be0b5318d28784df090e1bab91d1cd7f76cfc0dae740ce2199aa07d83e25267e

Analysis

max time kernel
453s
max time network
488s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
11-06-2024 10:00

Target

python-3.12.4-amd64.exe
Size

25.5MB
MD5

f3df1be26cc7cbd8252ab5632b62d740
SHA1

3b1f54802b4cb8c02d1eb78fc79f95f91e8e49e4
SHA256

da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258
SHA512

2f9a11ffae6d9f1ed76bf816f28812fcba71f87080b0c92e52bfccb46243118c5803a7e25dd78003ca7d66501bfcdce8ff7c691c63c0038b0d409ca3842dcc89
SSDEEP

786432:zRd0l0X/46+nq1rcVqA5Z2bQcLsv0GlYrJF55e2nRk:L5P46+q1QTILMKB5e2nRk

Score

4^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Executes dropped EXE 1 IoCs

Processes:

python-3.12.4-amd64.exe

pid process

4224 python-3.12.4-amd64.exe
Loads dropped DLL 1 IoCs

Processes:

python-3.12.4-amd64.exe

pid process

4224 python-3.12.4-amd64.exe

pid	process
4224	python-3.12.4-amd64.exe

pid	process
4224	python-3.12.4-amd64.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

python-3.12.4-amd64.exe

description	pid	process	target process
PID 4128 wrote to memory of 4224	4128	python-3.12.4-amd64.exe	python-3.12.4-amd64.exe
PID 4128 wrote to memory of 4224	4128	python-3.12.4-amd64.exe	python-3.12.4-amd64.exe
PID 4128 wrote to memory of 4224	4128	python-3.12.4-amd64.exe	python-3.12.4-amd64.exe

C:\Users\Admin\AppData\Local\Temp\python-3.12.4-amd64.exe
"C:\Users\Admin\AppData\Local\Temp\python-3.12.4-amd64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\Temp\{4746CEB3-EDC4-413C-892B-702C282AE6D5}\.cr\python-3.12.4-amd64.exe
  "C:\Windows\Temp\{4746CEB3-EDC4-413C-892B-702C282AE6D5}\.cr\python-3.12.4-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python-3.12.4-amd64.exe" -burn.filehandle.attached=588 -burn.filehandle.self=584
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4224

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\Temp\{423C89D5-88C6-43FE-A224-00EA6320E22A}\.ba\PythonBA.dll

Filesize
675KB

MD5
e58bf4439057b22e6db8735be19d61ad

SHA1
415e148ecf78754a72de761d88825366aaf7afa1

SHA256
e3d3f38fd9a32720db3a65180857497d9064cffe0a54911c96b6138a17199058

SHA512
8d3523a12ee82123a17e73e507d42ae3248bd5c0aa697d5a379e61b965781bd83c0c97de41104b494b1f3b42127ab4b48ac9a071d5194a75c2af107016fc8c9c

Download Submit
C:\Windows\Temp\{423C89D5-88C6-43FE-A224-00EA6320E22A}\.ba\SideBar.png

Filesize
50KB

MD5
888eb713a0095756252058c9727e088a

SHA1
c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4

SHA256
79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067

SHA512
7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0

Download Submit
C:\Windows\Temp\{4746CEB3-EDC4-413C-892B-702C282AE6D5}\.cr\python-3.12.4-amd64.exe

Filesize
858KB

MD5
504fdaeaa19b2055ffc58d23f830e104

SHA1
7071c8189d1ecd09173111f9787888723040433f

SHA256
8f211f3b8af3a2e6fd4aff1ac27a1ad9cd9737524e016b2e3bfc689dfdad95fb

SHA512
01aa983cbddfe38e69f381e8f8e66988273ef453b095012f9c0eeae01d39e32deb0e6fb369363cbb5e387485be33a53ac3ec16d3de1f42bb2cde0cfa05ceb366

Download Submit