Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3.pythonlib...t__.py
windows7-x64
3.pythonlib...t__.py
windows10-2004-x64
3.pythonlib...10.pyc
windows7-x64
3.pythonlib...10.pyc
windows10-2004-x64
3.pythonlib...10.pyc
windows7-x64
3.pythonlib...10.pyc
windows10-2004-x64
3.pythonlib...10.pyc
windows7-x64
3.pythonlib...10.pyc
windows10-2004-x64
3.pythonlib...10.pyc
windows7-x64
3.pythonlib...10.pyc
windows10-2004-x64
3.pythonlib...10.pyc
windows7-x64
3.pythonlib...10.pyc
windows10-2004-x64
3.pythonlib...10.pyc
windows7-x64
3.pythonlib...10.pyc
windows10-2004-x64
3.pythonlib...10.pyc
windows7-x64
3.pythonlib...10.pyc
windows10-2004-x64
3.pythonlib...10.pyc
windows7-x64
3.pythonlib...10.pyc
windows10-2004-x64
3.pythonlib...10.pyc
windows7-x64
3.pythonlib...10.pyc
windows10-2004-x64
3.pythonlib...10.pyc
windows7-x64
3.pythonlib...10.pyc
windows10-2004-x64
3.pythonlib...10.pyc
windows7-x64
3.pythonlib...10.pyc
windows10-2004-x64
3.pythonlib...10.pyc
windows7-x64
3.pythonlib...10.pyc
windows10-2004-x64
3.pythonlib...10.pyc
windows7-x64
3.pythonlib...10.pyc
windows10-2004-x64
3.pythonlib...10.pyc
windows7-x64
3.pythonlib...10.pyc
windows10-2004-x64
3.pythonlib...10.pyc
windows7-x64
3.pythonlib...10.pyc
windows10-2004-x64
3Analysis
-
max time kernel
102s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
20/07/2024, 21:27
Static task
static1
Behavioral task
behavioral1
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__init__.py
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__init__.py
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/__init__.cpython-310.pyc
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/__init__.cpython-310.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/abc.cpython-310.pyc
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/abc.cpython-310.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/base_protocol.cpython-310.pyc
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/base_protocol.cpython-310.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/client.cpython-310.pyc
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/client.cpython-310.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/client_exceptions.cpython-310.pyc
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/client_exceptions.cpython-310.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/client_proto.cpython-310.pyc
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/client_proto.cpython-310.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/client_reqrep.cpython-310.pyc
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/client_reqrep.cpython-310.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/client_ws.cpython-310.pyc
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/client_ws.cpython-310.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/compression_utils.cpython-310.pyc
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/compression_utils.cpython-310.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/connector.cpython-310.pyc
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/connector.cpython-310.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/cookiejar.cpython-310.pyc
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/cookiejar.cpython-310.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/formdata.cpython-310.pyc
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/formdata.cpython-310.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/hdrs.cpython-310.pyc
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/hdrs.cpython-310.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/helpers.cpython-310.pyc
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/helpers.cpython-310.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/http.cpython-310.pyc
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/http.cpython-310.pyc
Resource
win10v2004-20240709-en
General
-
Target
.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/base_protocol.cpython-310.pyc
-
Size
2KB
-
MD5
38bfeb17821a717ab6c8ff71ab29cb25
-
SHA1
c6fcfe4e61713655c59aa2962b80a17359ba78bc
-
SHA256
02ef503a660cf8063a73a6517bc9fe9d7efdf8825e0d99d20f9d59eec45fe035
-
SHA512
532676af182e14dc1b48db9ba45fc2cfea93040c1cf056f6dc2d3c40161e3c23f95af34b573abef364e6ca70a7b10067890ad2dac7311b7815451c9d7ba63bc6
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.pyc rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2748 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2748 AcroRd32.exe 2748 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2200 2508 cmd.exe 30 PID 2508 wrote to memory of 2200 2508 cmd.exe 30 PID 2508 wrote to memory of 2200 2508 cmd.exe 30 PID 2200 wrote to memory of 2748 2200 rundll32.exe 31 PID 2200 wrote to memory of 2748 2200 rundll32.exe 31 PID 2200 wrote to memory of 2748 2200 rundll32.exe 31 PID 2200 wrote to memory of 2748 2200 rundll32.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\.pythonlibs\lib\python3.10\site-packages\aiohttp\__pycache__\base_protocol.cpython-310.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\.pythonlibs\lib\python3.10\site-packages\aiohttp\__pycache__\base_protocol.cpython-310.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\.pythonlibs\lib\python3.10\site-packages\aiohttp\__pycache__\base_protocol.cpython-310.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2748
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD56bfba386ec74d5874246a471fb52d832
SHA1f19df70cbdfb7f10358e9e5846729fb6cf0372a3
SHA256cff6530348a48b2297be99cdb39ee4cdfe39c4cd7ba64ec261c96691e786b8fa
SHA5126bce2eb600e2d8312d9316f40930ff8e62a262a548590efe2dffc3a6dd7c35f7ad9d938a7b94e9b227972cb65035b9432a63ea6cdd4acf744560125a1adcfed1