File name:

pythoninstaller.exe

Full analysis: https://app.any.run/tasks/e4b7960b-0833-478d-a3f7-7bd09f11f80b
Verdict: Malicious activity
Analysis date: January 11, 2025, 00:55:25
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
python
arch-doc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 7 sections
MD5:

2219A75743FDA5B533023410764E668B

SHA1:

27DAB3D164726FADC3103B741A00A1567B305949

SHA256:

88EEB8271BB2F66C9A4E328F6A0C870DAE04703820D0E0DCA7D67D5F35480280

SSDEEP:

98304:pQWO7Z3ssuDfLYvI9yf+8Gm1MXpm+JM+acSU5jqV5HjzE5DEpH506A0/bBHwsZIS:g1joZLXzqIpivZNvSNf6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • pyinstall.exe (PID: 5316)

  • SUSPICIOUS

    • Process drops python dynamic module

      • pythoninstaller.exe (PID: 5544)
      • msiexec.exe (PID: 556)

    • The process drops C-runtime libraries

      • pythoninstaller.exe (PID: 5544)
      • pyinstall.exe (PID: 5316)
      • msiexec.exe (PID: 556)

    • Executable content was dropped or overwritten

      • pythoninstaller.exe (PID: 5544)
      • pythoninstaller.exe (PID: 2136)
      • pyinstall.exe (PID: 5316)
      • pyinstall.exe (PID: 3172)

    • Process drops legitimate windows executable

      • pythoninstaller.exe (PID: 5544)
      • pyinstall.exe (PID: 5316)
      • msiexec.exe (PID: 556)

    • Application launched itself

      • pythoninstaller.exe (PID: 5544)

    • Loads Python modules

      • pythoninstaller.exe (PID: 2136)
      • pyinstall.exe (PID: 5316)

    • Process checks presence of unattended files

      • pythoninstaller.exe (PID: 2136)
      • pyinstall.exe (PID: 5316)

    • The executable file from the user directory is run by the CMD process

      • pyinstall.exe (PID: 3172)

    • Starts CMD.EXE for commands execution

      • pythoninstaller.exe (PID: 2136)

    • Searches for installed software

      • pyinstall.exe (PID: 5316)

    • Creates a software uninstall entry

      • pyinstall.exe (PID: 5316)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 556)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 556)

  • INFO

    • Reads the computer name

      • pythoninstaller.exe (PID: 5544)
      • pythoninstaller.exe (PID: 2136)
      • pyinstall.exe (PID: 5316)
      • msiexec.exe (PID: 556)

    • Checks supported languages

      • pythoninstaller.exe (PID: 5544)
      • pythoninstaller.exe (PID: 2136)
      • pyinstall.exe (PID: 5316)
      • pyinstall.exe (PID: 3172)
      • msiexec.exe (PID: 556)

    • The sample compiled with english language support

      • pythoninstaller.exe (PID: 5544)
      • pythoninstaller.exe (PID: 2136)
      • pyinstall.exe (PID: 3172)
      • pyinstall.exe (PID: 5316)
      • msiexec.exe (PID: 556)

    • Create files in a temporary directory

      • pythoninstaller.exe (PID: 5544)
      • pyinstall.exe (PID: 3172)
      • pyinstall.exe (PID: 5316)

    • Checks proxy server information

      • pythoninstaller.exe (PID: 2136)

    • Creates files or folders in the user directory

      • pyinstall.exe (PID: 5316)
      • msiexec.exe (PID: 556)

    • Reads the machine GUID from the registry

      • pyinstall.exe (PID: 5316)
      • msiexec.exe (PID: 556)

    • Reads the software policy settings

      • msiexec.exe (PID: 556)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 556)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

Subsystem: Windows command line
SubsystemVersion: 5.2
ImageVersion: -
OSVersion: 5.2
EntryPoint: 0xb9e0
UninitializedDataSize: -
InitializedDataSize: 154112
CodeSize: 176640
LinkerVersion: 14.38
PEType: PE32+
ImageFileCharacteristics: Executable, Large address aware
TimeStamp: 2024:12:15 01:50:28+00:00
MachineType: AMD AMD64
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
7
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start pythoninstaller.exe conhost.exe no specs pythoninstaller.exe cmd.exe no specs pyinstall.exe pyinstall.exe msiexec.exe

