Overview

overview

8

Static

static

3

py.exe

windows10-2004-x64

8

py.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/06/2026, 18:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    py.exe
  • Size 34.1MB
  • Sample260623-wryj4aey2n
  • SHA256 71921560431825a67182cc50d9036bb45a52215f8e7cf2c6e49a0406b6392864
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasionpersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Loads dropped DLL 27 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\py.exe
    "C:\Users\Admin\AppData\Local\Temp\py.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5408
    • C:\Users\Admin\AppData\Local\Temp\py.exe
      "C:\Users\Admin\AppData\Local\Temp\py.exe"
      2⤵
      • Disables RegEdit via registry modification
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:3656
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "net user "User_12wa48" "P@ssw0rd123!" /add"
        3⤵
          PID:5584
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "net user "User_w8u7h2" "P@ssw0rd123!" /add"
          3⤵
            PID:1972
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "net user "User_r4xr83" "P@ssw0rd123!" /add"
            3⤵
              PID:3092
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "net user "User_2dklh9" "P@ssw0rd123!" /add"
              3⤵
                PID:5300
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "net user "User_okh3dd" "P@ssw0rd123!" /add"
                3⤵
                  PID:5536
            • C:\Windows\system32\sihost.exe
              sihost.exe
              1⤵
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:3796
              • C:\Windows\explorer.exe
                explorer.exe /LOADSAVEDWINDOWS
                2⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:2684
            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:3356
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:1744

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  prep_Activatable Class_Hermes_perf.cache
                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                  • Size 607B
                  • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
                  • Size 213KB
                  • SHA256 ba7fc544994f126cb7485ce52d265d2f32e93c4f1ea1fcd6fcdee3918f271979
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _imaging.cp313-win_amd64.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\PIL\_imaging.cp313-win_amd64.pyd
                  • Size 2.5MB
                  • SHA256 34b9fbd040c46776f343c65b9ecd252c1cf30e84def79294d7e2675feef1a363
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VCRUNTIME140.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\VCRUNTIME140.dll
                  • Size 117KB
                  • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VCRUNTIME140_1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\VCRUNTIME140_1.dll
                  • Size 48KB
                  • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _bz2.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\_bz2.pyd
                  • Size 83KB
                  • SHA256 55894b2b98d01f37b9a8cf4daf926d0161ff23c2fb31c56f9dbbac3a61932712
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _ctypes.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\_ctypes.pyd
                  • Size 129KB
                  • SHA256 5c4c489ac052795c27af063c96bc4db5ab250144d4839050cfa9bb3836b87c32
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _decimal.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\_decimal.pyd
                  • Size 274KB
                  • SHA256 040f361f63204b55c17a100c260c7ddfadd00866cc055fbd641b83a6747547d5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _hashlib.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\_hashlib.pyd
                  • Size 63KB
                  • SHA256 78223aef72777efc93c739f5308a3fc5de28b7d10e6975b8947552a62592772b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _lzma.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\_lzma.pyd
                  • Size 155KB
                  • SHA256 e44dea262a24df69fd9b50b08d09ae6f8b051137ce0834640c977091a6f9fca8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _queue.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\_queue.pyd
                  • Size 34KB
                  • SHA256 73cade82ee139459fe5841e5631274fc9caf7f579418b613f278125435653539
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _socket.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\_socket.pyd
                  • Size 82KB
                  • SHA256 62d0493ced6ca33e2fd8141649dd9889c23b2e9afc5fdf56edb4f888c88fb823
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _ssl.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\_ssl.pyd
                  • Size 178KB
                  • SHA256 e94f0195363c5c9babfc4c17ec6fb1aa8bbabf59e377db66ce6a79c4c58bbd07
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  auto.tcl
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\_tcl_data\auto.tcl
                  • Size 21KB
                  • SHA256 08113823951619d659eb03a1f6acd2f9500e1264795219125a5df7b83cabcb99
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cp1252.enc
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\_tcl_data\encoding\cp1252.enc
                  • Size 1KB
                  • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  init.tcl
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\_tcl_data\init.tcl
                  • Size 25KB
                  • SHA256 acacce15658dd7ce8f69b1e3d3a94770a22972a8e906eb3b61cd06f0ecd5db59
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  package.tcl
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\_tcl_data\package.tcl
                  • Size 23KB
                  • SHA256 b471cec9056b62d562020b14d69d4bd1f92dfe158afc8ba81c6341836211ca46
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tclIndex
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\_tcl_data\tclIndex
                  • Size 7KB
                  • SHA256 577f042bbe640e2739606a1f76098abdb8bd1d1f31526402fb82b21091644f65
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tm.tcl
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\_tcl_data\tm.tcl
                  • Size 11KB
                  • SHA256 f0cc13daca21fee538cca757aa09e88a969a85174eda26e61e573dda6c7ba413
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  pkgIndex.tcl
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\_tk_data\pkgIndex.tcl
                  • Size 376B
                  • SHA256 6127926b94db2992ab450fc6cc2ec3d071f7bbc856656d0ae20cc3fd4036f547
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  tk.tcl
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\_tk_data\tk.tcl
                  • Size 23KB
                  • SHA256 b7fd24177b17f67da2ca671f711309c65cf246be1fd0cf4f1ab8f3ea9ca2c3f1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _tkinter.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\_tkinter.pyd
                  • Size 66KB
                  • SHA256 f34a80dc8435934c410b621a354ea88801d41d1089b0f3128e60aac170b083ad
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _wmi.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\_wmi.pyd
                  • Size 39KB
                  • SHA256 afad80f9e62a57814779cf3e48352b583c1a0697b11a23cc9db3f4e43f7f8664
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  base_library.zip
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\base_library.zip
                  • Size 1.3MB
                  • SHA256 fb6c5b902ff11bb4b48b0882b409cc23d0b50b2fc97489051f93c09cbae7b22e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cd.cp313-win_amd64.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\charset_normalizer\cd.cp313-win_amd64.pyd
                  • Size 10KB
                  • SHA256 2e9f5049b3c5db7ab78c6abb94dfbbfe035ebab8f40594320f8c92221f486f24
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libcrypto-3.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\libcrypto-3.dll
                  • Size 5.0MB
                  • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libffi-8.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\libffi-8.dll
                  • Size 38KB
                  • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libssl-3.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\libssl-3.dll
                  • Size 774KB
                  • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  python3.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\python3.dll
                  • Size 70KB
                  • SHA256 c1de4bfe57dc4a5be8c72c865d617dc39dfd8162fcd2ce1fac9f401cf9efb504
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  python313.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\python313.dll
                  • Size 5.8MB
                  • SHA256 78b1dd211c0e66a0603df48da2c9b67a915ab3258701b9285d3faa255ed8dc25
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  select.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\select.pyd
                  • Size 31KB
                  • SHA256 81f124b01a85882e362a42e94a13c0eff2f4ccd72d461821dc5457a789554413
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Lorem ipsum.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                  • Size 1KB
                  • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  tcl86t.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\tcl86t.dll
                  • Size 1.8MB
                  • SHA256 7269609c395716853a95e9b37828cda4ffb03d7cb956ba82147eb18b2e528f5f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msgcat-1.6.1.tm
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\tcl8\8.5\msgcat-1.6.1.tm
                  • Size 34KB
                  • SHA256 adca186be560f2236265f538d4cb6df1171bed91192118796988bb9c08a4bc7c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tk86t.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\tk86t.dll
                  • Size 1.5MB
                  • SHA256 32e4e077e4a55860dc84ea15d25c168bf1e656973e07fcc2f43d1a7ce440bd49
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ucrtbase.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\ucrtbase.dll
                  • Size 1.1MB
                  • SHA256 3d2217d9bdf5f9f2dd2a295c2329a1dc929236e44995b7a7fb25765faee966fe
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  unicodedata.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\unicodedata.pyd
                  • Size 695KB
                  • SHA256 3f462ee6e7743a87e5791181936539642e3761c55de3de980a125f91fe21f123
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  zlib1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI54082\zlib1.dll
                  • Size 143KB
                  • SHA256 908ac77373641d1733fa847c59e0e854088f80252ee544223c6488b119055e9a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/1744-1306-0x000001ECAB000000-0x000001ECAB434000-memory.dmp
                  Download

                  memory/3356-1137-0x00000206001E0000-0x00000206002E0000-memory.dmp
                  Download

                  memory/3356-1145-0x0000020603C90000-0x0000020603CB0000-memory.dmp
                  Download

                  memory/3356-1177-0x0000020E1D670000-0x0000020E1D690000-memory.dmp
                  Download

                  memory/3356-1142-0x0000020603E50000-0x0000020603F50000-memory.dmp
                  Download

                  memory/3356-1141-0x0000020603A30000-0x0000020603A50000-memory.dmp
                  Download

                  memory/3356-1136-0x00000206001E0000-0x00000206002E0000-memory.dmp
                  Download

                  memory/3356-1135-0x00000206001E0000-0x00000206002E0000-memory.dmp
                  Download

                  memory/3656-1130-0x00007FFA95E00000-0x00007FFA95E29000-memory.dmp
                  Download