hxxps://gofile[.]io/d/fX9E0j

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	python-3.12.3-amd64.exe

Executes dropped EXE 20 IoCs

pid	Process
2868	python-3.12.3-amd64.exe
1076	python-3.12.3-amd64.exe
1960	python.exe
5808	python.exe
5276	py.exe
5516	python.exe
5540	py.exe
5740	python.exe
4368	py.exe
3676	python.exe
5988	py.exe
864	python.exe
5312	py.exe
6040	python.exe
6064	py.exe
3904	python.exe
3336	py.exe
4796	python.exe
5100	FeatherFixer.exe
5288	FeatherFixer.exe

Loads dropped DLL 64 IoCs

pid	Process
2868	python-3.12.3-amd64.exe
6084	MsiExec.exe
1960	python.exe
1960	python.exe
1960	python.exe
1960	python.exe
1960	python.exe
1960	python.exe
1960	python.exe
5808	python.exe
5808	python.exe
5808	python.exe
5808	python.exe
5808	python.exe
5808	python.exe
5808	python.exe
5808	python.exe
5808	python.exe
5808	python.exe
5808	python.exe
5808	python.exe
5808	python.exe
5808	python.exe
5808	python.exe
5808	python.exe
5808	python.exe
5808	python.exe
5808	python.exe
5808	python.exe
5808	python.exe
5808	python.exe
5808	python.exe
5516	python.exe
5516	python.exe
5516	python.exe
5516	python.exe
5516	python.exe
5516	python.exe
5516	python.exe
5740	python.exe
5740	python.exe
5740	python.exe
5740	python.exe
5740	python.exe
5740	python.exe
5740	python.exe
3676	python.exe
3676	python.exe
3676	python.exe
3676	python.exe
3676	python.exe
3676	python.exe
3676	python.exe
864	python.exe
864	python.exe
864	python.exe
864	python.exe
864	python.exe
864	python.exe
864	python.exe
864	python.exe
3512	Process not Found
6040	python.exe
6040	python.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Windows\\pyshellext.amd64.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\\python-3.12.3-amd64.exe\" /burn.runonce"	python-3.12.3-amd64.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
295	3616	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Python312\Lib\curses\__pycache__\textpad.cpython-312.opt-1.pyc.1564682071600	python.exe
File created	C:\Program Files\Python312\DLLs\_asyncio.pyd	msiexec.exe
File created	C:\Program Files\Python312\Lib\test\test_import\data\circular_imports\use.py	msiexec.exe
File created	C:\Program Files\Python312\tcl\tcl8.6\encoding\shiftjis.enc	msiexec.exe
File created	C:\Program Files\Python312\tcl\tcl8.6\msgs\en_sg.msg	msiexec.exe
File created	C:\Program Files\Python312\tcl\tcl8.6\tzdata\America\Glace_Bay	msiexec.exe
File created	C:\Program Files\Python312\Lib\site-packages\pip\_vendor\chardet\euctwfreq.py	python.exe
File created	C:\Program Files\Python312\Lib\test\__pycache__\test_dict_version.cpython-312.pyc.1654469275440	python.exe
File created	C:\Program Files\Python312\Lib\__pycache__\poplib.cpython-312.opt-2.pyc.1680667606720	python.exe
File created	C:\Program Files\Python312\Lib\__pycache__\queue.cpython-312.opt-2.pyc.1680667606720	python.exe
File created	C:\Program Files\Python312\Lib\test\regrtestdata\import_from_tests\test_regrtest_b\__pycache__\__init__.cpython-312.opt-2.pyc.1680667672256	python.exe
File created	C:\Program Files\Python312\Lib\turtledemo\__pycache__\colormixer.cpython-312.opt-2.pyc.1680666359600	python.exe
File created	C:\Program Files\Python312\tcl\tcl8.6\msgs\es_pr.msg	msiexec.exe
File created	C:\Program Files\Python312\Lib\email\__pycache__\__init__.cpython-312.opt-1.pyc.1564682071600	python.exe
File created	C:\Program Files\Python312\Lib\__pycache__\xdrlib.cpython-312.opt-1.pyc.1564705733328	python.exe
File created	C:\Program Files\Python312\Lib\test\tokenizedata\__pycache__\coding20731.cpython-312.opt-2.pyc.1680677266336	python.exe
File created	C:\Program Files\Python312\Lib\test\decimaltestdata\ddMaxMag.decTest	msiexec.exe
File created	C:\Program Files\Python312\Lib\test\test_pickle.py	msiexec.exe