Process information

PID
CMD
Path
Indicators
Parent process
5544"C:\Users\admin\AppData\Local\Temp\pythoninstaller.exe" C:\Users\admin\AppData\Local\Temp\pythoninstaller.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\pythoninstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5740\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—pythoninstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2136"C:\Users\admin\AppData\Local\Temp\pythoninstaller.exe" C:\Users\admin\AppData\Local\Temp\pythoninstaller.exe
pythoninstaller.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\pythoninstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3820C:\WINDOWS\system32\cmd.exe /c "pyinstall.exe"C:\Windows\System32\cmd.exe—pythoninstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
3172pyinstall.exeC:\Users\admin\pythoninstaller\pyinstall.exe
cmd.exe
User:
admin
Company:
Python Software Foundation
Integrity Level:
MEDIUM
Description:
Python 3.13.1 (64-bit)
Version:
3.13.1150.0
Modules
Images
c:\users\admin\pythoninstaller\pyinstall.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5316"C:\Users\admin\AppData\Local\Temp\{09589840-91E5-4444-BB0C-5863B1F44A05}\.cr\pyinstall.exe" -burn.clean.room="C:\Users\admin\pythoninstaller\pyinstall.exe" -burn.filehandle.attached=600 -burn.filehandle.self=596 C:\Users\admin\AppData\Local\Temp\{09589840-91E5-4444-BB0C-5863B1F44A05}\.cr\pyinstall.exe
pyinstall.exe
User:
admin
Company:
Python Software Foundation
Integrity Level:
MEDIUM
Description:
Python 3.13.1 (64-bit)
Version:
3.13.1150.0
Modules
Images
c:\users\admin\appdata\local\temp\{09589840-91e5-4444-bb0c-5863b1f44a05}\.cr\pyinstall.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
556C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
22 041
Read events
18 937
Write events
3 059
Delete events
45

Modification events

(PID) Process:(5316) pyinstall.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1abbd55d-059a-4d1e-bdf1-35bb74697f5a}
Operation:writeName:BundleCachePath
Value:
C:\Users\admin\AppData\Local\Package Cache\{1abbd55d-059a-4d1e-bdf1-35bb74697f5a}\python-3.13.1-amd64.exe
(PID) Process:(5316) pyinstall.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1abbd55d-059a-4d1e-bdf1-35bb74697f5a}
Operation:writeName:BundleUpgradeCode
Value:
{F96F59BD-3E48-5E4E-B1A4-6CAFADEFEAE8}
(PID) Process:(5316) pyinstall.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1abbd55d-059a-4d1e-bdf1-35bb74697f5a}
Operation:writeName:BundleAddonCode
Value:
(PID) Process:(5316) pyinstall.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1abbd55d-059a-4d1e-bdf1-35bb74697f5a}
Operation:writeName:BundleDetectCode
Value:
(PID) Process:(5316) pyinstall.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1abbd55d-059a-4d1e-bdf1-35bb74697f5a}
Operation:writeName:BundlePatchCode
Value:
(PID) Process:(5316) pyinstall.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1abbd55d-059a-4d1e-bdf1-35bb74697f5a}
Operation:writeName:BundleVersion
Value:
3.13.1150.0
(PID) Process:(5316) pyinstall.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1abbd55d-059a-4d1e-bdf1-35bb74697f5a}
Operation:writeName:VersionMajor
Value:
3
(PID) Process:(5316) pyinstall.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1abbd55d-059a-4d1e-bdf1-35bb74697f5a}
Operation:writeName:VersionMinor
Value:
13
(PID) Process:(5316) pyinstall.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1abbd55d-059a-4d1e-bdf1-35bb74697f5a}
Operation:writeName:BundleProviderKey
Value:
CPython-3.13
(PID) Process:(5316) pyinstall.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1abbd55d-059a-4d1e-bdf1-35bb74697f5a}
Operation:writeName:BundleTag
Value:
Executable files
136
Suspicious files
96
Text files
907
Unknown types
1

