Analysis
- max time kernel
149s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/07/2026, 12:13
General
- Target ImageLogger-main/install_python.bat
- Size 700B
- Sample260710-pd5ypabs3p
- SHA256 f2dd02228d70d02117008e4e295b36d9af242d5d2c621421732d326605081ea4
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 11 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 16 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ImageLogger-main\install_python.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest https://www.python.org/ftp/python/ -UseBasicParsing | Select-String -Pattern '3.10.[0-9]{1,2}' -AllMatches | Select-Object -ExpandProperty Matches | Select-Object -ExpandProperty Value | Sort-Object -Descending -Unique | Select-Object -First 1"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-WebRequest https://www.python.org/ftp/python/ -UseBasicParsing | Select-String -Pattern '3.10.[0-9]{1,2}' -AllMatches | Select-Object -ExpandProperty Matches | Select-Object -ExpandProperty Value | Sort-Object -Descending -Unique | Select-Object -First 1"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\curl.execurl -L -o python-installer.exe https://www.python.org/ftp/python/3.10.9/python-3.10.9-amd64.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ImageLogger-main\python-installer.exepython-installer.exe /quiet /passive InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=02⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{CAE7976E-F571-46BB-9A75-F11BEDD21766}\.cr\python-installer.exe"C:\Windows\Temp\{CAE7976E-F571-46BB-9A75-F11BEDD21766}\.cr\python-installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\ImageLogger-main\python-installer.exe" -burn.filehandle.attached=608 -burn.filehandle.self=748 /quiet /passive InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=03⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{09D4094D-5465-471C-BE1A-A20476D6CC09}\.be\python-3.10.9-amd64.exe"C:\Windows\Temp\{09D4094D-5465-471C-BE1A-A20476D6CC09}\.be\python-3.10.9-amd64.exe" -q -burn.elevated BurnPipe.{65792BC3-C9AA-4629-B188-C746D8C8F2C3} {6F8117A7-F932-4CC9-8EE9-81CDDE7079AD} 53124⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Package Cache\{e8531749-5517-4937-a722-a4052cb2d75e}\python-3.10.9-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{e8531749-5517-4937-a722-a4052cb2d75e}\python-3.10.9-amd64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Package Cache\{e8531749-5517-4937-a722-a4052cb2d75e}\python-3.10.9-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{e8531749-5517-4937-a722-a4052cb2d75e}\python-3.10.9-amd64.exe" /passive /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.10.9 (64-bit)_20260710131405.log" InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=02⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Package Cache\{e8531749-5517-4937-a722-a4052cb2d75e}\python-3.10.9-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{e8531749-5517-4937-a722-a4052cb2d75e}\python-3.10.9-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{e8531749-5517-4937-a722-a4052cb2d75e}\python-3.10.9-amd64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /passive /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.10.9 (64-bit)_20260710131405.log" InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=03⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
lib_JustForMe
tcltk_JustForMe
pip.msi
tools.msi
path.msi
core.msi
dev.msi
exe.msi
python-installer.exe
Python 3.10.9 (64-bit)_20260710131405.log
Python 3.10.9 (64-bit)_20260710131405_000_core_JustForMe.log
PythonBA.dll
SideBar.png
launcher_AllUsers
python-installer.exe
memory/1596-219-0x00000000005F0000-0x0000000000678000-memory.dmp
memory/2796-218-0x0000021C911C0000-0x0000021C91B64000-memory.dmp
memory/4104-220-0x00000000005F0000-0x0000000000678000-memory.dmp
memory/4928-9-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/4928-163-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/4928-12-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/4928-11-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/4928-10-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/4928-17-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/4928-8-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/4928-13-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/4928-7-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/4928-6-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/4928-5-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/4928-3-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/4928-4-0x000001478BF90000-0x000001478BFB2000-memory.dmp
memory/4928-14-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/4928-16-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/4928-0-0x00007FFA7AA9F000-0x00007FFA7AAA0000-memory.dmp