General
- Target python-manager-26.3.msix
- Size 44.9MB
- Sample260808-jakkpaserh
- SHA256 bdd1a4e0b485f674748b275095cc8e7132beb37a1ae91db080abb2661e3badec
Malware Config
Targets
-
- Target python-manager-26.3.msix
- Size 44.9MB
- SHA256 bdd1a4e0b485f674748b275095cc8e7132beb37a1ae91db080abb2661e3badec
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target py-manager.exe
- Size 306KB
- SHA256 b9f4ab19f635829a06b77c40c5fe7f445406e15770514cd022b0e539c56c6f16
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target py.exe
- Size 306KB
- SHA256 d2e3f5fa8f1feb5443b70062663e1e4555dfeec4155c2cf0ad432eb8b861d469
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
- Target pymanager.exe
- Size 306KB
- SHA256 ebcf68dcb3c615ea37219d69b907204e1c55f9eb54199ec24f74a778ce200951
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target pyshellext.exe
- Size 1002KB
- SHA256 701bc674a6899fb335e6bc3080eb25541a769385b52a181a9276ac6fe7ffb46f
Score1/10 -
- Target python.exe
- Size 306KB
- SHA256 5da5ad3f515a97310adaa03019a110de8cab9f275767a6571c7b2a722c89eae9
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target python3.exe
- Size 306KB
- SHA256 9ae0b98f4b26d0955690c7afe57959376dca88f13fcd65d0bb1cb90abbeb1b29
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target pythonw.exe
- Size 305KB
- SHA256 7d450669d2d7b7718ca7ac1553624d4ea9e3b24a70f38ad7b0818d5ef849713c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target pythonw3.exe
- Size 305KB
- SHA256 eaa7f2e64d622bd1467c5b952a6a333680de430cfd8f38304eac10c161217eb6
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
- Target pyw-manager.exe
- Size 305KB
- SHA256 80222b201cb344b1af7c8d4a0c186d9ccb42c72cc3d2d495b73a5a588abc5f6e
Score7/10-
Loads dropped DLL
-
- Target pyw.exe
- Size 305KB
- SHA256 1db546e626dd3d0023162781d9ba02c1f08417ef56c83ddbdffa3e7d26bfbef4
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target pywmanager.exe
- Size 305KB
- SHA256 9abbe5eaffaddca52c2da03d846fb396c977246181ccc7ac9b405be6209f2bfa
Score1/10 -
- Target runtime/_native.cp314-win_amd64.pyd
- Size 203KB
- SHA256 5040ce83390655f6f021e02d5a6d956f36e148192737850915793a159e3bce97
Score1/10 -
- Target runtime/manage.cp314-win_amd64.pyd
- Size 423KB
- SHA256 c93c8e9efc9bb8eb1dabd4016f2e432445fabc590234c174c0090fd02f727c56
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target runtime/python314.dll
- Size 6.5MB
- SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
Score1/10 -
- Target templates/launcher-32.exe
- Size 456KB
- SHA256 6cbc0248aae531c92201b4d700e2917cc0ddb6677470f58af53d0426f56c0b26
Score3/10
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
3Obfuscated Files or Information
1Command Obfuscation
1Subvert Trust Controls
1Install Root Certificate
1