Dropped files

PID
Process
Filename
Type
5544pythoninstaller.exeC:\Users\admin\AppData\Local\Temp\_MEI55442\_brotli.cp312-win_amd64.pydexecutable
MD5:9AD5BB6F92EE2CFD29DDE8DD4DA99EB7
SHA256:788ACBFD0EDD6CA3EF3E97A9487EEAEA86515642C71CB11BBCF25721E6573EC8
5544pythoninstaller.exeC:\Users\admin\AppData\Local\Temp\_MEI55442\_ctypes.pydexecutable
MD5:10FDCF63D1C3C3B7E5861FBB04D64557
SHA256:BC3B83D2DC9E2F0E6386ED952384C6CF48F6EED51129A50DFD5EF6CBBC0A8FB3
5544pythoninstaller.exeC:\Users\admin\AppData\Local\Temp\_MEI55442\api-ms-win-core-file-l1-1-0.dllexecutable
MD5:7067670187C557F39168D871D158108E
SHA256:D7AF49C42B42AB6D53D0115F491F485B15FEC5998576C900699C00FA74B3EF9C
5544pythoninstaller.exeC:\Users\admin\AppData\Local\Temp\_MEI55442\_socket.pydexecutable
MD5:899380B2D48DF53414B974E11BB711E3
SHA256:B38E66E6EE413E5955EF03D619CADD40FCA8BE035B43093D2342B6F3739E883E
5544pythoninstaller.exeC:\Users\admin\AppData\Local\Temp\_MEI55442\api-ms-win-core-file-l2-1-0.dllexecutable
MD5:E6F48279F9721C34AF7B74145DD888A8
SHA256:C6C4529917C20EF5D1C13ADEFCD3D594198372B765E3766190CE35EC0F9CABC2
5544pythoninstaller.exeC:\Users\admin\AppData\Local\Temp\_MEI55442\VCRUNTIME140.dllexecutable
MD5:4585A96CC4EEF6AAFD5E27EA09147DC6
SHA256:A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
5544pythoninstaller.exeC:\Users\admin\AppData\Local\Temp\_MEI55442\_cffi_backend.cp312-win_amd64.pydexecutable
MD5:FCB71CE882F99EC085D5875E1228BDC1
SHA256:86F136553BA301C70E7BADA8416B77EB4A07F76CCB02F7D73C2999A38FA5FA5B
5544pythoninstaller.exeC:\Users\admin\AppData\Local\Temp\_MEI55442\_bz2.pydexecutable
MD5:C7CE973F261F698E3DB148CCAD057C96
SHA256:02D772C03704FE243C8DE2672C210A5804D075C1F75E738D6130A173D08DFCDE
5544pythoninstaller.exeC:\Users\admin\AppData\Local\Temp\_MEI55442\_ssl.pydexecutable
MD5:9B4E74FD1DE0F8A197E4AA1E16749186
SHA256:A4CE52A9E0DADDBBE7A539D1A7EDA787494F2173DDCC92A3FAF43B7CF597452B
5544pythoninstaller.exeC:\Users\admin\AppData\Local\Temp\_MEI55442\_hashlib.pydexecutable
MD5:F495D1897A1B52A2B15C20DCECB84B47
SHA256:E47E76D70D508B62924FE480F30E615B12FDD7745C0AAC68A2CDDABD07B692AE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
36
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
556
msiexec.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBTOQYLFSE5GO%2FpaRVfYu7d9gZEbQAQU2UEpsA8PY2zvadf1zSmepEhqMOYCEzMAAAAF%2B3pcMhNh310AAAAAAAU%3D
unknown
—
—
whitelisted
556
msiexec.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBTh4QXD3xfHaxna9yfH20h%2Ft5LfbQQUZZ9RzoVofy%2BKRYiq3acxux4NAF4CEzMAATrAmwCycB81MNQAAAABOsA%3D
unknown
—
—
whitelisted
556
msiexec.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBTh4QXD3xfHaxna9yfH20h%2Ft5LfbQQUZZ9RzoVofy%2BKRYiq3acxux4NAF4CEzMAATrAmwCycB81MNQAAAABOsA%3D
unknown
—
—
whitelisted
556
msiexec.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBTDHsfuqfubd3pihvq4mgQVWgHWNwQUyH7SaoUqG8oZmAQHJ89QEE9oqKICEzMAAAAHh6M0o3uljhwAAAAAAAc%3D
unknown
—
—
whitelisted
3260
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6644
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5988
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
104.126.37.131:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 172.217.16.142
whitelisted
www.bing.com
  • 104.126.37.131
  • 104.126.37.145
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.22
  • 40.126.32.140
  • 40.126.32.68
  • 20.190.160.14
  • 40.126.32.72
  • 40.126.32.138
  • 20.190.160.17
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
www.python.org
  • 151.101.64.223
  • 151.101.0.223
  • 151.101.192.223
  • 151.101.128.223
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
pythoninstaller.exe