Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1auto-py-to...tar.gz
windows7-x64
3auto-py-to...tar.gz
windows10-2004-x64
3auto-py-to....1.tar
windows7-x64
3auto-py-to....1.tar
windows10-2004-x64
3auto-py-to...ICENSE
windows7-x64
1auto-py-to...ICENSE
windows10-2004-x64
1auto-py-to...EST.in
windows7-x64
3auto-py-to...EST.in
windows10-2004-x64
3auto-py-to...G-INFO
windows7-x64
1auto-py-to...G-INFO
windows10-2004-x64
1auto-py-to...DME.md
windows7-x64
3auto-py-to...DME.md
windows10-2004-x64
3auto-py-to...G-INFO
windows7-x64
1auto-py-to...G-INFO
windows10-2004-x64
1auto-py-to...ES.txt
windows7-x64
1auto-py-to...ES.txt
windows10-2004-x64
1auto-py-to...ks.txt
windows7-x64
1auto-py-to...ks.txt
windows10-2004-x64
1auto-py-to...ts.txt
windows7-x64
1auto-py-to...ts.txt
windows10-2004-x64
1auto-py-to...t__.py
windows7-x64
3auto-py-to...t__.py
windows10-2004-x64
3auto-py-to...n__.py
windows7-x64
3auto-py-to...n__.py
windows10-2004-x64
3auto-py-to...fig.py
windows7-x64
3auto-py-to...fig.py
windows10-2004-x64
3auto-py-to...ogs.py
windows7-x64
3auto-py-to...ogs.py
windows10-2004-x64
3auto-py-to...ing.py
windows7-x64
3auto-py-to...ing.py
windows10-2004-x64
3auto-py-to...ims.py
windows7-x64
3auto-py-to...ims.py
windows10-2004-x64
3Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
18/07/2024, 23:19
Static task
static1
Behavioral task
behavioral1
Sample
auto-py-to-exe-2.44.1.tar.gz
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
auto-py-to-exe-2.44.1.tar.gz
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
auto-py-to-exe-2.44.1.tar
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral4
Sample
auto-py-to-exe-2.44.1.tar
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
auto-py-to-exe-2.44.1/LICENSE
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral6
Sample
auto-py-to-exe-2.44.1/LICENSE
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
auto-py-to-exe-2.44.1/MANIFEST.in
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral8
Sample
auto-py-to-exe-2.44.1/MANIFEST.in
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
auto-py-to-exe-2.44.1/PKG-INFO
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral10
Sample
auto-py-to-exe-2.44.1/PKG-INFO
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
auto-py-to-exe-2.44.1/README.md
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral12
Sample
auto-py-to-exe-2.44.1/README.md
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
auto-py-to-exe-2.44.1/auto_py_to_exe.egg-info/PKG-INFO
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral14
Sample
auto-py-to-exe-2.44.1/auto_py_to_exe.egg-info/PKG-INFO
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
auto-py-to-exe-2.44.1/auto_py_to_exe.egg-info/SOURCES.txt
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral16
Sample
auto-py-to-exe-2.44.1/auto_py_to_exe.egg-info/SOURCES.txt
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
auto-py-to-exe-2.44.1/auto_py_to_exe.egg-info/dependency_links.txt
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral18
Sample
auto-py-to-exe-2.44.1/auto_py_to_exe.egg-info/dependency_links.txt
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
auto-py-to-exe-2.44.1/auto_py_to_exe.egg-info/entry_points.txt
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral20
Sample
auto-py-to-exe-2.44.1/auto_py_to_exe.egg-info/entry_points.txt
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
auto-py-to-exe-2.44.1/auto_py_to_exe/__init__.py
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral22
Sample
auto-py-to-exe-2.44.1/auto_py_to_exe/__init__.py
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
auto-py-to-exe-2.44.1/auto_py_to_exe/__main__.py
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral24
Sample
auto-py-to-exe-2.44.1/auto_py_to_exe/__main__.py
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
auto-py-to-exe-2.44.1/auto_py_to_exe/config.py
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral26
Sample
auto-py-to-exe-2.44.1/auto_py_to_exe/config.py
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
auto-py-to-exe-2.44.1/auto_py_to_exe/dialogs.py
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral28
Sample
auto-py-to-exe-2.44.1/auto_py_to_exe/dialogs.py
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
auto-py-to-exe-2.44.1/auto_py_to_exe/packaging.py
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral30
Sample
auto-py-to-exe-2.44.1/auto_py_to_exe/packaging.py
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
auto-py-to-exe-2.44.1/auto_py_to_exe/shims.py
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral32
Sample
auto-py-to-exe-2.44.1/auto_py_to_exe/shims.py
Resource
win10v2004-20240709-en
windows10-2004-x64
General
-
Target
auto-py-to-exe-2.44.1.tar.gz
-
Size
183KB
-
MD5
64447fa80ca29e9e1a5b151e32ade01d
-
SHA1
d58a8b3c80a98ebd13d1228dc7988606119197a2
-
SHA256
73c8170cc05b69721269b77d161be6e2bf2a544a6422fcb9a4bf615376e4bb83
-
SHA512
3110c4dfb63f81e8002bf54c4a609a4ca2f42f188e288df9b753f5ff50cb4dfed989f1f3e089810ce30a46ae81fef552b37d5563fc0033d09c70dec3911757ea
-
SSDEEP
3072:SjRxF5aAQrb4LAmmK67nRjYtKEkqwhNAAJSpnlM/LkLXHvPPsGy8qRDaGXFjC:SjjfaAQrb4LIKKnRjYtKKwZt/cH/slRO
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1472 rundll32.exe 2756 rundll32.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe 1472 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1900 wrote to memory of 1472 1900 cmd.exe 32 PID 1900 wrote to memory of 1472 1900 cmd.exe 32 PID 1900 wrote to memory of 1472 1900 cmd.exe 32 PID 1472 wrote to memory of 2756 1472 rundll32.exe 33 PID 1472 wrote to memory of 2756 1472 rundll32.exe 33 PID 1472 wrote to memory of 2756 1472 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\auto-py-to-exe-2.44.1.tar.gz1⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\auto-py-to-exe-2.44.1.tar.gz2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\auto-py-to-exe-2.44.1.tar.gz3⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2756
-
-