Analysis
- max time kernel
121s - max time network
126s - platform
windows7_x64 - resource
win7-20241023-en - resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system - submitted
22/01/2025, 01:16
Static task
static1
Behavioral task
behavioral1
Sample
using python exe.exe
Resource
win7-20241023-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
using python exe.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
20 signatures
150 seconds
General
- Target using python exe.exe
- Size 24.8MB
- Sample250122-bmsstszrdt
- SHA256 dcc64a3e8791dc7d343a656a67f0f9ff600ef5998f3730094a284b447cc43709
- MD5 08d61dc71afefa0c6984312cd4018825
- SHA1 06ce6af134316e62ac88c04965b1e62c02de86df
- SHA512 a4e64943cf93b793981857ae26d6c537e35fd28714e6b2e205637500d2d9c55d55e0ebe33595b26626c26c12695f75cfaa0c36a53065725213ada0cecc2f70fd
- SSDEEP 786432:gJ1HSHwSmCP+V73y3RncnQb+029KeTOPwkcfbklcmQ:gJ1HSHwSm6+VGBcq8KeTOpO/mQ
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 1984 wsedriverraw.exe 1140 wsedriverraw.exe 1184 Process not Found - Loads dropped DLL 9 IoCs
pid Process 2508 MsiExec.exe 2596 using python exe.exe 2516 MsiExec.exe 2516 MsiExec.exe 2516 MsiExec.exe 2516 MsiExec.exe 2784 msiexec.exe 1140 wsedriverraw.exe 1184 Process not Found - Blocklisted process makes network request 2 IoCs
flow pid Process 6 2992 msiexec.exe 7 2784 msiexec.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: using python exe.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: using python exe.exe File opened (read-only) \??\Q: using python exe.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: using python exe.exe File opened (read-only) \??\U: using python exe.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: using python exe.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: using python exe.exe File opened (read-only) \??\N: using python exe.exe File opened (read-only) \??\R: using python exe.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: using python exe.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: using python exe.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: using python exe.exe File opened (read-only) \??\W: using python exe.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: using python exe.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: using python exe.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: using python exe.exe File opened (read-only) \??\Z: using python exe.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: using python exe.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: using python exe.exe File opened (read-only) \??\P: using python exe.exe File opened (read-only) \??\X: using python exe.exe File opened (read-only) \??\S: using python exe.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Secure\Installer\wsedriverraw.exe msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIC744.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76c3ee.ipi msiexec.exe File opened for modification C:\Windows\Installer\f76c3eb.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC55E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC6B7.tmp msiexec.exe File created C:\Windows\Installer\f76c3ee.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSICA42.tmp msiexec.exe File created C:\Windows\Installer\f76c3f0.msi msiexec.exe File created C:\Windows\Installer\f76c3eb.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC639.tmp msiexec.exe - Detects Pyinstaller 1 IoCs
