Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    213s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    07/10/2023, 23:39

General

  • Target

    usr/lib/python3.11/site-packages/ansible_collections/amazon/aws/plugins/doc_fragments/aws_region.py

  • Size

    417B

  • MD5

    54a69fc712624730ba8038e9e6d41b95

  • SHA1

    402ed4db1fb5cdb934d31dedb36275b263fba555

  • SHA256

    945da4f9212119c2dc456914a5542e5b79ed7f390c3f64af828d61204553753f

  • SHA512

    74f32b33e82cdb5b4e7bedaf3d975d71abbd74af676ace2ec28b334bcdf4289fbb6f713e2b5b5434b7805c79bf75a73f99350afa0cb6c37b31682a1af9f01653

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\aws_region.py
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\aws_region.py
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2496
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\aws_region.py"
        3⤵
        • Suspicious use of SetWindowsHookEx
        PID:2328

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    a97380e82d77dafefe0f5f796a598a43

    SHA1

    14dd5320c353273213ac14744dd5adcb10ba98dc

    SHA256

    40c8e344426b58b8bacee09c4e0db46423620c4bdb0b97bd481bbac780725f8a

    SHA512

    a4671a2e37afbd4278c1e4429381c5ee9fbcedbb0d989290c36dba3a89ad83543b3750165f4dc69790063823bac83aa5924f2e2815c9ad63bfb76efd1c3bd5d3