cf0b47eafa7787a698bc8dbb62d18f1d16d0659ff7bd7e6312ccb50b08b754b6

General

Target

net8.0-windows/install-python.bat
Size

683B
MD5

d2582c98db5aad03be0d391a265f861b
SHA1

bb545f83d8d69c8a1a08cd773ddcb53689e8f57c
SHA256

44d62021bd4fa1870a45fc9f1b9bb978196987452688060a87ee97e4626fa4af
SHA512

268a5a71c70081ee8d6aa34d0a9158740712e174a70a0fac2972bd8fa812c34107ba2859d2f31391cc4b27f3f81a986160d9feb14880bdf02fe0c43567b2afbe

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000\Control Panel\International\Geo\Nation	python-3.12.2-amd64.exe

Executes dropped EXE 3 IoCs

pid	Process
3860	python-3.12.2-amd64.exe
1628	python-3.12.2-amd64.exe
5016	python-3.12.2-amd64.exe

Loads dropped DLL 1 IoCs

pid	Process
1628	python-3.12.2-amd64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.2-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.2-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.2-amd64.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	5028	vssvc.exe
Token: SeRestorePrivilege	5028	vssvc.exe
Token: SeAuditPrivilege	5028	vssvc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2488	1936	cmd.exe	81
PID 1936 wrote to memory of 2488	1936	cmd.exe	81
PID 1936 wrote to memory of 3860	1936	cmd.exe	82
PID 1936 wrote to memory of 3860	1936	cmd.exe	82
PID 1936 wrote to memory of 3860	1936	cmd.exe	82
PID 3860 wrote to memory of 1628	3860	python-3.12.2-amd64.exe	83
PID 3860 wrote to memory of 1628	3860	python-3.12.2-amd64.exe	83
PID 3860 wrote to memory of 1628	3860	python-3.12.2-amd64.exe	83
PID 1628 wrote to memory of 5016	1628	python-3.12.2-amd64.exe	84
PID 1628 wrote to memory of 5016	1628	python-3.12.2-amd64.exe	84
PID 1628 wrote to memory of 5016	1628	python-3.12.2-amd64.exe	84
PID 1936 wrote to memory of 8	1936	cmd.exe	88
PID 1936 wrote to memory of 8	1936	cmd.exe	88

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

cURL User-Agent 2 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	9	curl/8.7.1
HTTP User-Agent header	17	curl/8.7.1

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\net8.0-windows\install-python.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\system32\curl.exe
  curl -L -o python-3.12.2-amd64.exe https://www.python.org/ftp/python/3.12.2/python-3.12.2-amd64.exe
  2⤵
  PID:2488
- C:\Users\Admin\AppData\Local\Temp\net8.0-windows\python-3.12.2-amd64.exe
  python-3.12.2-amd64.exe /quiet InstallAllUsers=1 PrependPath=1 Include_test=0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\Temp\{DCD7C951-6762-4B4D-A87B-EF594B168842}\.cr\python-3.12.2-amd64.exe
    "C:\Windows\Temp\{DCD7C951-6762-4B4D-A87B-EF594B168842}\.cr\python-3.12.2-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\net8.0-windows\python-3.12.2-amd64.exe" -burn.filehandle.attached=552 -burn.filehandle.self=560 /quiet InstallAllUsers=1 PrependPath=1 Include_test=0
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Windows\Temp\{CD1D7921-3DEC-4393-B68A-926D8C2D3C80}\.be\python-3.12.2-amd64.exe
      "C:\Windows\Temp\{CD1D7921-3DEC-4393-B68A-926D8C2D3C80}\.be\python-3.12.2-amd64.exe" -q -burn.elevated BurnPipe.{3D6B8CBB-48BD-42E7-B1BC-A002F29F0361} {B9BC85D7-569D-4CB9-9BB7-68F909273F84} 1628
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5016
- C:\Windows\system32\curl.exe
  curl -L -o get-pip.py https://bootstrap.pypa.io/get-pip.py
  2⤵
  PID:8

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\net8.0-windows\get-pip.py

Filesize
2.2MB

MD5
f342256ee74ff8d8dfc95fdef9325a2f

SHA1
1bae613f32a12fc4dac9698d81048407a87db430

SHA256
96e58b5962f307566141ea9b393e136cbdf811db9f02968dc5bc88f43989345c

SHA512
6cb415947bd8d55a1e5fa76e35c394196048679533015ce64db05804599415837cfe4f490503cd467eadfc3475cca951941a5baba1ecca998b1d15e1f4053b58

Download Submit
C:\Users\Admin\AppData\Local\Temp\net8.0-windows\python-3.12.2-amd64.exe

Filesize
25.4MB

MD5
44abfae489d87cc005d50a9267b5d58d

SHA1
af778548383c17cb154530f1c06344c9cced9272

SHA256
b9314802f9efbf0f20a8e2cb4cacc4d5cfb0110dac2818d94e770e1ba5137c65

SHA512
e955f0bee350cd8f7e4da6a8e8f02db40e477b7465a77c8ecab46a54338c0a9d8acf3d22d524af2c45c25685df2468970ea1b70b83321c7f8e3fae230f3c7f16

Download Submit
C:\Windows\Temp\{CD1D7921-3DEC-4393-B68A-926D8C2D3C80}\.ba\PythonBA.dll

Filesize
675KB

MD5
8294dc8850dd596d0ce8455167496832

SHA1
5c75c685c95bee8c1a39187da8af46b6c7892757

SHA256
565f03893da383e5bec8c6eaa7c8fbb3e6db0b9bddd5a1399b0dec66fa44d64d

SHA512
21015ca201b64e3316f3d1ee32e4c562d0142111c1ed576f03aa078619fe656c56848b5998313af23aabb97293c5452be0e27d5c44878be5d90ac2d2d2f05851

Download Submit
C:\Windows\Temp\{CD1D7921-3DEC-4393-B68A-926D8C2D3C80}\.ba\SideBar.png

Filesize
50KB

MD5
888eb713a0095756252058c9727e088a

SHA1
c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4

SHA256
79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067

SHA512
7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0

Download Submit
C:\Windows\Temp\{DCD7C951-6762-4B4D-A87B-EF594B168842}\.cr\python-3.12.2-amd64.exe

Filesize
858KB

MD5
ab21a1bea9e3eaab64a2c062ab613221

SHA1
310b1f7921af8edf125eacba71944b6e5356acdf

SHA256
1474dbd6a33da8f2f0b50007ba48f0c1ddb3e0e6f8c969722eed1e683a9af68a

SHA512
b39b5a24bb7b2d3ead8aed284452c94280398a9e4855f17a8e3593fe718e9b3573e88b15f1dd4659030827e754b17e7f918ba24803e4d522ad9601167fb70df4

Download Submit

Analysis

Sharing