resource yara_rule behavioral1/files/0x000b0000000187a8-293.dat pyinstaller - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language using python exe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe - Modifies registry class 23 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26C433DA4E1E5104EBD9E7BEC8A2C6A1\PackageCode = "A31E671DA2986344CA11378E63C5663B" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26C433DA4E1E5104EBD9E7BEC8A2C6A1\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26C433DA4E1E5104EBD9E7BEC8A2C6A1\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6E0CEE053FBBFFC43BE95E3EB04C229B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6E0CEE053FBBFFC43BE95E3EB04C229B\26C433DA4E1E5104EBD9E7BEC8A2C6A1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26C433DA4E1E5104EBD9E7BEC8A2C6A1\SourceList\PackageName = "using python exe.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\26C433DA4E1E5104EBD9E7BEC8A2C6A1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26C433DA4E1E5104EBD9E7BEC8A2C6A1\ProductName = "Installer" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26C433DA4E1E5104EBD9E7BEC8A2C6A1\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26C433DA4E1E5104EBD9E7BEC8A2C6A1\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26C433DA4E1E5104EBD9E7BEC8A2C6A1\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26C433DA4E1E5104EBD9E7BEC8A2C6A1\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26C433DA4E1E5104EBD9E7BEC8A2C6A1\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26C433DA4E1E5104EBD9E7BEC8A2C6A1\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26C433DA4E1E5104EBD9E7BEC8A2C6A1\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\Secure\\Installer 5\\install\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\26C433DA4E1E5104EBD9E7BEC8A2C6A1\MainFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26C433DA4E1E5104EBD9E7BEC8A2C6A1 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26C433DA4E1E5104EBD9E7BEC8A2C6A1\Version = "83886080" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26C433DA4E1E5104EBD9E7BEC8A2C6A1\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26C433DA4E1E5104EBD9E7BEC8A2C6A1\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26C433DA4E1E5104EBD9E7BEC8A2C6A1\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26C433DA4E1E5104EBD9E7BEC8A2C6A1\SourceList\Media\1 = "Disk1;Disk1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26C433DA4E1E5104EBD9E7BEC8A2C6A1\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\Secure\\Installer 5\\install\\" msiexec.exe - Modifies system certificate store 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 using python exe.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 using python exe.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 using python exe.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 using python exe.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2784 msiexec.exe 2784 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2784 msiexec.exe Token: SeTakeOwnershipPrivilege 2784 msiexec.exe Token: SeSecurityPrivilege 2784 msiexec.exe Token: SeCreateTokenPrivilege 2596 using python exe.exe Token: SeAssignPrimaryTokenPrivilege 2596 using python exe.exe Token: SeLockMemoryPrivilege 2596 using python exe.exe Token: SeIncreaseQuotaPrivilege 2596 using python exe.exe Token: SeMachineAccountPrivilege 2596 using python exe.exe Token: SeTcbPrivilege 2596 using python exe.exe Token: SeSecurityPrivilege 2596 using python exe.exe Token: SeTakeOwnershipPrivilege 2596 using python exe.exe Token: SeLoadDriverPrivilege 2596 using python exe.exe Token: SeSystemProfilePrivilege 2596 using python exe.exe Token: SeSystemtimePrivilege 2596 using python exe.exe Token: SeProfSingleProcessPrivilege 2596 using python exe.exe Token: SeIncBasePriorityPrivilege 2596 using python exe.exe Token: SeCreatePagefilePrivilege 2596 using python exe.exe Token: SeCreatePermanentPrivilege 2596 using python exe.exe Token: SeBackupPrivilege 2596 using python exe.exe Token: SeRestorePrivilege 2596 using python exe.exe Token: SeShutdownPrivilege 2596 using python exe.exe Token: SeDebugPrivilege 2596 using python exe.exe Token: SeAuditPrivilege 2596 using python exe.exe Token: SeSystemEnvironmentPrivilege 2596 using python exe.exe Token: SeChangeNotifyPrivilege 2596 using python exe.exe Token: SeRemoteShutdownPrivilege 2596 using python exe.exe Token: SeUndockPrivilege 2596 using python exe.exe Token: SeSyncAgentPrivilege 2596 using python exe.exe Token: SeEnableDelegationPrivilege 2596 using python exe.exe Token: SeManageVolumePrivilege 2596 using python exe.exe Token: SeImpersonatePrivilege 2596 using python exe.exe Token: SeCreateGlobalPrivilege 2596 using python exe.exe Token: SeCreateTokenPrivilege 2596 using python exe.exe Token: SeAssignPrimaryTokenPrivilege 2596 using python exe.exe Token: SeLockMemoryPrivilege 2596 using python exe.exe Token: SeIncreaseQuotaPrivilege 2596 using python exe.exe Token: SeMachineAccountPrivilege 2596 using python exe.exe Token: SeTcbPrivilege 2596 using python exe.exe Token: SeSecurityPrivilege 2596 using python exe.exe Token: SeTakeOwnershipPrivilege 2596 using python exe.exe Token: SeLoadDriverPrivilege 2596 using python exe.exe Token: SeSystemProfilePrivilege 2596 using python exe.exe Token: SeSystemtimePrivilege 2596 using python exe.exe Token: SeProfSingleProcessPrivilege 2596 using python exe.exe Token: SeIncBasePriorityPrivilege 2596 using python exe.exe Token: SeCreatePagefilePrivilege 2596 using python exe.exe Token: SeCreatePermanentPrivilege 2596 using python exe.exe Token: SeBackupPrivilege 2596 using python exe.exe Token: SeRestorePrivilege 2596 using python exe.exe Token: SeShutdownPrivilege 2596 using python exe.exe Token: SeDebugPrivilege 2596 using python exe.exe Token: SeAuditPrivilege 2596 using python exe.exe Token: SeSystemEnvironmentPrivilege 2596 using python exe.exe Token: SeChangeNotifyPrivilege 2596 using python exe.exe Token: SeRemoteShutdownPrivilege 2596 using python exe.exe Token: SeUndockPrivilege 2596 using python exe.exe Token: SeSyncAgentPrivilege 2596 using python exe.exe Token: SeEnableDelegationPrivilege 2596 using python exe.exe Token: SeManageVolumePrivilege 2596 using python exe.exe Token: SeImpersonatePrivilege 2596 using python exe.exe Token: SeCreateGlobalPrivilege 2596 using python exe.exe Token: SeCreateTokenPrivilege 2596 using python exe.exe Token: SeAssignPrimaryTokenPrivilege 2596 using python exe.exe Token: SeLockMemoryPrivilege 2596 using python exe.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2596 using python exe.exe 2992 msiexec.exe 2992 msiexec.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2784 wrote to memory of 2508 2784 msiexec.exe 31 PID 2784 wrote to memory of 2508 2784 msiexec.exe 31 PID 2784 wrote to memory of 2508 2784 msiexec.exe 31 PID 2784 wrote to memory of 2508 2784 msiexec.exe 31 PID 2784 wrote to memory of 2508 2784 msiexec.exe 31 PID 2784 wrote to memory of 2508 2784 msiexec.exe 31 PID 2784 wrote to memory of 2508 2784 msiexec.exe 31 PID 2596 wrote to memory of 2992 2596 using python exe.exe 32 PID 2596 wrote to memory of 2992 2596 using python exe.exe 32 PID 2596 wrote to memory of 2992 2596 using python exe.exe 32 PID 2596 wrote to memory of 2992 2596 using python exe.exe 32 PID 2596 