e1da9f6888a9d595fecf41cbd69ea1a7a236734ce796390350dc6580c3178e20

Analysis

user interaction
yes
max time kernel
66s
max time network
70s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pysilon.exe
Size 6.9MB
Sample260919-xe2awsen21
SHA256 e1da9f6888a9d595fecf41cbd69ea1a7a236734ce796390350dc6580c3178e20
MD5 47ef213ec59ad61ce645ac279ac83228
SHA1 da59f0fddf64419c783bd4d2cb9c8c0818812284
SHA512 1ff70bd384c9e8a107f8fc82a3ea833d1a5b2acc6a199fe85765e744bd755e5dfa59b2e2e1f2d3610cf9f6e578cd85a2b941c7bcc9cf8e1cf45262aba1fcf3c9
SSDEEP 49152:5zCnz6QsglAaBKeFXoqNn5NHtOcctP8wsbJ6pWBxMmfuxjtJdb2HX/OD1zWEo4B+:5GkMXnNWP8v0Jg/s9JZ3mzn+5
TLSH
T1D8767C43F3A581E8C4AEC878935BA63BF7327C8E0924729B5BE04B122F65B905F1D745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3952	powershell.exe
252	powershell.exe
1972	powershell.exe
2832	powershell.exe
3396	powershell.exe
1508	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\pysilon.exe\""	pysilon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\pysilon.exe\""	pysilon.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
3	discord.com
4	discord.com

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1972	powershell.exe
1972	powershell.exe
2832	powershell.exe
2832	powershell.exe
2832	powershell.exe
3952	powershell.exe
3952	powershell.exe
3952	powershell.exe
252	powershell.exe
252	powershell.exe
252	powershell.exe
3396	powershell.exe
3396	powershell.exe
3396	powershell.exe
1508	powershell.exe
1508	powershell.exe
1508	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeIncreaseQuotaPrivilege	1972	powershell.exe
Token: SeSecurityPrivilege	1972	powershell.exe
Token: SeTakeOwnershipPrivilege	1972	powershell.exe
Token: SeLoadDriverPrivilege	1972	powershell.exe
Token: SeSystemProfilePrivilege	1972	powershell.exe
Token: SeSystemtimePrivilege	1972	powershell.exe
Token: SeProfSingleProcessPrivilege	1972	powershell.exe
Token: SeIncBasePriorityPrivilege	1972	powershell.exe
Token: SeCreatePagefilePrivilege	1972	powershell.exe
Token: SeBackupPrivilege	1972	powershell.exe
Token: SeRestorePrivilege	1972	powershell.exe
Token: SeShutdownPrivilege	1972	powershell.exe
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeSystemEnvironmentPrivilege	1972	powershell.exe
Token: SeRemoteShutdownPrivilege	1972	powershell.exe
Token: SeUndockPrivilege	1972	powershell.exe
Token: SeManageVolumePrivilege	1972	powershell.exe
Token: 33	1972	powershell.exe
Token: 34	1972	powershell.exe
Token: 35	1972	powershell.exe
Token: 36	1972	powershell.exe
Token: SeIncreaseQuotaPrivilege	2832	powershell.exe
Token: SeSecurityPrivilege	2832	powershell.exe
Token: SeTakeOwnershipPrivilege	2832	powershell.exe
Token: SeLoadDriverPrivilege	2832	powershell.exe
Token: SeSystemProfilePrivilege	2832	powershell.exe
Token: SeSystemtimePrivilege	2832	powershell.exe
Token: SeProfSingleProcessPrivilege	2832	powershell.exe
Token: SeIncBasePriorityPrivilege	2832	powershell.exe
Token: SeCreatePagefilePrivilege	2832	powershell.exe
Token: SeBackupPrivilege	2832	powershell.exe
Token: SeRestorePrivilege	2832	powershell.exe
Token: SeShutdownPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeSystemEnvironmentPrivilege	2832	powershell.exe
Token: SeRemoteShutdownPrivilege	2832	powershell.exe
Token: SeUndockPrivilege	2832	powershell.exe
Token: SeManageVolumePrivilege	2832	powershell.exe
Token: 33	2832	powershell.exe
Token: 34	2832	powershell.exe
Token: 35	2832	powershell.exe
Token: 36	2832	powershell.exe
Token: SeDebugPrivilege	3952	powershell.exe
Token: SeDebugPrivilege	252	powershell.exe
Token: SeIncreaseQuotaPrivilege	3952	powershell.exe
Token: SeSecurityPrivilege	3952	powershell.exe
Token: SeTakeOwnershipPrivilege	3952	powershell.exe
Token: SeLoadDriverPrivilege	3952	powershell.exe
Token: SeSystemProfilePrivilege	3952	powershell.exe
Token: SeSystemtimePrivilege	3952	powershell.exe
Token: SeProfSingleProcessPrivilege	3952	powershell.exe
Token: SeIncBasePriorityPrivilege	3952	powershell.exe
Token: SeCreatePagefilePrivilege	3952	powershell.exe
Token: SeBackupPrivilege	3952	powershell.exe
Token: SeRestorePrivilege	3952	powershell.exe
Token: SeShutdownPrivilege	3952	powershell.exe
Token: SeDebugPrivilege	3952	powershell.exe
Token: SeSystemEnvironmentPrivilege	3952	powershell.exe
Token: SeRemoteShutdownPrivilege	3952	powershell.exe
Token: SeUndockPrivilege	3952	powershell.exe
Token: SeManageVolumePrivilege	3952	powershell.exe
Token: 33	3952	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2424	pysilon.exe
1216	pysilon.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 1972	2424	pysilon.exe	91
PID 1216 wrote to memory of 2832	1216	pysilon.exe	95
PID 2424 wrote to memory of 3952	2424	pysilon.exe	98
PID 1216 wrote to memory of 252	1216	pysilon.exe	100
PID 2424 wrote to memory of 3396	2424	pysilon.exe	102
PID 1216 wrote to memory of 1508	1216	pysilon.exe	105

