IR Report: Unpacking a Python Executable
Event ID 1: Process Creation & Initial Triage
Our investigation began with the identification of Event ID 1 (process creation).
The primary executable, process_creation_lab.exe, was executed from the user's Downloads directory. A critical first
step involved hashing the file and querying it against VirusTotal.
Deep analysis was conducted using
[Link] to extract relevant logs in EVTX format. Subsequently
EvtxECmd parsed these logs into CSV, which were then imported into TimelineExplorer for a comprehensive timeline
reconstruction. This process provided a full picture of the events, revealing the parent process originated from:
C:\\Users\\mn402\\Downloads\\process_creation_lab.exe.
Technical Timeline: Unpacking and Runtime
Libraries
Execution of process_creation_lab.exe triggered a self-extraction phase consistent with a PyInstaller-packed Python
executable. The process unpacked multiple runtime and dependency libraries into a temporary folder
(C:\\Users\\mn402\\AppData\\Local\\Temp\_MEI91082\\).
[Link] [Link]
Compression engine C/C++ runtime library
[Link] & [Link] [Link]
GUI runtime components Python interpreter
[Link] [Link]
Cryptographic libraries (OpenSSL) Visual C++ runtime
This sequence indicates a self-contained Python application, where an executable bundles its dependencies, unpacks
them into a temporary location, and then executes its core logic