Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
6data/pytho...t__.py
windows11-21h2-x64
6data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...nal.py
windows11-21h2-x64
3data/pytho...ing.py
windows11-21h2-x64
3data/pytho...t__.py
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...t__.py
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...hms.py
windows11-21h2-x64
3data/pytho...t__.py
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...ric.py
windows11-21h2-x64
3data/pytho...thm.py
windows11-21h2-x64
3data/pytho...ion.py
windows11-21h2-x64
3data/pytho...t__.py
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3Analysis
-
max time kernel
61s -
max time network
143s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
27/09/2024, 12:58
Behavioral task
behavioral1
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/bindings/openssl/__init__.py
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/bindings/openssl/__pycache__/__init__.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/bindings/openssl/__pycache__/_conditional.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/bindings/openssl/__pycache__/binding.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/bindings/openssl/_conditional.py
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/bindings/openssl/binding.py
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/decrepit/__init__.py
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/decrepit/__pycache__/__init__.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/decrepit/ciphers/__init__.py
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/decrepit/ciphers/__pycache__/__init__.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/decrepit/ciphers/__pycache__/algorithms.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/decrepit/ciphers/algorithms.py
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__init__.py
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/__init__.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/_asymmetric.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral16
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/_cipheralgorithm.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/_serialization.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral18
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/cmac.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral19
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/constant_time.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral20
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/hashes.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral21
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/hmac.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral22
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/keywrap.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral23
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/padding.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral24
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/poly1305.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral25
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/_asymmetric.py
Resource
win11-20240802-en
Behavioral task
behavioral26
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/_cipheralgorithm.py
Resource
win11-20240802-en
Behavioral task
behavioral27
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/_serialization.py
Resource
win11-20240802-en
Behavioral task
behavioral28
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/asymmetric/__init__.py
Resource
win11-20240802-en
Behavioral task
behavioral29
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/asymmetric/__pycache__/__init__.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral30
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/asymmetric/__pycache__/dh.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral31
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/asymmetric/__pycache__/dsa.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral32
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/asymmetric/__pycache__/ec.cpython-312.pyc
Resource
win11-20240802-en
General
-
Target
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/bindings/openssl/_conditional.py
-
Size
5KB
-
MD5
c62f46f15048cdd49270ff103b9ace0a
-
SHA1
8a184fa2613e8cb7eab716cfae5db1937576eb12
-
SHA256
f215bb6a05c14008109b39848fa2b432db9477d7feb3488ef30e081f5f769d16
-
SHA512
a878551b6b6ab990683187d8495b2baa9689c5bfc514ecd00faea56d087934662a9f44bae9b875d5c60a51211354f47dee7ac25bd1a1502251d7d884278e5b1d
-
SSDEEP
96:sJhcE5pEZsDvS9gEGuEodEAdEd8jEedpdUcEliooEEHEJgM3Ea+EJ48tE73En8GQ:s8EnEZsDvqgEHEWEAuIEejDEqEuEJxEz
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4180 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\data\python-3.12.5-embed-amd64\Lib\site-packages\cryptography\hazmat\bindings\openssl\_conditional.py1⤵
- Modifies registry class
PID:4680
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4180