C:\Users\Admin\AppData\Local\Temp\pysilon.exe
"C:\Users\Admin\AppData\Local\Temp\pysilon.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' 2>$null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\pysilon.exe' 2>$null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3396

C:\Users\Admin\AppData\Local\Temp\pysilon.exe
"C:\Users\Admin\AppData\Local\Temp\pysilon.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' 2>$null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\pysilon.exe' 2>$null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 31f54a84498a62f4280cdad450e7e459b75378c7e67bfcf3279f493410eef07a
MD5 dcd0d48e287a2fa1fc2c2116c1997c88
SHA1 aa1c4035e6666763d1ccd82b32b9541f4b42b1be
SHA512 b4af5e7ff27bffe7527094d4187b934df549bcd1f31df3853c1ff317f47e60165682f740ee3279f573d5ea8adfd586aee37095800fcb77aa348011284ce99859
TLSH
T18C216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cfe7f23aea9e7003aa0021e2576460ef539ad28b7af6fc7b902ce56b35903251
MD5 13369f5668ad3edc193be4180fed16b4
SHA1 cb046802b6f84f6ec3f845227e7c6c0546f36fa3
SHA512 b994a3110cc3dfe532454bcf088c7bba39ad6869a1af4191d85dba29c14ea63bd91a3e80aa933b64ce1320ddeba4b599e6ff586e6ffec4ce739f02f77299c2e1
TLSH
T16D219837F3DC8224CCA9003A10DDAD0036B6C7CB40DECF5B6B81E159A42F298CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ruaurmyg.rez.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ruaurmyg.rez.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1508-56-0x00000262C63C0000-0x00000262C6472000-memory.dmp

Download

memory/1972-8-0x00007FFEABC20000-0x00007FFEAC5C4000-memory.dmp

Download

memory/1972-21-0x00007FFEABC20000-0x00007FFEAC5C4000-memory.dmp

Download

memory/1972-9-0x00007FFEABC20000-0x00007FFEAC5C4000-memory.dmp

Download

memory/1972-12-0x000002C9F36A0000-0x000002C9F36BE000-memory.dmp

Download

memory/1972-15-0x00007FFEABC20000-0x00007FFEAC5C4000-memory.dmp

Download

memory/1972-17-0x00007FFEABC20000-0x00007FFEAC5C4000-memory.dmp

Download

memory/1972-16-0x000002C9F3900000-0x000002C9F39B2000-memory.dmp

Download

memory/1972-7-0x00007FFEABC20000-0x00007FFEAC5C4000-memory.dmp

Download

memory/1972-18-0x000002C9F3680000-0x000002C9F368A000-memory.dmp

Download

memory/1972-19-0x00007FFEABC20000-0x00007FFEAC5C4000-memory.dmp

Download

memory/1972-20-0x00007FFEABC20000-0x00007FFEAC5C4000-memory.dmp

Download

memory/1972-0-0x00007FFEABDAF000-0x00007FFEABDB0000-memory.dmp

Download

memory/1972-22-0x00007FFEABC20000-0x00007FFEAC5C4000-memory.dmp

Download

memory/1972-23-0x00007FFEABC20000-0x00007FFEAC5C4000-memory.dmp

Download

memory/1972-24-0x00007FFEABC20000-0x00007FFEAC5C4000-memory.dmp

Download

memory/1972-28-0x00007FFEABC20000-0x00007FFEAC5C4000-memory.dmp

Download

memory/1972-6-0x00007FFEABC20000-0x00007FFEAC5C4000-memory.dmp

Download

memory/1972-5-0x00007FFEABC20000-0x00007FFEAC5C4000-memory.dmp

Download

memory/1972-1-0x00007FFEABC20000-0x00007FFEAC5C4000-memory.dmp

Download

memory/1972-4-0x000002C9F3620000-0x000002C9F3642000-memory.dmp

Download

memory/3396-48-0x000002174BD80000-0x000002174BDAA000-memory.dmp

Download

memory/3396-49-0x000002174BD80000-0x000002174BDA4000-memory.dmp

Download