 chrome.exe 3928 chrome.exe 4600 chrome.exe 4600 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 3928 chrome.exe 3928 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe Token: SeShutdownPrivilege 3928 chrome.exe Token: SeCreatePagefilePrivilege 3928 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
chrome.exepid process 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe 3928 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3928 wrote to memory of 3024 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 3024 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 1288 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 4812 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 4812 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe PID 3928 wrote to memory of 2576 3928 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/addi00000/empyrean1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xe4,0xe8,0xdc,0xe0,0x10c,0x7ffb954eab58,0x7ffb954eab68,0x7ffb954eab782⤵PID:3024
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1800,i,12207340381312323997,13281563309608973221,131072 /prefetch:22⤵PID:1288
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1800,i,12207340381312323997,13281563309608973221,131072 /prefetch:82⤵PID:4812
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2092 --field-trial-handle=1800,i,12207340381312323997,13281563309608973221,131072 /prefetch:82⤵PID:2576
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1800,i,12207340381312323997,13281563309608973221,131072 /prefetch:12⤵PID:4816
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1800,i,12207340381312323997,13281563309608973221,131072 /prefetch:12⤵PID:4976
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 --field-trial-handle=1800,i,12207340381312323997,13281563309608973221,131072 /prefetch:82⤵PID:4832
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4460 --field-trial-handle=1800,i,12207340381312323997,13281563309608973221,131072 /prefetch:82⤵PID:4932
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=872 --field-trial-handle=1800,i,12207340381312323997,13281563309608973221,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4600
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3132
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD585e07f78e7e13c3aba44aa4bd56d0083
SHA1f6795afe2913a648dc65798a855714ed0f0eee73
SHA2561b856070f6550feddb50d5f8e8b4b64dfa2bca15f7e1220d0a40423ea112b263
SHA5123fa9061ef9d22e6f582147b7e62325e343650c23723aaf2535dae2a236e3dd83d492fc44fe5550ba89408d7947b0d73232597911e72c394efa1101e428311c7a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD549200cd6713e5d37cc95f78df020c03e
SHA1a5cd9083ae8509e1888c0edb6e23e77ac3d6797f
SHA2564926c933a28a1d24242fa22ec4b511be6f4380ed6c451e4d52b2c8721a46b26d
SHA5129948bd65b9718333cd2510612f78f0cff5ae6df601935b0446284b77958ccaf397af772b1c08a4db493e67e975865402b2460486c34214177a1878e4b1433bfc
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5459dbcfb99b8de4eca7f3fdfc6eb15f0
SHA168bea711c6c80cf5c5c4d10fd41cee24d3ed0f2d
SHA2560d49ea5e6d12287eb713ecd7db969684553b15bccea7aae5c0a3cef22ea5903c
SHA5126ee1910fbd479766df5c72771b927c32263221dbe7e70586676f801ee011fa71c5712fd7a9f8424e561cb785b500dc2d73dc343e1efcc9abad54a34c7e7249c8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD569ab6eaf2872135e9ddcb6cb35ec801d
SHA186d7a3fbe6d12a84804babcb769bb7b9aa031ac7
SHA25655f5eaf79fa1a641f9b67b878fd6947aa7b73d77d4fbc8ed72d9f71ebeee9227
SHA512882dfe76ecc5381b5b7d21b6a5b49aa370885833434f3bd5c2eb2ef6f09a7b7106e3c949e26301f36d133f88f142cec7585b67cdcd3e947299fc182723295763
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
130KB
MD572211fc072202582485d04939d0617f7
SHA1c50cb5a6784dfb9edb925be7123511b7738cff1e
SHA2566c070e5cab734305d650e94e6f839bc243ade933dfa9489874851c63b861dd87
SHA512440c56249fe9010ae6cfbd605b3426be235b63b5b14d7278b065a685bf974d2a9d2955ca32b31cac4551932a31aa5df36b3f271753aef797bf9145634e97f417
-
\??\pipe\crashpad_3928_ZEWAVEODDAWGIAFZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e