fce4891d0ca542d32448ba0d79fe853654cbd7eeb81768ac36cb0316609ea8a0

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	python-installer.exe

Executes dropped EXE 5 IoCs

pid	Process
1536	python-installer.exe
1280	python-installer.exe
3332	python-3.10.9-amd64.exe
652	python.exe
4756	python.exe

Loads dropped DLL 29 IoCs

pid	Process
1280	python-installer.exe
1868	MsiExec.exe
652	python.exe
652	python.exe
652	python.exe
652	python.exe
652	python.exe
652	python.exe
4756	python.exe
4756	python.exe
4756	python.exe
4756	python.exe
4756	python.exe
4756	python.exe
4756	python.exe
4756	python.exe
4756	python.exe
4756	python.exe
4756	python.exe
4756	python.exe
4756	python.exe
4756	python.exe
4756	python.exe
4756	python.exe
4756	python.exe
4756	python.exe
4756	python.exe
4756	python.exe
4756	python.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Windows\\pyshellext.amd64.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{e8531749-5517-4937-a722-a4052cb2d75e} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{e8531749-5517-4937-a722-a4052cb2d75e}\\python-3.10.9-amd64.exe\" /burn.runonce"	python-installer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in Windows directory 54 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{9802C929-A3F0-480D-A4B2-DAD129F2236E}	msiexec.exe
File created	C:\Windows\Installer\e58ebf1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE91.tmp	msiexec.exe
File created	C:\Windows\Installer\e58ebfa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ebfb.msi	msiexec.exe
File created	C:\Windows\Installer\e58ec09.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF1F.tmp	msiexec.exe
File created	C:\Windows\Installer\e58ebe2.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F115E5B8-9719-4BDF-8B0D-551809BB677D}	msiexec.exe
File created	C:\Windows\Installer\e58ebf0.msi	msiexec.exe
File created	C:\Windows\Installer\e58ebf5.msi	msiexec.exe
File created	C:\Windows\pyshellext.amd64.dll	msiexec.exe
File created	C:\Windows\Installer\e58ec04.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E2BC2EBD-7260-458B-A42C-3322DCB0B82F}	msiexec.exe
File created	C:\Windows\Installer\e58ec05.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{067C6FFC-0FD1-4F3A-8E94-58F091BCC0D5}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF0A5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ec00.msi	msiexec.exe
File created	C:\Windows\Installer\{35A2AF4F-C504-4D2A-A025-F69379ECDF07}\ARPIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3269.tmp	msiexec.exe
File created	C:\Windows\Installer\e58ebe6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF71F.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\{35A2AF4F-C504-4D2A-A025-F69379ECDF07}\ARPIcon	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0CBB496F-1D15-42F1-AA45-C01C95196EC8}	msiexec.exe
File created	C:\Windows\Installer\e58ebff.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F69.tmp	msiexec.exe
File created	C:\Windows\pyw.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ebe7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ebf1.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{92CFA54C-9CE5-4284-83FD-1D0B8AB2AB69}	msiexec.exe
File created	C:\Windows\Installer\e58ec00.msi	msiexec.exe
File created	C:\Windows\py.exe	msiexec.exe
File created	C:\Windows\Installer\e58ec0a.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e58ebeb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ebf6.msi	msiexec.exe
File created	C:\Windows\Installer\e58ebfb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ebe2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE43.tmp	msiexec.exe
File created	C:\Windows\Installer\e58ebe7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1568.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ec0a.msi	msiexec.exe
File created	C:\Windows\Installer\e58ebec.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ebec.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ec05.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{59ED0114-0C86-4B18-83E2-929AD7D232AD}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI514C.tmp	msiexec.exe
File created	C:\Windows\Installer\e58ec0e.msi	msiexec.exe
