Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

4

Static

static

1

.SIGN.RSA....sa.pub

windows7-x64

4

.SIGN.RSA....sa.pub

windows10-2004-x64

3

usr/lib/py...11.pyc

windows7-x64

3

usr/lib/py...11.pyc

windows10-2004-x64

3

usr/lib/py...11.pyc

windows7-x64

3

usr/lib/py...11.pyc

windows10-2004-x64

3

usr/lib/py...11.pyc

windows7-x64

3

usr/lib/py...11.pyc

windows10-2004-x64

3

usr/lib/py...es.pyc

windows7-x64

3

usr/lib/py...es.pyc

windows10-2004-x64

3

usr/lib/py...11.pyc

windows7-x64

3

usr/lib/py...11.pyc

windows10-2004-x64

usr/lib/py...aw.pyc

windows7-x64

3

usr/lib/py...aw.pyc

windows10-2004-x64

3

usr/lib/py...11.pyc

windows7-x64

3

usr/lib/py...11.pyc

windows10-2004-x64

3

usr/lib/py...11.pyc

windows7-x64

3

usr/lib/py...11.pyc

windows10-2004-x64

usr/lib/py...11.pyc

windows7-x64

3

usr/lib/py...11.pyc

windows10-2004-x64

usr/lib/py...11.pyc

windows7-x64

3

usr/lib/py...11.pyc

windows10-2004-x64

3

usr/lib/py...11.pyc

windows7-x64

3

usr/lib/py...11.pyc

windows10-2004-x64

3

usr/lib/py...11.pyc

windows7-x64

3

usr/lib/py...11.pyc

windows10-2004-x64

3

usr/lib/py...11.pyc

windows7-x64

3

usr/lib/py...11.pyc

windows10-2004-x64

3

usr/lib/py...11.pyc

windows7-x64

3

usr/lib/py...11.pyc

windows10-2004-x64

3

usr/lib/py...11.pyc

windows7-x64

3

usr/lib/py...11.pyc

windows10-2004-x64

3

Analysis

  • max time kernel
    30s
  • max time network
    440s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/10/2023, 23:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    usr/lib/python3.11/site-packages/ansible_collections/amazon/aws/plugins/doc_fragments/__pycache__/tags.cpython-311.pyc

  • Size

    2KB

  • MD5

    a5124e9f6c7f571ee053f75881d8c6b4

  • SHA1

    4377116394990884d4728184a7748613bca7ac4b

  • SHA256

    c36216a4932f8b377d42e02a3b3af67282b1c70ec002abf4b3296a46a25ff8eb

  • SHA512

    c3e477456ed9a883fc456fe933a300e18acf29f802c2046c19de3467d78cc7183487a2bcd0788830f218ca5f81c5fef69fe7dd2d59457384e1b02b15c1808cf7

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\__pycache__\tags.cpython-311.pyc
    1⤵
    • Modifies registry class
    PID:1956
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads