dcf91485a3bc4aeacb7624ad8d343d1c266980b2094f49455fa3a502c070b02d

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25-Nuke-main/python_installer.bat
Size 4KB
Sample260709-tw3cqset5s
SHA256 dcf91485a3bc4aeacb7624ad8d343d1c266980b2094f49455fa3a502c070b02d
MD5 4f31ac0b42feb3428c352af017835ad5
SHA1 fb5e1946364f156d4a210c60c44ed5bacd65d0ba
SHA512 6108e51c07cb35f2efbc493480da39548ee829a7ec6155c370de21a2375f8cb4b1fbee7b6c480764978be9f276b7274de43d8220ee1ac0670af510cd17f8975a
SSDEEP 96:SnXBF0XkzDdaRRE3HHFul/viMGNzQcydKiMJmIrjN8N7U:mZzDdaLqul/vrGNEdK7VXN8N7U
TLSH
T194A162573C28D47062B4C6AA5D9D4162F78693D309016DC936BF80E86F163E623BE37E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution ransomware

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2396	py_setup.exe
3920	py_setup.exe
3728	python-3.11.5-amd64.exe

Loads dropped DLL 1 IoCs

pid	Process
3920	py_setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5728	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.11.5-amd64.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000aa8d3db9b2bda1420000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801aa8d3db90000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101aa8d3db9000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3aa8d3db900000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6aa8d3db900000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4156	timeout.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
5052	taskkill.exe
2488	taskkill.exe
5320	taskkill.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6012	WMIC.exe
6012	WMIC.exe
6012	WMIC.exe
6012	WMIC.exe
5728	powershell.exe
5728	powershell.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeDebugPrivilege	5052	taskkill.exe
Token: SeDebugPrivilege	2488	taskkill.exe
Token: SeDebugPrivilege	5320	taskkill.exe
Token: SeIncreaseQuotaPrivilege	6012	WMIC.exe
Token: SeSecurityPrivilege	6012	WMIC.exe
Token: SeTakeOwnershipPrivilege	6012	WMIC.exe
Token: SeLoadDriverPrivilege	6012	WMIC.exe
Token: SeSystemProfilePrivilege	6012	WMIC.exe
Token: SeSystemtimePrivilege	6012	WMIC.exe
Token: SeProfSingleProcessPrivilege	6012	WMIC.exe
Token: SeIncBasePriorityPrivilege	6012	WMIC.exe
Token: SeCreatePagefilePrivilege	6012	WMIC.exe
Token: SeBackupPrivilege	6012	WMIC.exe
Token: SeRestorePrivilege	6012	WMIC.exe
Token: SeShutdownPrivilege	6012	WMIC.exe
Token: SeDebugPrivilege	6012	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6012	WMIC.exe
Token: SeRemoteShutdownPrivilege	6012	WMIC.exe
Token: SeUndockPrivilege	6012	WMIC.exe
Token: SeManageVolumePrivilege	6012	WMIC.exe
Token: 33	6012	WMIC.exe
Token: 34	6012	WMIC.exe
Token: 35	6012	WMIC.exe
Token: 36	6012	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6012	WMIC.exe
Token: SeSecurityPrivilege	6012	WMIC.exe
Token: SeTakeOwnershipPrivilege	6012	WMIC.exe
Token: SeLoadDriverPrivilege	6012	WMIC.exe
Token: SeSystemProfilePrivilege	6012	WMIC.exe
Token: SeSystemtimePrivilege	6012	WMIC.exe
Token: SeProfSingleProcessPrivilege	6012	WMIC.exe
Token: SeIncBasePriorityPrivilege	6012	WMIC.exe
Token: SeCreatePagefilePrivilege	6012	WMIC.exe
Token: SeBackupPrivilege	6012	WMIC.exe
Token: SeRestorePrivilege	6012	WMIC.exe
Token: SeShutdownPrivilege	6012	WMIC.exe
Token: SeDebugPrivilege	6012	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6012	WMIC.exe
Token: SeRemoteShutdownPrivilege	6012	WMIC.exe
Token: SeUndockPrivilege	6012	WMIC.exe
Token: SeManageVolumePrivilege	6012	WMIC.exe
Token: 33	6012	WMIC.exe
Token: 34	6012	WMIC.exe
Token: 35	6012	WMIC.exe
Token: 36	6012	WMIC.exe
Token: SeDebugPrivilege	5728	powershell.exe
Token: SeBackupPrivilege	428	vssvc.exe
Token: SeRestorePrivilege	428	vssvc.exe
Token: SeAuditPrivilege	428	vssvc.exe
Token: SeBackupPrivilege	2584	srtasks.exe
Token: SeRestorePrivilege	2584	srtasks.exe
Token: SeSecurityPrivilege	2584	srtasks.exe
Token: SeTakeOwnershipPrivilege	2584	srtasks.exe
Token: SeBackupPrivilege	2584	srtasks.exe
Token: SeRestorePrivilege	2584	srtasks.exe
Token: SeSecurityPrivilege	2584	srtasks.exe
Token: SeTakeOwnershipPrivilege	2584	srtasks.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 5052	1240	cmd.exe	89
PID 1240 wrote to memory of 2488	1240	cmd.exe	91
PID 1240 wrote to memory of 5320	1240	cmd.exe	92
