070a15cad3562150c99b4a915d3383dfd557b146c86f1c9cd9809b1066301056

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EdgewarePlusPlus-20/edgeware/EdgewareSetup.bat
Size 3KB
Sample260529-e3wffac121
SHA256 070a15cad3562150c99b4a915d3383dfd557b146c86f1c9cd9809b1066301056
MD5 137815f705e60a9f76d619b03ef6af82
SHA1 540f8eb353d7d097588a09c29591cf661713c876
SHA512 05a212042b6ee3b1b276a8ecd4688a555280cff195ee645d6e772048e8f1b34643a6817246e8537fa614e2daa201bba8a62f9cbd70fd5ad17c27d566f4066cb7
TLSH
T10E61973FB348143E6CECC1A9CD0A21A5BB4361A751281DB670BB50642DC339A76B668F
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2212	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2212	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1628	pyinstaller.exe
684	pyinstaller.exe

Loads dropped DLL 1 IoCs

pid	Process
684	pyinstaller.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pyinstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pyinstaller.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	reg.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2212	powershell.exe
2212	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2212	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 4028	664	cmd.exe	81
PID 664 wrote to memory of 3504	664	cmd.exe	82
PID 664 wrote to memory of 2212	664	cmd.exe	83
PID 664 wrote to memory of 1628	664	cmd.exe	84
PID 1628 wrote to memory of 684	1628	pyinstaller.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\EdgewarePlusPlus-20\edgeware\EdgewareSetup.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:664
- C:\Windows\system32\reg.exe
  reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
  2⤵
  - Checks processor information in registry
  PID:4028
- C:\Windows\system32\find.exe
  find /i "x86"
  2⤵
  PID:3504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Invoke-WebRequest https://www.python.org/ftp/python/3.12.6/python-3.12.6-amd64.exe -OutFile pyinstaller.exe"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2212
- C:\Users\Admin\AppData\Local\Temp\EdgewarePlusPlus-20\edgeware\pyinstaller.exe
  C:\Users\Admin\AppData\Local\Temp\EdgewarePlusPlus-20\edgeware\pyinstaller.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\Temp\{D4309661-9729-4D21-A329-A67C68977CEE}\.cr\pyinstaller.exe
    "C:\Windows\Temp\{D4309661-9729-4D21-A329-A67C68977CEE}\.cr\pyinstaller.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\EdgewarePlusPlus-20\edgeware\pyinstaller.exe" -burn.filehandle.attached=568 -burn.filehandle.self=576
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pyinstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\EdgewarePlusPlus-20\edgeware\pyinstaller.exe
Size 25.3MB
SHA256 5914748e6580e70bedeb7c537a0832b3071de9e09a2e4e7e3d28060616045e0a
MD5 d8548aa7609a762ba66f62eeb2ca862d
SHA1 2eb85b73cab52693d3a27446b7de1c300cc05655
SHA512 37fa7250b10b0c03b87d800bf4f920589649309cb4fbd25864475084bb7873d62b809a4fdeabd06c79f03f33614218eb7e01a9bd796de29dd3b141f1906d588c
SSDEEP 786432:C12KqmYUrVZDMyjmI1aSGGRRKZOTv1U73X0AIumL0un:HKLYU/YHI1PGG/KZOT9Q3Ex5P
TLSH
T10347333381A6812BEBB241F3FA25D2306D3C7E24075189ABF3D4FCA52E754932677166
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_jz0b5whe.zws.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jz0b5whe.zws.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PythonBA.dll

Path C:\Windows\Temp\{77D32430-6FE7-4668-B3A7-64158AC3B5FD}\.ba\PythonBA.dll
Size 675KB
SHA256 edc6db3712eb4e1cd6988bc7b42c467ac6901148f3ee4bdfb286eff26efbfd43
MD5 8c8e5a5ca0483abdc6ad6ef22c73b5d2
SHA1 9b7345ab1b60bb3fb37c9dc7f331155b4441e4dc
SHA512 861ad726872b58e5b8b7c580b485e7bde0be6c1963ac23db63d4105684d1e50e8f409cd329f183d252a52e2be2737efaf9e4413eff29deee75b87850664b3157
SSDEEP 6144:j7OyHTzZfBPqX7kfKAZ6voOYAnkmH8BtukJnFUsA3LkT45Wwv:jayHXZhqX7kyAkvoztukJIwU5v
TLSH
T1D5E48D1174C08275EDF620BB46BC763A46ADE1B00734D9CB1BC81AFAEA215C29F37657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SideBar.png

Path C:\Windows\Temp\{77D32430-6FE7-4668-B3A7-64158AC3B5FD}\.ba\SideBar.png
Size 50KB
SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
MD5 888eb713a0095756252058c9727e088a
SHA1 c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4
SHA512 7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0
SSDEEP 1536:/c/aRsg1fYfJt0Bg74nWPMMCNBaeQzxxj8ckBo:UcsgGfP0yCWTAaeyxxjGBo
TLSH
T1F33302E488115E7BCBE33A0615458CEF4EA9215F976C91886971C7CA5842F0CE3FE9D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyinstaller.exe

Path C:\Windows\Temp\{D4309661-9729-4D21-A329-A67C68977CEE}\.cr\pyinstaller.exe
Size 858KB
SHA256 1dcf770dc47264f7495a559f786a4428f3a97f9d81e4c466ec9a5636f5a1be6d
MD5 931227a65a32cebf1c10a99655ad7bbd
SHA1 1b874fdef892a2af2501e1aaea3fcafb4b4b00c6
SHA512 0212b5adc6ee8893edf4b94272fdffe145f53fe31357a3e024543f434cdc022a915d76780c1103aa9948feca5f161cfae608f91f3c7a876569e91c05d690d507
SSDEEP 12288:U5mWukhI2jFMSjysAS9X/GsfTDYrGilGEHNBro2Dq4o+sQqlEEWFT6NNAlaSw:U5mWpI2jFM5sFzfTpilGyNNGp+uuuA4
TLSH
T1D715BF3265A14072FBF10573BA28D530BD2CAF281750C9AEE3D4BE1D7E7849267B7252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2212-0-0x0000013240C30000-0x0000013240C40000-memory.dmp

Download

memory/2212-7-0x0000013243A30000-0x0000013243A52000-memory.dmp

Download

memory/2212-8-0x0000013240C30000-0x0000013240C40000-memory.dmp

Download

memory/2212-9-0x0000013240C30000-0x0000013240C40000-memory.dmp

Download

memory/2212-10-0x0000013240C30000-0x0000013240C40000-memory.dmp

Download