Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    169s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    07/10/2023, 23:44

General

  • Target

    usr/lib/python3.11/site-packages/ansible_collections/amazon/aws/plugins/doc_fragments/__pycache__/boto3.cpython-311.pyc

  • Size

    718B

  • MD5

    447305548bcff1fc92d3c832cc2840c9

  • SHA1

    6316ae7b47b6d4598c542a9c12e09e8c52b12faf

  • SHA256

    df45ce1a1752b3b5bef32886367a19dd43a8dd6a16357280116bdc9d57dc464e

  • SHA512

    ef0242be6c5492b1df2e46d2259ec4291f2dc9ae9cffa320ac6c497a10141307349cd37cdebc52b3f87603502e7c6fd400f0fddd3f5fcbb1c2d7c9aa12392987

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\__pycache__\boto3.cpython-311.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2608
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\__pycache__\boto3.cpython-311.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2724
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\__pycache__\boto3.cpython-311.pyc"
        3⤵
        • Suspicious use of SetWindowsHookEx
        PID:3044

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    07878785c9cc4215cd1f9a87e9d53bc3

    SHA1

    f99a94a2d4fef8d11d00b9e9679a446d785ddf58

    SHA256

    f29b9087d8035d06a256edcef8da8f2108477260acb591e1c7b78a7b1b63a083

    SHA512

    d08fa6f5b33f2aeb6408118f826a4e2e2beb54d784028edf5472f9158c948c2913ff3f29493686abedecd299e39f1f589d567d07429eb55166f7b4a5d7c918bd