File created	C:\Program Files\Python312\tcl\tcl8.6\msgs\ro.msg	msiexec.exe
File created	C:\Program Files\Python312\Lib\__pycache__\linecache.cpython-312.opt-1.pyc.1564689666096	python.exe
File created	C:\Program Files\Python312\Lib\test\test_future_stmt\__pycache__\test_future_single_import.cpython-312.opt-1.pyc.1564690742160	python.exe
File created	C:\Program Files\Python312\Lib\test\test_import\data\circular_imports\__pycache__\from_cycle1.cpython-312.opt-1.pyc.1564690741520	python.exe
File created	C:\Program Files\Python312\Lib\test\__pycache__\regrtest.cpython-312.opt-2.pyc.1680659287088	python.exe
File created	C:\Program Files\Python312\Lib\test\test_script_helper.py	msiexec.exe
File created	C:\Program Files\Python312\Doc\html\library\http.html	msiexec.exe
File created	C:\Program Files\Python312\Lib\__pycache__\subprocess.cpython-312.pyc.2349083920288	python.exe
File created	C:\Program Files\Python312\Lib\idlelib\idle_test\__pycache__\test_multicall.cpython-312.pyc.1654469259984	python.exe
File created	C:\Program Files\Python312\Lib\test\__pycache__\test_enum.cpython-312.pyc.1654470276144	python.exe
File created	C:\Program Files\Python312\Lib\test\__pycache__\test_metaclass.cpython-312.opt-1.pyc.1564682557616	python.exe
File created	C:\Program Files\Python312\Lib\pydoc_data\topics.py	msiexec.exe
File created	C:\Program Files\Python312\Lib\test\test_import\data\circular_imports\subpkg2\parent\__pycache__\child.cpython-312.opt-1.pyc.1564701241248	python.exe
File created	C:\Program Files\Python312\Lib\test\test_ctypes\__pycache__\test_delattr.cpython-312.opt-2.pyc.1680666769376	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pygments\sphinxext.py	python.exe
File created	C:\Program Files\Python312\Lib\multiprocessing\__pycache__\resource_tracker.cpython-312.pyc.1654469261136	python.exe
File created	C:\Program Files\Python312\Lib\test\__pycache__\test_clinic.cpython-312.pyc.1654470276144	python.exe
File created	C:\Program Files\Python312\Lib\test\typinganndata\__pycache__\ann_module9.cpython-312.pyc.1654487350944	python.exe
File created	C:\Program Files\Python312\Lib\turtledemo\__pycache__\peace.cpython-312.opt-2.pyc.1680666351152	python.exe
File created	C:\Program Files\Python312\tcl\tix8.4.3\demos\samples\SListBox.tcl	msiexec.exe
File created	C:\Program Files\Python312\tcl\tix8.4.3\DragDrop.tcl	msiexec.exe
File created	C:\Program Files\Python312\tcl\tk8.6\demos\states.tcl	msiexec.exe
File created	C:\Program Files\Python312\Lib\site-packages\pip\_vendor\chardet\euckrfreq.py	python.exe
File created	C:\Program Files\Python312\Lib\multiprocessing\__pycache__\popen_spawn_posix.cpython-312.pyc.1654469260992	python.exe
File created	C:\Program Files\Python312\Lib\unittest\__pycache__\case.cpython-312.pyc.1654470837808	python.exe
File created	C:\Program Files\Python312\Lib\test\typinganndata\__pycache__\_typed_dict_helper.cpython-312.opt-1.pyc.1564690169216	python.exe
File created	C:\Program Files\Python312\Lib\curses\has_key.py	msiexec.exe
File created	C:\Program Files\Python312\Lib\__pycache__\fileinput.cpython-312.opt-2.pyc.1680655012272	python.exe
File created	C:\Program Files\Python312\Lib\__pycache__\codeop.cpython-312.pyc.1654469721120	python.exe
File created	C:\Program Files\Python312\Lib\test\__pycache__\mapping_tests.cpython-312.pyc.1654487148080	python.exe
File created	C:\Program Files\Python312\Lib\test\test_importlib\__pycache__\test_threaded_import.cpython-312.pyc.1654487340576	python.exe
File created	C:\Program Files\Python312\Lib\test\__pycache__\test_rlcompleter.cpython-312.pyc.1654484838064	python.exe