PID 1240 wrote to memory of 4156	1240	cmd.exe	93
PID 1240 wrote to memory of 1816	1240	cmd.exe	94
PID 1816 wrote to memory of 3888	1816	cmd.exe	95
PID 1240 wrote to memory of 3084	1240	cmd.exe	96
PID 3084 wrote to memory of 2072	3084	cmd.exe	97
PID 3084 wrote to memory of 2616	3084	cmd.exe	98
PID 1240 wrote to memory of 5828	1240	cmd.exe	99
PID 5828 wrote to memory of 6012	5828	cmd.exe	100
PID 5828 wrote to memory of 3148	5828	cmd.exe	101
PID 1240 wrote to memory of 4212	1240	cmd.exe	102
PID 1240 wrote to memory of 5728	1240	cmd.exe	103
PID 1240 wrote to memory of 4140	1240	cmd.exe	104
PID 4140 wrote to memory of 5868	4140	cmd.exe	105
PID 1240 wrote to memory of 3224	1240	cmd.exe	106
PID 1240 wrote to memory of 4836	1240	cmd.exe	107
PID 1240 wrote to memory of 2396	1240	cmd.exe	108
PID 2396 wrote to memory of 3920	2396	py_setup.exe	109
PID 3920 wrote to memory of 3728	3920	py_setup.exe	110
PID 1240 wrote to memory of 5064	1240	cmd.exe	118
PID 5064 wrote to memory of 2388	5064	cmd.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\25-Nuke-main\python_installer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\system32\taskkill.exe
  taskkill /f /im python.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5052
- C:\Windows\system32\taskkill.exe
  taskkill /f /im pythonw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2488
- C:\Windows\system32\taskkill.exe
  taskkill /f /im pip.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5320
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:3888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe" /v "DisplayName" 2>nul | findstr /i "Python"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\system32\reg.exe
    reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe" /v "DisplayName"
    3⤵
    PID:2072
- - C:\Windows\system32\findstr.exe
    findstr /i "Python"
    3⤵
    PID:2616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic product where "Name like ''Python%''" get IdentifyingNumber /format:value 2>nul | findstr "IdentifyingNumber"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5828
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product where "Name like ''Python%''" get IdentifyingNumber /format:value
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6012
- - C:\Windows\system32\findstr.exe
    findstr "IdentifyingNumber"
    3⤵
    PID:3148
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Python" /f
  2⤵
  PID:4212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "$u=[System.Environment]::GetEnvironmentVariable('PATH','User'); $c=($u -split ';' | Where-Object {$_ -notmatch '(?i)python' -and $_ -notmatch '(?i)Scripts' -and $_ -ne ''} | Select-Object -Unique) -join ';'; [System.Environment]::SetEnvironmentVariable('PATH',$c,'User');"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKCU\Environment" /v PATH 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Environment" /v PATH
    3⤵
    PID:5868
- C:\Windows\system32\where.exe
  where python
  2⤵
  PID:3224
- C:\Windows\system32\curl.exe
  curl -L "https://www.python.org/ftp/python/3.11.5/python-3.11.5-amd64.exe" -o "C:\Users\Admin\AppData\Roaming\py_setup.exe"
  2⤵
  PID:4836
- C:\Users\Admin\AppData\Roaming\py_setup.exe
  "C:\Users\Admin\AppData\Roaming\py_setup.exe" /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0 Include_launcher=1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\Temp\{ABE80171-99E5-40DF-A3FA-026F58D01199}\.cr\py_setup.exe
    "C:\Windows\Temp\{ABE80171-99E5-40DF-A3FA-026F58D01199}\.cr\py_setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Roaming\py_setup.exe" -burn.filehandle.attached=604 -burn.filehandle.self=744 /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0 Include_launcher=1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3920
  - - C:\Windows\Temp\{DE5B7019-698C-4462-B621-80E892F7700C}\.be\python-3.11.5-amd64.exe
      "C:\Windows\Temp\{DE5B7019-698C-4462-B621-80E892F7700C}\.be\python-3.11.5-amd64.exe" -q -burn.elevated BurnPipe.{EE71B3AB-0985-48B2-BA9E-B596F2DCDA5A} {E1B1A7EC-8657-4D31-8F65-51184984A4FA} 3920
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKCU\Environment" /v PATH 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Environment" /v PATH
    3⤵
    PID:2388