wrote to memory of 2992 2596 using python exe.exe 32 PID 2596 wrote to memory of 2992 2596 using python exe.exe 32 PID 2596 wrote to memory of 2992 2596 using python exe.exe 32 PID 2784 wrote to memory of 2516 2784 msiexec.exe 33 PID 2784 wrote to memory of 2516 2784 msiexec.exe 33 PID 2784 wrote to memory of 2516 2784 msiexec.exe 33 PID 2784 wrote to memory of 2516 2784 msiexec.exe 33 PID 2784 wrote to memory of 2516 2784 msiexec.exe 33 PID 2784 wrote to memory of 2516 2784 msiexec.exe 33 PID 2784 wrote to memory of 2516 2784 msiexec.exe 33 PID 2784 wrote to memory of 1984 2784 msiexec.exe 35 PID 2784 wrote to memory of 1984 2784 msiexec.exe 35 PID 2784 wrote to memory of 1984 2784 msiexec.exe 35 PID 1984 wrote to memory of 1140 1984 wsedriverraw.exe 36 PID 1984 wrote to memory of 1140 1984 wsedriverraw.exe 36 PID 1984 wrote to memory of 1140 1984 wsedriverraw.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\using python exe.exe"C:\Users\Admin\AppData\Local\Temp\using python exe.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Secure\Installer 5\install\using python exe.msi" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\using python exe.exe" SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1737249136 "2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2992
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Loads dropped DLL
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DCC02999B4A4593C9FC9D0B285290ED4 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2508
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A5C0F5C712F30F5657B75E325AE981152⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2516
-
-
C:\Program Files (x86)\Secure\Installer\wsedriverraw.exe"C:\Program Files (x86)\Secure\Installer\wsedriverraw.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Program Files (x86)\Secure\Installer\wsedriverraw.exe"C:\Program Files (x86)\Secure\Installer\wsedriverraw.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\f76c3ef.rbs
- Size 7KB
- SHA256 5ce8377116cb9d99dfdbf186141645435ffbf0c928cf1e011a3fbdaa1fccad28
- MD5 faa474decad0579d875f352c668e46af
- SHA1 1ca2eb812311f4e736e4717bbab15772027d3074
- SHA512 6d448e6dadb2e986d36809aaf90b4c069978d0c1fbd2955838ec58c417787cf658671c273eee31bdc3969a59058d29f4edf94d7fa1f792bc62f09db534bd2223
- SSDEEP 96:Kh0b69a5l76ev4kZ6lUNpPXCsAq6lUNpPXC6j0KKelAqiHST5njWsViiC4plj0Cl:K19awe++TPSZ+TPSiBc4p+k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Secure\Installer\wsedriverraw.exe
- Size 18.7MB
- SHA256 cc60a440ee6042296b8e2e700e2f7ecf1e0adb0168eca1077567b83160e84198
- MD5 6a884fc9baead0257f860b23dffedd7a
- SHA1 6a5d6262f37cd14ff8fc2e4fd53801e0e2adf022
- SHA512 d5c5ffe745b93501d4dfe152f2b70195490fa20e49bcd5e5df774ca5022820f36474e67b69414623aab1fe840dd333dd36257edb62fbea3c76d223c9962905bd
- SSDEEP 393216:hXilnit/lnD149dM/ISqL2Vmd6mFT7YB0GzajzjZlRhhYJtHraKoHy35FWYbCIC6:FiditZCT6ISqyVmdXsEzjPR8LLaKqIT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07298EE8EBA9732300AE62BDCA6B6898
- Size 1KB
- SHA256 2e7bf16cc22485a7bbe2aa8696750761b0ae39be3b2fe9d0cc6d4ef73491425c
- MD5 e11e31581aae545302f6176a117b4d95
- SHA1 743af0529bd032a0f44a83cdd4baa97b7c2ec49a
- SHA512 c63aba6ca79c60a92b3bd26d784a5436e45a626022958bf6c194afc380c7bfb01fadf0b772513bbdbd7f1bb73691b0edb2f60b2f235ec9e0b81c427e04fbe451
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07298EE8EBA9732300AE62BDCA6B6898
- Size 312B
- SHA256 e873d28b335a97d1d3408347a525fafebf355463221a7c2fab430ce4db76fd24
- MD5 4abd810a3c4f5fa4b565c750887c20c4
- SHA1 24ccae31307360ab2a59f585f533b13395bc41bb
- SHA512 58f6edabb227bf2c0765a569bb3cf25dcb5962fef550afe887aae82a1c1f2339053524399add0a690e2c7223d8726599ca63d38343d06b86518236cd653bb7ab
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 25fff6a774c45e829341959923f4b6afe6f97b17b82a02a517eb9e6ebaad8de0
- MD5 a6c748c194eac87937baaa2aa4cc2b63
- SHA1 0c67f78e0f3366b8278c6c6de619cf8c41db4ebd
- SHA512 2ea4d4ec7f4e4b915ab18795f5fd38235237ba2aecbb1dae9e18a0cdf24ae3fa1b422e9fb27edd880c02144b498bf230bc014c286c6148660be174be0897138d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 9ee5644269bacc79ee861e542fcd50a19f73055d7ce720b75156dbbb0f905e1e
- MD5 54cedcab97d5e80d209bfe73f8c695c9
- SHA1 d554abc9fd7b2d5e53ce523a630f4b0e224136fe
- SHA512 adba8136b02d239e4858a7ab870d3bc25c7b03664dcf106c00d5471d9c6ed49b00baaebbee8cd25651cd6e2e375c4c6f71046cfd2efee6e298c81247903c3172
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\CabBC8D.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIC0E1.tmp
- Size 1001KB
- SHA256 e831a5aebc7bd941fa815a9441e552a0ba699f9bd5454036a68ccbb42200353a
- MD5 de574f7f5256f98f356a2d620c4a2288
- SHA1 1d57d182bb748170f5cefb7ecf594b4998e113b8
- SHA512 431f3ea61d23028e1c538af3c808e7213d629615e3cb22b41d44715ff805323da82880c35bc90fffe95621132dad96eab5bfcc395863f167664a5666369d0d5b
- SSDEEP 24576:KnknHeDU4dmI6Eepd5TsP1Ih0lhSMXlrcsiG/Ch:6knHeVdOEod5+1d7csiG/Ch
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TarBE45.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI19842\importlib_metadata-8.5.0.dist-info\INSTALLER
- Size 4B
- SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
- MD5 365c9bfeb7d89244f2ce01c1de44cb85
- SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
- SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\_MEI19842\python39.dll
- Size 4.3MB
- SHA256 324963a39b8fd045ff634bb3271508dab5098b4d99e85e7648d0b47c32dc85c3
- MD5 2135da9f78a8ef80850fa582df2c7239
- SHA1 aac6ad3054de6566851cae75215bdeda607821c4
- SHA512 423b03990d6aa9375ce10e6b62ffdb7e1e2f20a62d248aac822eb9d973ae2bf35deddd2550a4a0e17c51ad9f1e4f86443ca8f94050e0986daa345d30181a2369
- SSDEEP 49152:icfsV4WJ+NXBzGcS5V7Du7RHEYNf/OpEQZIMKKx+qNIowg1h9MKpj4ZkYMCfmUIS:6JeB1SDaZf/7Ns9MLZfERUHRMXIwNKX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Secure\Installer 5\install\using python exe.msi
- Size 2.4MB
- SHA256 67e61409a7b4b0f36575317fee4908bad024d24e1e6cb7d9dfbcc320b0673593
- MD5 af7d0a9a4170d6b4309ac9ad976ef278
- SHA1 8e10a3a528418d03bb096cdaf3c7f315cd9e9068
- SHA512 9d6f522487e025f2038346e206cddbbc80a2b9ea2339c0565ea1388d571671e349bf825fa27ee44a839807f2c458282b18d3c5f549384413a2856bc2dc1c676f
- SSDEEP 49152:ztlTknHeVdOEod5+1d7csiG/CCpndAhMtBGvoUw4SaWv:fYHeVdPod57CdA+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Secure\Installer 5\install\using python exe1.cab
- Size 18.5MB
- SHA256 31e57fdb20758359f49d029afc8910e18ac1162700a7ec5a48e418537a564e34
- MD5 ec72e5dff456a4a87742cc0d8757fa43
- SHA1 5058c765bfd0d8d444760b252ffc495f1e375a6e
- SHA512 2cf96de8f71ba4a719d86be5307e3054c92ca68c034d5bbeb1e7df7ee51bd562f1889b3bdf7859c0c7605e72dfeaf5eb7abefe1019671188b13232420e3d8d20
- SSDEEP 393216:+IN3K2+gtzYCuQhN+9QL29KeTSNk0z76hiZwk3heQaFVk+vXxxx+LRYl6bUUyQ:+y3RncnQb+029KeTOPwkcfbklcmx
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\preC1FB.tmp
- Size 893KB
- SHA256 3b4bac5bbb4bf191691a1b052926418d4bcab5e9aad9d535f4e1e87a19617308
- MD5 1e105e916a38059af2253769bc9be624
- SHA1 521ec39ffafd44ddd5cd793ecc126481f1ee411a
- SHA512 eec650afe3ccb812241716530722129e35917043bca41cbba3b7e17b9f560f346908b9559d4c2f2313032348a5ba1cbf3f1d4dc66553b1da9d956c754322059a
- SSDEEP 24576:0RGpIr2wmiWdSxRa4hMERh0lhSMXlMOZGs+oUw4SaWB:BpndAhMtBGvoUw4SaWB
- MD5 SHA1 SHA512 SSDEEP