File created	C:\Program Files\Python312\Lib\test\test_importlib\import_\__pycache__\test_helpers.cpython-312.opt-1.pyc.1564690640016	python.exe
File created	C:\Program Files\Python312\Lib\test\__pycache__\test_socketserver.cpython-312.opt-1.pyc.1564682593200	python.exe
File created	C:\Program Files\Python312\Lib\lib2to3\pygram.py	msiexec.exe
File created	C:\Program Files\Python312\Lib\site-packages\pip\_vendor\idna\package_data.py	python.exe
File created	C:\Program Files\Python312\Lib\test\test_future_stmt\__pycache__\test_future_multiple_imports.cpython-312.pyc.1654470193552	python.exe
File created	C:\Program Files\Python312\Lib\xml\dom\__pycache__\domreg.cpython-312.opt-2.pyc.1680666359472	python.exe
File created	C:\Program Files\Python312\Lib\test\test_ctypes\test_arrays.py	msiexec.exe
File created	C:\Program Files\Python312\Lib\__pycache__\csv.cpython-312.pyc.2775578677568	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\pip\_vendor\urllib3\response.py	python.exe
File created	C:\Program Files\Python312\Lib\test\test_shlex.py	msiexec.exe
File created	C:\Program Files\Python312\Lib\xml\dom\__pycache__\pulldom.cpython-312.opt-1.pyc.1564682558256	python.exe
File created	C:\Program Files\Python312\Lib\idlelib\Icons\README.txt	msiexec.exe
File created	C:\Program Files\Python312\Lib\test\test_zipfile\_path\__pycache__\_test_params.cpython-312.opt-1.pyc.1564690169216	python.exe
File created	C:\Program Files\Python312\Lib\test\__pycache__\test_fnmatch.cpython-312.opt-2.pyc.1680679321008	python.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5ab38b.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{52ABF617-F7B4-40F9-8197-C7490DAA97A3}	msiexec.exe
File opened for modification	C:\Windows\Installer\{52ABF617-F7B4-40F9-8197-C7490DAA97A3}\ARPIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC912.tmp	msiexec.exe
File created	C:\Windows\Installer\e5ab36d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A48.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE66B.tmp	msiexec.exe
File created	C:\Windows\Installer\{A2FC8FF0-021A-431C-826E-E4B85D3F064F}\idle.exe	msiexec.exe
File created	C:\Windows\py.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ab372.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6217.tmp	msiexec.exe
File created	C:\Windows\Installer\e5ab394.msi	msiexec.exe
File created	C:\Windows\Installer\e5ab399.msi	msiexec.exe
File created	C:\Windows\Installer\e5ab3a4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ab3a4.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{837260D6-3959-452B-A557-666302BEA663}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1705.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5ab386.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79B6.tmp	msiexec.exe
File created	C:\Windows\Installer\e5ab377.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D0A35B98-1897-48CA-A1B8-2DF24BC768A5}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ab38b.msi	msiexec.exe
File created	C:\Windows\pyw.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ab363.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F0104AC4-11E8-4FEF-B0C5-22E324D2430B}	msiexec.exe
File created	C:\Windows\Installer\e5ab380.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D95.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI492F.tmp	msiexec.exe
File created	C:\Windows\pyshellext.amd64.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ab36d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI472B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ab37c.msi	msiexec.exe
File created	C:\Windows\Installer\e5ab3a3.msi	msiexec.exe
File created	C:\Windows\Installer\e5ab3a8.msi	msiexec.exe