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:428

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

py_setup.exe

Path C:\Users\Admin\AppData\Roaming\py_setup.exe
Size 24.7MB
SHA256 1bb46f65bb6f71b295801c8ff596bb5b69fa4c0645541db5f3d3bac33aa6eade
MD5 3afd5b0ba1549f5b9a90c1e3aa8f041e
SHA1 f68e39fc58029b272f3138eb9e6058ece72631ec
SHA512 c86bbeacad3ae3c7bde747f5b4f09c11eced841add14e79ec4a064e5e29ebca35460e543ba735b11bfb882837d5ff4371ce64492d28d096b4686233c9a8cda6d
SSDEEP 786432:e4t7SDsf+VDTKtIPvpGW47zFkN5x1Ef8d9zr:t6sf+VDTK2PMWSs5x10qr
TLSH
T1B447333354504977E6B000B7F92895383FADAF182B1084BAF6D07E363D351AA63F756A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

py_setup.exe

Path C:\Windows\Temp\{ABE80171-99E5-40DF-A3FA-026F58D01199}\.cr\py_setup.exe
Size 858KB
SHA256 75ea2903bc1578e651cd2f0307b6866300514babd21fe29db693803cf75bb5d9
MD5 2051bdaf3239362bd087334e7ee0922c
SHA1 e040960991badbe75e3a3e7a8ea568bd6b29ad7c
SHA512 ba5acb91a350291c24722c27cbccdafaf3ee8de0b0acb936ad0582b09d64589db425967214623b6c8dfce07918cd490bd33ea368bf00f7174f9fba2e7d45e6e6
SSDEEP 24576:I5mWpI2jFM5sFzfTpiCGqNQ6weQpOU2xmrPAwqU:I5BjBbTpiCxQ6wnpOU2xmrjqU
TLSH
T11015AF3265A14072E7F10573BA28D530BE6CAF281750C8AEE3D4BE1D7E7449267F7292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PythonBA.dll

Path C:\Windows\Temp\{DE5B7019-698C-4462-B621-80E892F7700C}\.ba\PythonBA.dll
Size 674KB
SHA256 d5f7beaf6bd3b19f1bd2c5e9503d91bee11a50f1f5ff93e46a90bd3383d31177
MD5 cdb479e5b8b2f961ddac00489faa7045
SHA1 d8cc1a4fa8fcbe0a59eb618ff0a0a35a18f1aa83
SHA512 e03aa5145d266d033e496324ab0ef3ce6f2d6608e271c37620bc4f338f2f868b3798c1461ab836899d8fb464dfb0f4c34022951c29a24379520a5c9677bf08d8
SSDEEP 6144:iDFVSxYqyMjOmGGeeaGaPHQ+nMPK4XZQGVWFkuMX+lUeH1E+HvO:ISTyMjtqePaPHqPKNkuMXSVO
TLSH
T173E48D1174808271FDF620BB46BCB63946ADF4B4077899CF1AC85AEBEA605C29F37543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SideBar.png

Path C:\Windows\Temp\{DE5B7019-698C-4462-B621-80E892F7700C}\.ba\SideBar.png
Size 50KB
SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
MD5 888eb713a0095756252058c9727e088a
SHA1 c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4
SHA512 7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0
SSDEEP 1536:/c/aRsg1fYfJt0Bg74nWPMMCNBaeQzxxj8ckBo:UcsgGfP0yCWTAaeyxxjGBo
TLSH
T1F33302E488115E7BCBE33A0615458CEF4EA9215F976C91886971C7CA5842F0CE3FE9D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5728-2-0x00000149FAE60000-0x00000149FAE82000-memory.dmp

Download