Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    171s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    07/10/2023, 23:44

General

  • Target

    usr/lib/python3.11/site-packages/ansible_collections/amazon/aws/plugins/doc_fragments/__pycache__/aw.pyc

  • Size

    1KB

  • MD5

    c9e519531b5e0b0b177795259aa6751b

  • SHA1

    ae4cb0a03fe4bf17f9be117787326da2b742a255

  • SHA256

    7e6f8d74458c04fe4598017908d8c86b9013a98dcaf48e66984db076fa12ff03

  • SHA512

    96de9fe2548357477683d33e977b4635342f029993365b6e10a2fcf2d29607f430f78d608a0a8e7af6cf5abdfc49cc27b52b13ad03958948f02065867ef43cb3

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\__pycache__\aw.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\__pycache__\aw.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2572
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\__pycache__\aw.pyc"
        3⤵
        • Suspicious use of SetWindowsHookEx
        PID:2452

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    b188910e17692b2505b8ac3604f0d030

    SHA1

    880ab84d0902daf430c395225d20e40f6eace7bc

    SHA256

    ce8a9945f7ac497733c7e141e72d07d8d45058107f33d085bad7310dfb1f3606

    SHA512

    83276884435a25f65a3b75a16ab2db36c48942cd6fb339b6ebd5c1180af5488fa722ddb6f1cb3fec5171db010bf1a7d12fda6f706b7097cf38ebd45605fbd4c3