File created	C:\Windows\Installer\e5ab3a9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ab3a9.msi	msiexec.exe
File created	C:\Windows\Installer\e5ab363.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}	msiexec.exe
File created	C:\Windows\Installer\e5ab376.msi	msiexec.exe
File created	C:\Windows\Installer\e5ab395.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ab39f.msi	msiexec.exe
File created	C:\Windows\Installer\e5ab367.msi	msiexec.exe
File created	C:\Windows\Installer\e5ab36c.msi	msiexec.exe
File created	C:\Windows\Installer\e5ab381.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{A2FC8FF0-021A-431C-826E-E4B85D3F064F}\idle.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ab39a.msi	msiexec.exe
File created	C:\Windows\Installer\e5ab39e.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{575FEF7A-71FE-437E-91B0-D3838C1026DA}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5C195EDE-CE8F-4C5C-A4B8-B60913B9C2B9}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A2FC8FF0-021A-431C-826E-E4B85D3F064F}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C26019C0-7147-478C-9821-E9E447C153F3}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}	msiexec.exe
File created	C:\Windows\Installer\e5ab38a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ab395.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{79F57949-6D0D-4861-8087-B4C06689DE52}	msiexec.exe
File created	C:\Windows\Installer\e5ab3ad.msi	msiexec.exe
File created	C:\Windows\Installer\e5ab368.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI33B0.tmp	msiexec.exe
File created	C:\Windows\Installer\e5ab371.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC26.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB7C8.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000064efbbd21686319b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000064efbbd20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090064efbbd2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d64efbbd2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000064efbbd200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 31 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFED3BF868D49884B9A0F07EEA097D9C\PackageCode = "0BB0149B9E075244DB82665E7D518B7E"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9785E4745D9A5FD43958DA7F2E42EC7C\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0FF8CF2AA120C13428E64E8BD5F360F4\Shortcuts	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shellex	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConArchiveFile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\716FBA254B7F9F0418797C94D0AA793A\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9785E4745D9A5FD43958DA7F2E42EC7C\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2BE9381A03C3DCB4AAFC406FFFC609DC\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\89B53A0D7981AC841A8BD22FB47C865A\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\89B53A0D7981AC841A8BD22FB47C865A\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{D0A35B98-1897-48CA-A1B8-2DF24BC768A5}v3.12.3150.0\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\DefaultIcon\ = "\"C:\\Windows\\py.exe\",1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\716FBA254B7F9F0418797C94D0AA793A\DeploymentFlags = "2"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CA4010F8E11FEF40B5C223E422D34B0\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{F0104AC4-11E8-4FEF-B0C5-22E324D2430B}v3.12.3150.0\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\833B86A739EE0B94DB9F1339A367F3C3\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4CA4010F8E11FEF40B5C223E422D34B0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A7FEF575EF17E734190B3D38C80162AD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A7FEF575EF17E734190B3D38C80162AD\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyz\Content