File created	C:\Windows\Installer\e58ebf6.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1F097B66-81E9-46FB-BBAC-315C5F50CF94}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{35A2AF4F-C504-4D2A-A025-F69379ECDF07}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI320A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005cf4f6141e81f6580000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800005cf4f6140000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809005cf4f614000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d5cf4f614000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005cf4f61400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shell\open\command\ = "\"C:\\Windows\\py.exe\" \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CE0A86B13DD4431548E03758B480361F	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Installer\Dependencies\{F115E5B8-9719-4BDF-8B0D-551809BB677D}\DisplayName = "Python 3.10.9 Executables (64-bit)"	python-installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Python.NoConFile\Shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConFile\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyc\ = "Python.CompiledFile"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F4FA2A53405CA2D40A526F3997CEFD70	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Installer\Dependencies\{F115E5B8-9719-4BDF-8B0D-551809BB677D}	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Python.NoConFile	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pyc	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Installer\Dependencies\{1F097B66-81E9-46FB-BBAC-315C5F50CF94}\Version = "3.10.9150.0"	python-installer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pyz	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConArchiveFile	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Installer\Dependencies\CPython-3.10\Dependents	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Installer\Dependencies\{9802C929-A3F0-480D-A4B2-DAD129F2236E}\DisplayName = "Python 3.10.9 Core Interpreter (64-bit)"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Installer\Dependencies\{9802C929-A3F0-480D-A4B2-DAD129F2236E}\Version = "3.10.9150.0"	python-installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F4FA2A53405CA2D40A526F3997CEFD70\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F4FA2A53405CA2D40A526F3997CEFD70\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyz\ = "Python.ArchiveFile"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\DefaultIcon\ = "\"C:\\Windows\\py.exe\",5"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Installer\Dependencies\{92CFA54C-9CE5-4284-83FD-1D0B8AB2AB69}\DisplayName = "Python 3.10.9 Tcl/Tk Support (64-bit)"	python-installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.ArchiveFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Installer\Dependencies\{E2BC2EBD-7260-458B-A42C-3322DCB0B82F}\Version = "3.10.9150.0"	python-installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Installer\Dependencies\{F115E5B8-9719-4BDF-8B0D-551809BB677D}\ = "{F115E5B8-9719-4BDF-8B0D-551809BB677D}"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Installer\Dependencies\{9802C929-A3F0-480D-A4B2-DAD129F2236E}	python-installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F4FA2A53405CA2D40A526F3997CEFD70\ProductIcon = "C:\\Windows\\Installer\\{35A2AF4F-C504-4D2A-A025-F69379ECDF07}\\ARPIcon"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Installer\Dependencies\{92CFA54C-9CE5-4284-83FD-1D0B8AB2AB69}\ = "{92CFA54C-9CE5-4284-83FD-1D0B8AB2AB69}"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Python.File\Shell\editwithidle\shell\edit310\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Installer\Dependencies\{067C6FFC-0FD1-4F3A-8E94-58F091BCC0D5}\ = "{067C6FFC-0FD1-4F3A-8E94-58F091BCC0D5}"	python-installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.Extension\DefaultIcon\ = "\"C:\\Windows\\py.exe\",3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Installer\Dependencies\{1F097B66-81E9-46FB-BBAC-315C5F50CF94}	python-installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\ = "Python File (no console)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F4FA2A53405CA2D40A526F3997CEFD70\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Windows\\pyshellext.amd64.dll"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Python.NoConFile\Shell\editwithidle	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyo\ = "Python.CompiledFile"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Installer\Dependencies\{9802C929-A3F0-480D-A4B2-DAD129F2236E}\Dependents\{e8531749-5517-4937-a722-a4052cb2d75e}	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Python.File\Shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell\open\command\ = "\"C:\\Windows\\py.exe\" \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.py\Content Type = "text/x-python"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shellex	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shellex	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConArchiveFile\DefaultIcon	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Installer\Dependencies\{E2BC2EBD-7260-458B-A42C-3322DCB0B82F}\Dependents\{e8531749-5517-4937-a722-a4052cb2d75e}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit310\MUIVerb = "Edit with IDLE 3.10 (64-bit)"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Installer\Dependencies\{F115E5B8-9719-4BDF-8B0D-551809BB677D}\Dependents	python-installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shellex	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.File	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConFile	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.ArchiveFile	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F4FA2A53405CA2D40A526F3997CEFD70\AssociateFiles	msiexec.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3112	powershell.exe
3112	powershell.exe
400	msiexec.exe
400	msiexec.exe
400	msiexec.exe
400	msiexec.exe
400	msiexec.exe
400	msiexec.exe
400	msiexec.exe
400	msiexec.exe
400	msiexec.exe
400	msiexec.exe
400	msiexec.exe
400	msiexec.exe
400	msiexec.exe
400	msiexec.exe
400	msiexec.exe
400	msiexec.exe
400	msiexec.exe
400	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3112	powershell.exe
Token: SeBackupPrivilege	2608	vssvc.exe
Token: SeRestorePrivilege	2608	vssvc.exe
Token: SeAuditPrivilege	2608	vssvc.exe
Token: SeShutdownPrivilege	1280	python-installer.exe
Token: SeIncreaseQuotaPrivilege	1280	python-installer.exe
Token: SeSecurityPrivilege	400	msiexec.exe
Token: SeCreateTokenPrivilege	1280	python-installer.exe
Token: SeAssignPrimaryTokenPrivilege	1280	python-installer.exe
Token: SeLockMemoryPrivilege	1280	python-installer.exe
Token: SeIncreaseQuotaPrivilege	1280	python-installer.exe
Token: SeMachineAccountPrivilege	1280	python-installer.exe
Token: SeTcbPrivilege	1280	python-installer.exe
Token: SeSecurityPrivilege	1280	python-installer.exe
Token: SeTakeOwnershipPrivilege	1280	python-installer.exe
Token: SeLoadDriverPrivilege	1280	python-installer.exe
Token: SeSystemProfilePrivilege	1280	python-installer.exe
Token: SeSystemtimePrivilege	1280	python-installer.exe
Token: SeProfSingleProcessPrivilege	1280	python-installer.exe
Token: SeIncBasePriorityPrivilege	1280	python-installer.exe
Token: SeCreatePagefilePrivilege	1280	python-installer.exe
Token: SeCreatePermanentPrivilege	1280	python-installer.exe
Token: SeBackupPrivilege	1280	python-installer.exe
Token: SeRestorePrivilege	1280	python-installer.exe
Token: SeShutdownPrivilege	1280	python-installer.exe
Token: SeDebugPrivilege	1280	python-installer.exe
Token: SeAuditPrivilege	1280	python-installer.exe
Token: SeSystemEnvironmentPrivilege	1280	python-installer.exe
Token: SeChangeNotifyPrivilege	1280	python-installer.exe
Token: SeRemoteShutdownPrivilege	1280	python-installer.exe
Token: SeUndockPrivilege	1280	python-installer.exe
Token: SeSyncAgentPrivilege	1280	python-installer.exe
Token: SeEnableDelegationPrivilege	1280	python-installer.exe
Token: SeManageVolumePrivilege	1280	python-installer.exe
Token: SeImpersonatePrivilege	1280	python-installer.exe
Token: SeCreateGlobalPrivilege	1280	python-installer.exe
Token: SeRestorePrivilege	400	msiexec.exe
Token: SeTakeOwnershipPrivilege	400	msiexec.exe
Token: SeRestorePrivilege	400	msiexec.exe
Token: SeTakeOwnershipPrivilege	400	msiexec.exe
Token: SeRestorePrivilege	400	msiexec.exe
Token: SeTakeOwnershipPrivilege	400	msiexec.exe
Token: SeRestorePrivilege	400	msiexec.exe
Token: SeTakeOwnershipPrivilege	400	msiexec.exe
Token: SeRestorePrivilege	400	msiexec.exe
Token: SeTakeOwnershipPrivilege	400	msiexec.exe
Token: SeRestorePrivilege	400	msiexec.exe
Token: SeTakeOwnershipPrivilege	400	msiexec.exe
Token: SeRestorePrivilege	400	msiexec.exe
Token: SeTakeOwnershipPrivilege	400	msiexec.exe
Token: SeRestorePrivilege	400	msiexec.exe
Token: SeTakeOwnershipPrivilege	400	msiexec.exe
Token: SeRestorePrivilege	400	msiexec.exe
Token: SeTakeOwnershipPrivilege	400	msiexec.exe
Token: SeRestorePrivilege	400	msiexec.exe
Token: SeTakeOwnershipPrivilege	400	msiexec.exe
Token: SeRestorePrivilege	400	msiexec.exe
Token: SeTakeOwnershipPrivilege	400	msiexec.exe
Token: SeRestorePrivilege	400	msiexec.exe
Token: SeTakeOwnershipPrivilege	400	msiexec.exe
Token: SeRestorePrivilege	400	msiexec.exe
Token: SeTakeOwnershipPrivilege	400	msiexec.exe
Token: SeRestorePrivilege	400	msiexec.exe
Token: SeTakeOwnershipPrivilege	400	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1280	python-installer.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 1620	1020	cmd.exe	86
PID 1020 wrote to memory of 1620	1020	cmd.exe	86
PID 1620 wrote to memory of 3112	1620	cmd.exe	87
PID 1620 wrote to memory of 3112	1620	cmd.exe	87
PID 1020 wrote to memory of 4404	1020	cmd.exe	88
PID 1020 wrote to memory of 4404	1020	cmd.exe	88
PID 1020 wrote to memory of 1536	1020	cmd.exe	97
PID 1020 wrote to memory of 1536	1020	cmd.exe	97
PID 1020 wrote to memory of 1536	1020	cmd.exe	97
PID 1536 wrote to memory of 1280	1536	python-installer.exe	98
PID 1536 wrote to memory of 1280	1536	python-installer.exe	98
PID 1536 wrote to memory of 1280	1536	python-installer.exe	98
PID 1280 wrote to memory of 3332	1280	python-installer.exe	99
PID 1280 wrote to memory of 3332	1280	python-installer.exe	99
PID 1280 wrote to memory of 3332	1280	python-installer.exe	99
PID 400 wrote to memory of 1868	400	msiexec.exe	109
PID 400 wrote to memory of 1868	400	msiexec.exe	109
PID 400 wrote to memory of 1868	400	msiexec.exe	109
PID 1868 wrote to memory of 652	1868	MsiExec.exe	110
PID 1868 wrote to memory of 652	1868	MsiExec.exe	110
PID 652 wrote to memory of 4756	652	python.exe	112
PID 652 wrote to memory of 4756	652	python.exe	112
PID 4756 wrote to memory of 3720	4756	python.exe	113
PID 4756 wrote to memory of 3720	4756	python.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Creal-Stealer-main\install_python.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest https://www.python.org/ftp/python/ -UseBasicParsing | Select-String -Pattern '3.10.[0-9]{1,2}' -AllMatches | Select-Object -ExpandProperty Matches | Select-Object -ExpandProperty Value | Sort-Object -Descending -Unique | Select-Object -First 1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest https://www.python.org/ftp/python/ -UseBasicParsing | Select-String -Pattern '3.10.[0-9]{1,2}' -AllMatches | Select-Object -ExpandProperty Matches | Select-Object -ExpandProperty Value | Sort-Object -Descending -Unique | Select-Object -First 1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3112
- C:\Windows\system32\curl.exe
  curl -L -o python-installer.exe https://www.python.org/ftp/python/3.10.9/python-3.10.9-amd64.exe
  2⤵
  PID:4404
- C:\Users\Admin\AppData\Local\Temp\Creal-Stealer-main\python-installer.exe
  python-installer.exe /quiet /passive InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\Temp\{60882CAF-B6B4-4FDA-8C75-4016F3C7AD8F}\.cr\python-installer.exe
    "C:\Windows\Temp\{60882CAF-B6B4-4FDA-8C75-4016F3C7AD8F}\.cr\python-installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Creal-Stealer-main\python-installer.exe" -burn.filehandle.attached=536 -burn.filehandle.self=660 /quiet /passive InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1280
  - - C:\Windows\Temp\{41815DB7-F17A-4F8C-BB4F-6F645C32824D}\.be\python-3.10.9-amd64.exe
      "C:\Windows\Temp\{41815DB7-F17A-4F8C-BB4F-6F645C32824D}\.be\python-3.10.9-amd64.exe" -q -burn.elevated BurnPipe.{78A4543E-FA24-4113-A3FA-52D74F89F498} {036F2687-AEF9-4064-B1FB-56A79C48DE8C} 1280
      4⤵
      Executes dropped EXE
      PID:3332

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:760

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3AC11CDC50D5016FF5BA2B4475C04BCD
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" -E -s -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:652
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpjie5prso\\setuptools-65.5.0-py3-none-any.whl', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpjie5prso\\pip-22.3.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpjie5prso', '--upgrade', 'setuptools', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:4756
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery