dcf91485a3bc4aeacb7624ad8d343d1c266980b2094f49455fa3a502c070b02d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25-Nuke-main/python_installer.bat
Size 4KB
Sample260709-tw3cqset5s
SHA256 dcf91485a3bc4aeacb7624ad8d343d1c266980b2094f49455fa3a502c070b02d
MD5 4f31ac0b42feb3428c352af017835ad5
SHA1 fb5e1946364f156d4a210c60c44ed5bacd65d0ba
SHA512 6108e51c07cb35f2efbc493480da39548ee829a7ec6155c370de21a2375f8cb4b1fbee7b6c480764978be9f276b7274de43d8220ee1ac0670af510cd17f8975a
SSDEEP 96:SnXBF0XkzDdaRRE3HHFul/viMGNzQcydKiMJmIrjN8N7U:mZzDdaLqul/vrGNEdK7VXN8N7U
TLSH
T194A162573C28D47062B4C6AA5D9D4162F78693D309016DC936BF80E86F163E623BE37E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
6	2992	curl.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	py_setup.exe

Executes dropped EXE 3 IoCs

pid	Process
3884	py_setup.exe
4732	py_setup.exe
368	python-3.11.5-amd64.exe

Loads dropped DLL 1 IoCs

pid	Process
4732	py_setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3972	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.11.5-amd64.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e0d688459d835b340000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e0d688450000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e0d68845000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae0d68845000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de0d68845000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4672	timeout.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
2100	taskkill.exe
4356	taskkill.exe
4144	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3972	powershell.exe
3972	powershell.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	taskkill.exe
Token: SeDebugPrivilege	4356	taskkill.exe
Token: SeDebugPrivilege	4144	taskkill.exe
Token: SeIncreaseQuotaPrivilege	412	WMIC.exe
Token: SeSecurityPrivilege	412	WMIC.exe
Token: SeTakeOwnershipPrivilege	412	WMIC.exe
Token: SeLoadDriverPrivilege	412	WMIC.exe
Token: SeSystemProfilePrivilege	412	WMIC.exe
Token: SeSystemtimePrivilege	412	WMIC.exe
Token: SeProfSingleProcessPrivilege	412	WMIC.exe
Token: SeIncBasePriorityPrivilege	412	WMIC.exe
Token: SeCreatePagefilePrivilege	412	WMIC.exe
Token: SeBackupPrivilege	412	WMIC.exe
Token: SeRestorePrivilege	412	WMIC.exe
Token: SeShutdownPrivilege	412	WMIC.exe
Token: SeDebugPrivilege	412	WMIC.exe
Token: SeSystemEnvironmentPrivilege	412	WMIC.exe
Token: SeRemoteShutdownPrivilege	412	WMIC.exe
Token: SeUndockPrivilege	412	WMIC.exe
Token: SeManageVolumePrivilege	412	WMIC.exe
Token: 33	412	WMIC.exe
Token: 34	412	WMIC.exe
Token: 35	412	WMIC.exe
Token: 36	412	WMIC.exe
Token: SeIncreaseQuotaPrivilege	412	WMIC.exe
Token: SeSecurityPrivilege	412	WMIC.exe
Token: SeTakeOwnershipPrivilege	412	WMIC.exe
Token: SeLoadDriverPrivilege	412	WMIC.exe
Token: SeSystemProfilePrivilege	412	WMIC.exe
Token: SeSystemtimePrivilege	412	WMIC.exe
Token: SeProfSingleProcessPrivilege	412	WMIC.exe
Token: SeIncBasePriorityPrivilege	412	WMIC.exe
Token: SeCreatePagefilePrivilege	412	WMIC.exe
Token: SeBackupPrivilege	412	WMIC.exe
Token: SeRestorePrivilege	412	WMIC.exe
Token: SeShutdownPrivilege	412	WMIC.exe
Token: SeDebugPrivilege	412	WMIC.exe
Token: SeSystemEnvironmentPrivilege	412	WMIC.exe
Token: SeRemoteShutdownPrivilege	412	WMIC.exe
Token: SeUndockPrivilege	412	WMIC.exe
Token: SeManageVolumePrivilege	412	WMIC.exe
Token: 33	412	WMIC.exe
Token: 34	412	WMIC.exe
Token: 35	412	WMIC.exe
Token: 36	412	WMIC.exe
Token: SeDebugPrivilege	3972	powershell.exe
Token: SeBackupPrivilege	1412	vssvc.exe
Token: SeRestorePrivilege	1412	vssvc.exe
Token: SeAuditPrivilege	1412	vssvc.exe
Token: SeBackupPrivilege	4584	srtasks.exe
Token: SeRestorePrivilege	4584	srtasks.exe
Token: SeSecurityPrivilege	4584	srtasks.exe
Token: SeTakeOwnershipPrivilege	4584	srtasks.exe
Token: SeBackupPrivilege	4584	srtasks.exe
Token: SeRestorePrivilege	4584	srtasks.exe
Token: SeSecurityPrivilege	4584	srtasks.exe
Token: SeTakeOwnershipPrivilege	4584	srtasks.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 2100	3916	cmd.exe	88
PID 3916 wrote to memory of 4356	3916	cmd.exe	90
PID 3916 wrote to memory of 4144	3916	cmd.exe	91
PID 3916 wrote to memory of 4672	3916	cmd.exe	92
PID 3916 wrote to memory of 2736	3916	cmd.exe	93
PID 2736 wrote to memory of 724	2736	cmd.exe	94
PID 3916 wrote to memory of 4964	3916	cmd.exe	95
PID 4964 wrote to memory of 2416	4964	cmd.exe	96
PID 4964 wrote to memory of 3288	4964	cmd.exe	97
PID 3916 wrote to memory of 3196	3916	cmd.exe	98
PID 3196 wrote to memory of 412	3196	cmd.exe	99
PID 3196 wrote to memory of 548	3196	cmd.exe	100
PID 3916 wrote to memory of 876	3916	cmd.exe	101
PID 3916 wrote to memory of 3972	3916	cmd.exe	102
PID 3916 wrote to memory of 4020	3916	cmd.exe	103
PID 4020 wrote to memory of 2952	4020	cmd.exe	104
PID 3916 wrote to memory of 1148	3916	cmd.exe	105
PID 3916 wrote to memory of 2992	3916	cmd.exe	106
PID 3916 wrote to memory of 3884	3916	cmd.exe	113
PID 3884 wrote to memory of 4732	3884	py_setup.exe	114
PID 4732 wrote to memory of 368	4732	py_setup.exe	115
PID 3916 wrote to memory of 4400	3916	cmd.exe	123
PID 4400 wrote to memory of 2548	4400	cmd.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\25-Nuke-main\python_installer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\system32\taskkill.exe
  taskkill /f /im python.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\system32\taskkill.exe
  taskkill /f /im pythonw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4356
- C:\Windows\system32\taskkill.exe
  taskkill /f /im pip.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4144
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe" /v "DisplayName" 2>nul | findstr /i "Python"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\system32\reg.exe
    reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe" /v "DisplayName"
    3⤵
    PID:2416
- - C:\Windows\system32\findstr.exe
    findstr /i "Python"
    3⤵
    PID:3288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic product where "Name like ''Python%''" get IdentifyingNumber /format:value 2>nul | findstr "IdentifyingNumber"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product where "Name like ''Python%''" get IdentifyingNumber /format:value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:412
- - C:\Windows\system32\findstr.exe
    findstr "IdentifyingNumber"
    3⤵
    PID:548
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Python" /f
  2⤵
  PID:876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "$u=[System.Environment]::GetEnvironmentVariable('PATH','User'); $c=($u -split ';' | Where-Object {$_ -notmatch '(?i)python' -and $_ -notmatch '(?i)Scripts' -and $_ -ne ''} | Select-Object -Unique) -join ';'; [System.Environment]::SetEnvironmentVariable('PATH',$c,'User');"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKCU\Environment" /v PATH 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Environment" /v PATH
    3⤵
    PID:2952
- C:\Windows\system32\where.exe
  where python
  2⤵
  PID:1148
- C:\Windows\system32\curl.exe
  curl -L "https://www.python.org/ftp/python/3.11.5/python-3.11.5-amd64.exe" -o "C:\Users\Admin\AppData\Roaming\py_setup.exe"
  2⤵
  - Downloads MZ/PE file
  PID:2992
- C:\Users\Admin\AppData\Roaming\py_setup.exe
  "C:\Users\Admin\AppData\Roaming\py_setup.exe" /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0 Include_launcher=1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\Temp\{C728EA73-8760-4751-A7B5-49D498E7C3D5}\.cr\py_setup.exe
    "C:\Windows\Temp\{C728EA73-8760-4751-A7B5-49D498E7C3D5}\.cr\py_setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Roaming\py_setup.exe" -burn.filehandle.attached=568 -burn.filehandle.self=564 /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0 Include_launcher=1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Windows\Temp\{98FE7620-1E25-4AAD-8AB3-3B6C91E5A979}\.be\python-3.11.5-amd64.exe
      "C:\Windows\Temp\{98FE7620-1E25-4AAD-8AB3-3B6C91E5A979}\.be\python-3.11.5-amd64.exe" -q -burn.elevated BurnPipe.{A96F483D-5CA9-4373-82D2-0785D20A9B55} {A4D7C30A-E1F7-4B4A-9350-BC393B0B2C4E} 4732
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKCU\Environment" /v PATH 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Environment" /v PATH
    3⤵
    PID:2548

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1412

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_3sm4qjlv.id5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3sm4qjlv.id5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

py_setup.exe

Path C:\Users\Admin\AppData\Roaming\py_setup.exe
Size 24.7MB
SHA256 1bb46f65bb6f71b295801c8ff596bb5b69fa4c0645541db5f3d3bac33aa6eade
MD5 3afd5b0ba1549f5b9a90c1e3aa8f041e
SHA1 f68e39fc58029b272f3138eb9e6058ece72631ec
SHA512 c86bbeacad3ae3c7bde747f5b4f09c11eced841add14e79ec4a064e5e29ebca35460e543ba735b11bfb882837d5ff4371ce64492d28d096b4686233c9a8cda6d
SSDEEP 786432:e4t7SDsf+VDTKtIPvpGW47zFkN5x1Ef8d9zr:t6sf+VDTK2PMWSs5x10qr
TLSH
T1B447333354504977E6B000B7F92895383FADAF182B1084BAF6D07E363D351AA63F756A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PythonBA.dll

Path C:\Windows\Temp\{98FE7620-1E25-4AAD-8AB3-3B6C91E5A979}\.ba\PythonBA.dll
Size 674KB
SHA256 d5f7beaf6bd3b19f1bd2c5e9503d91bee11a50f1f5ff93e46a90bd3383d31177
MD5 cdb479e5b8b2f961ddac00489faa7045
SHA1 d8cc1a4fa8fcbe0a59eb618ff0a0a35a18f1aa83
SHA512 e03aa5145d266d033e496324ab0ef3ce6f2d6608e271c37620bc4f338f2f868b3798c1461ab836899d8fb464dfb0f4c34022951c29a24379520a5c9677bf08d8
SSDEEP 6144:iDFVSxYqyMjOmGGeeaGaPHQ+nMPK4XZQGVWFkuMX+lUeH1E+HvO:ISTyMjtqePaPHqPKNkuMXSVO
TLSH
T173E48D1174808271FDF620BB46BCB63946ADF4B4077899CF1AC85AEBEA605C29F37543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SideBar.png

Path C:\Windows\Temp\{98FE7620-1E25-4AAD-8AB3-3B6C91E5A979}\.ba\SideBar.png
Size 50KB
SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
MD5 888eb713a0095756252058c9727e088a
SHA1 c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4
SHA512 7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0
SSDEEP 1536:/c/aRsg1fYfJt0Bg74nWPMMCNBaeQzxxj8ckBo:UcsgGfP0yCWTAaeyxxjGBo
TLSH
T1F33302E488115E7BCBE33A0615458CEF4EA9215F976C91886971C7CA5842F0CE3FE9D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

py_setup.exe

Path C:\Windows\Temp\{C728EA73-8760-4751-A7B5-49D498E7C3D5}\.cr\py_setup.exe
Size 858KB
SHA256 75ea2903bc1578e651cd2f0307b6866300514babd21fe29db693803cf75bb5d9
MD5 2051bdaf3239362bd087334e7ee0922c
SHA1 e040960991badbe75e3a3e7a8ea568bd6b29ad7c
SHA512 ba5acb91a350291c24722c27cbccdafaf3ee8de0b0acb936ad0582b09d64589db425967214623b6c8dfce07918cd490bd33ea368bf00f7174f9fba2e7d45e6e6
SSDEEP 24576:I5mWpI2jFM5sFzfTpiCGqNQ6weQpOU2xmrPAwqU:I5BjBbTpiCxQ6wnpOU2xmrjqU
TLSH
T11015AF3265A14072E7F10573BA28D530BE6CAF281750C8AEE3D4BE1D7E7449267F7292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3972-0-0x000001E50F070000-0x000001E50F092000-memory.dmp

Download