Type = "application/x-zip-compressed"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5EF11A5A9F184445CA5A3AFEC8CCF53D	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D0627389593B2545A75663620EB6A36\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CA4010F8E11FEF40B5C223E422D34B0\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2BE9381A03C3DCB4AAFC406FFFC609DC\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D0627389593B2545A75663620EB6A36\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\89B53A0D7981AC841A8BD22FB47C865A\Language = "1033"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FF8CF2AA120C13428E64E8BD5F360F4\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.py	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pyd	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\89B53A0D7981AC841A8BD22FB47C865A\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFED3BF868D49884B9A0F07EEA097D9C\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.Extension	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\CPython-3.12\ = "{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9785E4745D9A5FD43958DA7F2E42EC7C\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}v3.12.3150.0\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CA4010F8E11FEF40B5C223E422D34B0\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{F0104AC4-11E8-4FEF-B0C5-22E324D2430B}v3.12.3150.0\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2A62ACE542A62185592545C9B1852DD5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\833B86A739EE0B94DB9F1339A367F3C3\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\Shell\editwithidle\shell\edit312\command\ = "\"C:\\Program Files\\Python312\\pythonw.exe\" -m idlelib \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FF8CF2AA120C13428E64E8BD5F360F4\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyzw\ = "Python.NoConArchiveFile"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D7C91534D075F640A9AA311D5372ECE\PackageCode = "A3C03D2E6C1427D408069CD275DC4C22"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C91062C7417C87489129E4E741C353F\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CA4010F8E11FEF40B5C223E422D34B0\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\952F1BE8623138543B385F3C7D9CD3D7\ProductName = "Python 3.12.3 Development Libraries (64-bit)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConArchiveFile\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D7C91534D075F640A9AA311D5372ECE\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C91062C7417C87489129E4E741C353F\SourceList\PackageName = "core_pdb.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C91062C7417C87489129E4E741C353F\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{C26019C0-7147-478C-9821-E9E447C153F3}v3.12.3150.0\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9785E4745D9A5FD43958DA7F2E42EC7C\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5F138CB615460F45D88B3EA8B2F22A35\9785E4745D9A5FD43958DA7F2E42EC7C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FEB0B64B9810FAF5DBBA3571BBB3D45E\833B86A739EE0B94DB9F1339A367F3C3	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C91062C7417C87489129E4E741C353F\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94975F97D0D6168408784B0C6698ED25\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shell\open\command\ = "\"C:\\Windows\\py.exe\" \"%L\" %*"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CA4010F8E11FEF40B5C223E422D34B0\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2BE9381A03C3DCB4AAFC406FFFC609DC\DeploymentFlags = "2"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7DBB865FAEBEC0C5AA4385D3C41F4F5F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\Shell\editwithidle\shell\edit312\command\ = "\"C:\\Program Files\\Python312\\pythonw.exe\" -m idlelib \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0FF8CF2AA120C13428E64E8BD5F360F4\DefaultFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FFED3BF868D49884B9A0F07EEA097D9C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\Shell\editwithidle	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFED3BF868D49884B9A0F07EEA097D9C\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9}v3.12.3150.0\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe
5624	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1588	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	5052	7zG.exe
Token: 35	5052	7zG.exe
Token: SeSecurityPrivilege	5052	7zG.exe
Token: SeSecurityPrivilege	5052	7zG.exe
Token: SeBackupPrivilege	4684	vssvc.exe
Token: SeRestorePrivilege	4684	vssvc.exe
Token: SeAuditPrivilege	4684	vssvc.exe
Token: SeShutdownPrivilege	1076	python-3.12.3-amd64.exe
Token: SeIncreaseQuotaPrivilege	1076	python-3.12.3-amd64.exe
Token: SeSecurityPrivilege	5624	msiexec.exe
Token: SeCreateTokenPrivilege	1076	python-3.12.3-amd64.exe
Token: SeAssignPrimaryTokenPrivilege	1076	python-3.12.3-amd64.exe
Token: SeLockMemoryPrivilege	1076	python-3.12.3-amd64.exe
Token: SeIncreaseQuotaPrivilege	1076	python-3.12.3-amd64.exe
Token: SeMachineAccountPrivilege	1076	python-3.12.3-amd64.exe
Token: SeTcbPrivilege	1076	python-3.12.3-amd64.exe
Token: SeSecurityPrivilege	1076	python-3.12.3-amd64.exe
Token: SeTakeOwnershipPrivilege	1076	python-3.12.3-amd64.exe
Token: SeLoadDriverPrivilege	1076	python-3.12.3-amd64.exe
Token: SeSystemProfilePrivilege	1076	python-3.12.3-amd64.exe
Token: SeSystemtimePrivilege	1076	python-3.12.3-amd64.exe
Token: SeProfSingleProcessPrivilege	1076	python-3.12.3-amd64.exe
Token: SeIncBasePriorityPrivilege	1076	python-3.12.3-amd64.exe
Token: SeCreatePagefilePrivilege	1076	python-3.12.3-amd64.exe
Token: SeCreatePermanentPrivilege	1076	python-3.12.3-amd64.exe
Token: SeBackupPrivilege	1076	python-3.12.3-amd64.exe
Token: SeRestorePrivilege	1076	python-3.12.3-amd64.exe
Token: SeShutdownPrivilege	1076	python-3.12.3-amd64.exe
Token: SeDebugPrivilege	1076	python-3.12.3-amd64.exe
Token: SeAuditPrivilege	1076	python-3.12.3-amd64.exe
Token: SeSystemEnvironmentPrivilege	1076	python-3.12.3-amd64.exe
Token: SeChangeNotifyPrivilege	1076	python-3.12.3-amd64.exe
Token: SeRemoteShutdownPrivilege	1076	python-3.12.3-amd64.exe
Token: SeUndockPrivilege	1076	python-3.12.3-amd64.exe
Token: SeSyncAgentPrivilege	1076	python-3.12.3-amd64.exe
Token: SeEnableDelegationPrivilege	1076	python-3.12.3-amd64.exe
Token: SeManageVolumePrivilege	1076	python-3.12.3-amd64.exe
Token: SeImpersonatePrivilege	1076	python-3.12.3-amd64.exe
Token: SeCreateGlobalPrivilege	1076	python-3.12.3-amd64.exe
Token: SeRestorePrivilege	5624	msiexec.exe
Token: SeTakeOwnershipPrivilege	5624	msiexec.exe
Token: SeRestorePrivilege	5624	msiexec.exe
Token: SeTakeOwnershipPrivilege	5624	msiexec.exe
Token: SeRestorePrivilege	5624	msiexec.exe
Token: SeTakeOwnershipPrivilege	5624	msiexec.exe
Token: SeRestorePrivilege	5624	msiexec.exe
Token: SeTakeOwnershipPrivilege	5624	msiexec.exe
Token: SeRestorePrivilege	5624	msiexec.exe
Token: SeTakeOwnershipPrivilege	5624	msiexec.exe
Token: SeRestorePrivilege	5624	msiexec.exe
Token: SeTakeOwnershipPrivilege	5624	msiexec.exe
Token: SeRestorePrivilege	5624	msiexec.exe
Token: SeTakeOwnershipPrivilege	5624	msiexec.exe
