hxxps://github[.]com/mategol/PySilon-malware/blob/main/builder[.]py

Analysis

max time kernel
1143s
max time network
1173s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/mategol/PySilon-malware/blob/main/builder.py

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
101	raw.githubusercontent.com
102	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2797820639"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31134782"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D25D73E0-8031-11EF-B1C5-D20DFB866B4D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31134782"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31134782"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000068fd66d6220e584abe447a4e1268eb5100000000020000000000106600000001000020000000a45513188bb70ce1dc20986ef868d381400ac88c3814848cb575c41a3848b2e8000000000e8000000002000020000000c3733b7aae2c94fe69a4e7e7aae16333bfd5fb987ffbff8bc3274c935c7de12d20000000bb8e2e23a22d12f649b1af0c023eeb45112ff390b0b3bd47be550c08a83070984000000052da87c81219b0e9a7388529d8b6c8a5584aa29cd83a7a19aba4e319d86ed15ae5cb3287d4a81c142d92526d6d14f732e4574cc686b6ee609356a9d9c0853d09	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2797820639"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2802352308"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ab60a73e14db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000068fd66d6220e584abe447a4e1268eb51000000000200000000001066000000010000200000001b273ed8b1ad2e6881e7836a7ad5d93bad80d06f918f84dab56c80fb56b0e54c000000000e800000000200002000000089288cf9f3242bd39419c398a4fee7e918009a9d389386ee1075a2694602fcf12000000025b8856bda14b53e82fc446fe69662476c47d2a88900454e1b508cd35d3c9f4a40000000e3eca661ab96538808580ed90170bc6ec955906c6f11fc61840d61668cf6c388b26d3e3650910c733d0826abe09afb795f58944c463d1578eefc598415435b3e	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f07f59a73e14db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434578669"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1052	msedge.exe
1052	msedge.exe
1616	msedge.exe
1616	msedge.exe
1496	identity_helper.exe
1496	identity_helper.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
2220	msedge.exe
2220	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
528	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
2176	iexplore.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
528	OpenWith.exe
2176	iexplore.exe
2176	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 3404	1616	msedge.exe	82
PID 1616 wrote to memory of 3404	1616	msedge.exe	82
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 2260	1616	msedge.exe	83
PID 1616 wrote to memory of 1052	1616	msedge.exe	84
PID 1616 wrote to memory of 1052	1616	msedge.exe	84
PID 1616 wrote to memory of 3976	1616	msedge.exe	85
PID 1616 wrote to memory of 3976	1616	msedge.exe	85
PID 1616 wrote to memory of 3976	1616	msedge.exe	85
PID 1616 wrote to memory of 3976	1616	msedge.exe	85
PID 1616 wrote to memory of 3976	1616	msedge.exe	85
PID 1616 wrote to memory of 3976	1616	msedge.exe	85
PID 1616 wrote to memory of 3976	1616	msedge.exe	85
PID 1616 wrote to memory of 3976	1616	msedge.exe	85
PID 1616 wrote to memory of 3976	1616	msedge.exe	85
PID 1616 wrote to memory of 3976	1616	msedge.exe	85
PID 1616 wrote to memory of 3976	1616	msedge.exe	85
PID 1616 wrote to memory of 3976	1616	msedge.exe	85
PID 1616 wrote to memory of 3976	1616	msedge.exe	85
PID 1616 wrote to memory of 3976	1616	msedge.exe	85
PID 1616 wrote to memory of 3976	1616	msedge.exe	85
PID 1616 wrote to memory of 3976	1616	msedge.exe	85
PID 1616 wrote to memory of 3976	1616	msedge.exe	85
PID 1616 wrote to memory of 3976	1616	msedge.exe	85
PID 1616 wrote to memory of 3976	1616	msedge.exe	85
PID 1616 wrote to memory of 3976	1616	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/mategol/PySilon-malware/blob/main/builder.py
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffb5b46f8,0x7ffffb5b4708,0x7ffffb5b4718
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,18138293130390311298,18295090962894776987,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,18138293130390311298,18295090962894776987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,18138293130390311298,18295090962894776987,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,18138293130390311298,18295090962894776987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,18138293130390311298,18295090962894776987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,18138293130390311298,18295090962894776987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,18138293130390311298,18295090962894776987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,18138293130390311298,18295090962894776987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,18138293130390311298,18295090962894776987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,18138293130390311298,18295090962894776987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,18138293130390311298,18295090962894776987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,18138293130390311298,18295090962894776987,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5132 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,18138293130390311298,18295090962894776987,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,18138293130390311298,18295090962894776987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,18138293130390311298,18295090962894776987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4580

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:528
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\builder.py
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2176
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
016cd32e20f4781f6d5d72242e0641a0

SHA1
cbe4f156e692376dbbe60ca590a2777cb1d5cddf

SHA256
3640e01273102b46ab15acc8e2cdc4b76a3fcb12d6c9b0aab1d9a406d93b5857

SHA512
1e207d85b9ac7c06da816c0546fdac1e065b95cdb24700482d284db9001ec6fe20c555579a62b099d7f8ad9e0f84107d180cf9cfc5438e2cdff7eab547b1668f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
409B

MD5
8194ed25dbd9488193ea0891ba2a1d61

SHA1
1602608cba6eb29c098a3cc75373719ff803b46d

SHA256
f8061a62c10c0c68205a93c4797fc675334a13bdd4bcd3e4dfbcdf67293060e4

SHA512
2882eef26bfaefffc3d268b418ff128422b2e9055f6fc560b1146bb121e39926e83cf04ea5c648425e2906c37a5a695447fbb4ce3ff2cef7a8aaf25421fef995

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
492B

MD5
9a6ce27b8d0b8451401204291e83d579

SHA1
0a94eaae0e37289b3ab5c634d886579f01f8cbab

SHA256
475dd5afca6828b19833bdabdc3d287a2a147dd8d6e8abeb42f5927e3ed903af

SHA512
bcc5cb6b95208daf67402adbab62269fa29f6406d88c5759344887c109285ab59625f94f139fe92fa4dcea2151d7e3d2455484272ed6399370e4452724497785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eca9ccd8592870cda21a84a1c8d9056d

SHA1
7a71fb4e9a802deb3fa4caa69597dd0ca21a7026

SHA256
a868574f834ac731a836b7c5df4f990b189479122720ab50327945d4dd7550dd

SHA512
93d65a1793743e431b1c6aa7115906080bc4857d4b226a9e45aa7d56b0120fdf412fff21a9baacf27f2a8df0e67358733da490b18ec01af475a1a26656b8931d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7c9a0129a68b34cc2f7522838fddbc7c

SHA1
a9ccc1270db476e6ff3e31a5db5fc4aec0fd3434

SHA256
1dc9d59ea7db8d723ee0201e39d0c8f6b051b4d5cc33ac06685f7b5a4185cd07

SHA512
2c2266a2182b170564a59d9d269e566877357dcac47a8230be854370790683b881cd621d474d16aeda653477fea0e45a4afc161188eab58235a897c075515069

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
24ec19a770832d9b33a225003a6625e8

SHA1
a1ac66c9aeaa62df07f1f7fffceacf3c644df86a

SHA256
d31436cd08ed4e8552b7da0e01c8907589882bfef94d4ae372fc34cd3664c8df

SHA512
c4e41683b900862a5268ec371e7190252e097fbbdc7ed8f32989d7d959f8ee25440729993e72c608fbe6685a4604ec0958ce179489d5a56b4f2c1205e0c25bbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
8f8005a607c59f40a693acbd5ade92bd

SHA1
4b7a1e07f59364c9a964a14c502d5f5945a9ee19

SHA256
dc7111362d66b8a8639a69ce34cf3fef112594c9f8cbc1477836c391a9dda91c

SHA512
1b6d3dca505ee69abeaa50299f936d171c001bccb1f30df22e110fd1267ac0b38989ae8736f133f7e1a43dfb010cd77a14ecc309abf56937316bdaac32f518cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
c3101eff0939f1c380453fac58825020

SHA1
e0f9cd9339ac6b348c39d9fe78c99c97b00b3a1b

SHA256
1cd1a0d18b744a56a8e08051b92d57a63042b67c07f0ff444f6b76297f5bf0d4

SHA512
092f6e312a2a08a6e31fe7cceda53630845e561154d06d3e1f6e70332dc2d23e7bed3f8dfb8988f0b4a995ae4230e900497b58778e1deca9152e52e5805cdab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5bd27f.TMP

Filesize
706B

MD5
021b42bac45a00b6d630fd9c015126e2

SHA1
85e119f0e91369bf879287ac75fdb25e6c82f41b

SHA256
f7862e86212f383ac05828ff29bc9b9a6c2835a5d0976fb4f01864ebc96bd04c

SHA512
030bc600da006a4517aefdff477149308cbd0018f11b014526f264e1c042de638ae28c032bab617d3c5a5b8cfa38339165d6b7a02b85c3dc6287575261648556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ea5c3c02b40ac173cfa8b3992531e215

SHA1
903362c1ccd07ecff415f5e964f0ebd03029e5cb

SHA256
d4b12895386752256d1537bb99e30fb568911a641000aa9615482c366454981f

SHA512
2c1d4672c060e638db550a49f5021f2fb41f8738e1ace09ef0db90bef30d66b420b950075f583b47d991fb6bd3405b476a6dd31d804102f9d7e458087e120978

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
40b6be015cf8157de2ddf21a71dcb2f7

SHA1
88e009eddf422bfada0357235dcef2c8ef86458c

SHA256
8ca35728946ac4ecbe152aea745fcdfd8f75c89065bb92f3af3afd72ba63ccfe

SHA512
b3ffc88831be7946195801f5c723470bd41b865db87d4699ca0099325f231a1083796b8482e20e95cd1b462c4d39c926ed00306a44b0c0e0a0a1fea86194e4e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LNHEOAK4\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\Downloads\builder.py

Filesize
30KB

MD5
f011ab09f5e640bbf339d9edd93e2739

SHA1
cfe055600b42ed2eb3b77c3f9632301cd4c3e6dd

SHA256
443bd85e3bf8d6a5880400025047933bf58e7cccdb9f1c7585fc6932113f2fdb

SHA512
bdae087b6fa1a781805fa8a1a2b248e23226261bb4be179dcf1b762f0a1241f7d697797434f23e0820ab39b4c6156c9b4674383cdfb251ce346351132b6ee3b3

Download Submit