Token: SeRestorePrivilege	5624	msiexec.exe
Token: SeTakeOwnershipPrivilege	5624	msiexec.exe
Token: SeRestorePrivilege	5624	msiexec.exe
Token: SeTakeOwnershipPrivilege	5624	msiexec.exe
Token: SeRestorePrivilege	5624	msiexec.exe
Token: SeTakeOwnershipPrivilege	5624	msiexec.exe
Token: SeRestorePrivilege	5624	msiexec.exe
Token: SeTakeOwnershipPrivilege	5624	msiexec.exe
Token: SeRestorePrivilege	5624	msiexec.exe
Token: SeTakeOwnershipPrivilege	5624	msiexec.exe
Token: SeRestorePrivilege	5624	msiexec.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
5052	7zG.exe
2868	python-3.12.3-amd64.exe
5568	7zG.exe
5288	FeatherFixer.exe
3616	msiexec.exe
3616	msiexec.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5288	OpenWith.exe
5288	OpenWith.exe
5288	OpenWith.exe
5288	OpenWith.exe
5288	OpenWith.exe
5288	OpenWith.exe
5288	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe
1588	OpenWith.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 2868	4404	python-3.12.3-amd64.exe	132
PID 4404 wrote to memory of 2868	4404	python-3.12.3-amd64.exe	132
PID 4404 wrote to memory of 2868	4404	python-3.12.3-amd64.exe	132
PID 2868 wrote to memory of 1076	2868	python-3.12.3-amd64.exe	133
PID 2868 wrote to memory of 1076	2868	python-3.12.3-amd64.exe	133
PID 2868 wrote to memory of 1076	2868	python-3.12.3-amd64.exe	133
PID 5624 wrote to memory of 6084	5624	msiexec.exe	147
PID 5624 wrote to memory of 6084	5624	msiexec.exe	147
PID 5624 wrote to memory of 6084	5624	msiexec.exe	147
PID 6084 wrote to memory of 1960	6084	MsiExec.exe	148
PID 6084 wrote to memory of 1960	6084	MsiExec.exe	148
PID 1960 wrote to memory of 5808	1960	python.exe	150
PID 1960 wrote to memory of 5808	1960	python.exe	150
PID 1076 wrote to memory of 5276	1076	python-3.12.3-amd64.exe	153
PID 1076 wrote to memory of 5276	1076	python-3.12.3-amd64.exe	153
PID 5276 wrote to memory of 5516	5276	py.exe	155
PID 5276 wrote to memory of 5516	5276	py.exe	155
PID 1076 wrote to memory of 5540	1076	python-3.12.3-amd64.exe	156
PID 1076 wrote to memory of 5540	1076	python-3.12.3-amd64.exe	156
PID 5540 wrote to memory of 5740	5540	py.exe	158
PID 5540 wrote to memory of 5740	5540	py.exe	158
PID 1076 wrote to memory of 4368	1076	python-3.12.3-amd64.exe	159
PID 1076 wrote to memory of 4368	1076	python-3.12.3-amd64.exe	159
PID 4368 wrote to memory of 3676	4368	py.exe	161
PID 4368 wrote to memory of 3676	4368	py.exe	161
PID 5988 wrote to memory of 864	5988	py.exe	166
PID 5988 wrote to memory of 864	5988	py.exe	166
PID 5288 wrote to memory of 5312	5288	OpenWith.exe	168
PID 5288 wrote to memory of 5312	5288	OpenWith.exe	168
PID 5288 wrote to memory of 5312	5288	OpenWith.exe	168
PID 5312 wrote to memory of 6040	5312	py.exe	170
PID 5312 wrote to memory of 6040	5312	py.exe	170
PID 1588 wrote to memory of 6064	1588	OpenWith.exe	174
PID 1588 wrote to memory of 6064	1588	OpenWith.exe	174
PID 1588 wrote to memory of 6064	1588	OpenWith.exe	174
PID 6064 wrote to memory of 3904	6064	py.exe	177
PID 6064 wrote to memory of 3904	6064	py.exe	177
PID 3336 wrote to memory of 4796	3336	py.exe	180
PID 3336 wrote to memory of 4796	3336	py.exe	180
PID 5100 wrote to memory of 5288	5100	FeatherFixer.exe	183
PID 5100 wrote to memory of 5288	5100	FeatherFixer.exe	183
PID 5288 wrote to memory of 3980	5288	FeatherFixer.exe	184
PID 5288 wrote to memory of 3980	5288	FeatherFixer.exe	184
PID 5288 wrote to memory of 5824	5288	FeatherFixer.exe	186
PID 5288 wrote to memory of 5824	5288	FeatherFixer.exe	186
PID 5288 wrote to memory of 3616	5288	FeatherFixer.exe	189
PID 5288 wrote to memory of 3616	5288	FeatherFixer.exe	189
PID 5624 wrote to memory of 5572	5624	msiexec.exe	190
PID 5624 wrote to memory of 5572	5624	msiexec.exe	190

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/fX9E0j
1⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=5680 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
1⤵
PID:2876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4840 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
1⤵
PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5832 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5888 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
1⤵
PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=4184 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
1⤵
PID:3820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2200 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=5344 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
1⤵
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=4000 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:2268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --mojo-platform-channel-handle=6228 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
1⤵
PID:2932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4180 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:1824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5484 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:1056

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=6676 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:3108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=6664 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:3752

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\src\" -spe -an -ai#7zMap23023:68:7zEvent19057
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --mojo-platform-channel-handle=6128 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
1⤵
PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --mojo-platform-channel-handle=5408 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
1⤵
PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --mojo-platform-channel-handle=6420 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
1⤵
PID:3780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --mojo-platform-channel-handle=6396 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
1⤵
PID:1060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --mojo-platform-channel-handle=7092 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
1⤵
PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --mojo-platform-channel-handle=7128 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
1⤵
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --mojo-platform-channel-handle=6404 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
1⤵
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --mojo-platform-channel-handle=6396 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=7140 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --mojo-platform-channel-handle=7288 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
1⤵
PID:380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --mojo-platform-channel-handle=7488 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:1352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=8096 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:2772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --mojo-platform-channel-handle=8080 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
1⤵
PID:2348

C:\Users\Admin\Downloads\python-3.12.3-amd64.exe
"C:\Users\Admin\Downloads\python-3.12.3-amd64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\Temp\{A96EDC26-D9D3-4C1D-BB0F-B3FEDBBBEB71}\.cr\python-3.12.3-amd64.exe
  "C:\Windows\Temp\{A96EDC26-D9D3-4C1D-BB0F-B3FEDBBBEB71}\.cr\python-3.12.3-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.3-amd64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=572
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\Temp\{4B3AE88D-D623-4896-98C0-63050A5AFEF3}\.be\python-3.12.3-amd64.exe
    "C:\Windows\Temp\{4B3AE88D-D623-4896-98C0-63050A5AFEF3}\.be\python-3.12.3-amd64.exe" -q -burn.elevated BurnPipe.{938FCA32-4105-42EB-B57A-0ECC672DE2B7} {B0252803-B97E-4491-BA1A-84895B3C9DC7} 2868
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\ProgramData\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe
      "C:\ProgramData\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe" -3.12 -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5276
    - - C:\Program Files\Python312\python.exe
        
        "C:\Program Files\Python312\python.exe" -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        
        PID:5516
  - - C:\ProgramData\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe
      "C:\ProgramData\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe" -3.12 -O -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5540
    - - C:\Program Files\Python312\python.exe
        
        "C:\Program Files\Python312\python.exe" -O -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        
        PID:5740
  - - C:\ProgramData\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe
      "C:\ProgramData\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe" -3.12 -OO -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4368
    - - C:\Program Files\Python312\python.exe
        
        "C:\Program Files\Python312\python.exe" -OO -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        
        PID:3676

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --mojo-platform-channel-handle=8288 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
1⤵
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --mojo-platform-channel-handle=8388 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
1⤵
PID:2972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --mojo-platform-channel-handle=8476 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
1⤵
PID:5072

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:5440

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5624
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 114449F2ED61B0B3595A299D3818A7A1
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:6084
- - C:\Program Files\Python312\python.exe
    "C:\Program Files\Python312\python.exe" -E -s -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp_cekxki9\\pip-24.0-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp_cekxki9', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      PID:5808
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B5F3F036118D35CCCB70DD06046FC684 C
  2⤵
  PID:5572

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\src\FeatherFixer.py"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Program Files\Python312\python.exe
  "C:\Program Files\Python312\python.exe" "C:\Users\Admin\Downloads\src\FeatherFixer.py"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:864

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5288
- C:\Windows\py.exe
  "C:\Windows\py.exe" "C:\Users\Admin\Downloads\src\FeatherFixer.py"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5312
- - C:\Program Files\Python312\python.exe
    "C:\Program Files\Python312\python.exe" "C:\Users\Admin\Downloads\src\FeatherFixer.py"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\py.exe
  "C:\Windows\py.exe" "C:\Users\Admin\Downloads\src\FeatherFixer.py"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Program Files\Python312\python.exe
    "C:\Program Files\Python312\python.exe" "C:\Users\Admin\Downloads\src\FeatherFixer.py"
    3⤵
    - Executes dropped EXE
    PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4244 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:3780

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\src\build\FeatherFixer\PYZ-00.pyz"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Program Files\Python312\python.exe
  "C:\Program Files\Python312\python.exe" "C:\Users\Admin\Downloads\src\build\FeatherFixer\PYZ-00.pyz"
  2⤵
  - Executes dropped EXE
  PID:4796

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\src\build\FeatherFixer\PYZ-00\" -spe -an -ai#7zMap1605:120:7zEvent27333
1⤵
- Suspicious use of FindShellTrayWindow
PID:5568

C:\Users\Admin\Downloads\src\dist\FeatherFixer.exe
"C:\Users\Admin\Downloads\src\dist\FeatherFixer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\Downloads\src\dist\FeatherFixer.exe
  "C:\Users\Admin\Downloads\src\dist\FeatherFixer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:3980
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    PID:5824
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec /i node-v20.14.0-x64.msi
    3⤵
    - Blocklisted process makes network request
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:3616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery