Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
100s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
04/05/2023, 14:31
Static task
static1
Behavioral task
behavioral1
Sample
Sign Contract Waiver a.turca967.html
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Sign Contract Waiver a.turca967.html
Resource
win10v2004-20230220-en
General
-
Target
Sign Contract Waiver a.turca967.html
-
Size
763KB
-
MD5
ebd82c3c202ad2aa2c19ae3200b19afa
-
SHA1
c18d16e9624b56dc37ea108394a02492a4aa752d
-
SHA256
9ebc4b07cc398d1621173142152477d0f388041a83348f985ce9ac537b693c19
-
SHA512
f55aa87f81c8a11bf081fc6a62c74d17f9d8cc66dd63a4e4b972ab25df7bee8cf5060e905776d6678d4be4d603c183c6a4dc49cfc4d7cbd132b3b8bb76ca4d98
-
SSDEEP
12288:TYrvVEkV9lAnCuQTUXUbD5AIeZ71trPoq5UGcOOwn1TGzsf:TYrvVEkVGCuQOUbFAPZRorEasf
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{30ACF2D1-EA99-11ED-A056-C29C0423A1DF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "389982894" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 406fb30ba67ed901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074b2d77a8e7a944ea7c282b9066208cc00000000020000000000106600000001000020000000f3ec0fe6f932c48053230680f9e028e6b8128b9da48a82341241f89b275f04bc000000000e8000000002000020000000193bae53fbb30eb44dd880777161af615db1bb86d07e77368edbeb173c98e80f20000000a895fe798b70ae75dbe72643dfc581f55cc3ae53bb516a615c04e27dbbdae2124000000013ff64c63770da7a52288787c8aa583a721e38c2f6b9e84f20969095751faea4cf29f05ec729f78eee3ce2a156c5ff1d0a7a974913193b5ff37b2f93da67a4db iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074b2d77a8e7a944ea7c282b9066208cc00000000020000000000106600000001000020000000410c5030a4a2235af8973cf4c67149c15e718c9bc34e111e91e5af43b83accd8000000000e8000000002000020000000cedc94ac5e0aa2f04e58023008a45e4d7f6bd8524890d5e9184d1f26759491a390000000aeea54741cc955be143e17706e6876a9fad7fb47c271c72841cbe86d473c91de9365858176afb610256a141c3c6499e8ea25849d96c12af4e4747263eba52d36710de873d28980263691c25fa7ea5ffe7319a3972135ab812d19711d33679fa572ade92e3e893655b4fb8d36138cad5857450f0083cb3dde32d2d91c25f5e009beb2c56d2a6df6ff54da98e789b41cbc40000000d9136e064ada1bc034eb90af4010a03c256e6d0b4bfdf3449f1a0f13e67fc496d8abfe2d2f111d8dee5e3ae774529b7489b9731282261cea3deccfb568066dba iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1740 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1740 iexplore.exe 1740 iexplore.exe 1312 IEXPLORE.EXE 1312 IEXPLORE.EXE 1312 IEXPLORE.EXE 1312 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1740 wrote to memory of 1312 1740 iexplore.exe 29 PID 1740 wrote to memory of 1312 1740 iexplore.exe 29 PID 1740 wrote to memory of 1312 1740 iexplore.exe 29 PID 1740 wrote to memory of 1312 1740 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Sign Contract Waiver a.turca967.html"1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1312
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f98f6ab820c68103d8e3e8cc1279319
SHA11400bae3ece13ce8375bcfb8767d5b8303d4d19f
SHA256438fed6152b090e255d9be75a4cc225682ea1b0db6d07bc1450434e1d6abf984
SHA51213978adcd631580f49fb8d5db7a40b0ec35f7e77afdd1e79a26c83909f70a7a767a3d2761928e8b6ad416e35f1443e216ad5406e271ce753d12d364296c77e3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5059cc829d105d1be5058117632ba4008
SHA13dcc7ebda75d9db4f6bd3dff3ff50f737436ba14
SHA2561d03f6924538da2dc17c8e668534950ab22fc2c1b6d89c2a573e4fd257244877
SHA5122512d8dfa3c47fd58b948978b731ec458ef1810add983032dd38f7669c0e6cf9f5a2f1c4bce0618bf40a92fcea6b955c882cd83400e66950eba74a88efe04890
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a11279f7b4b5105cd457fa9d456f97d
SHA11e7e440a4a5fdeb65e9a23c85a5df883e8967fcf
SHA2569adba930aa0dfa7d302be028e431c3704bf10a2ebe3b9557bf66ae4e8729a462
SHA5122af6e2a3f320e0e6edd9e5600b0667045e30eb82fbc0f67d06a7391945c3e8fbdb98d66190649aa34c54d2dbd785d2431709691373efee39f26b28e894f53bd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508b5d22d30f8c6cc9852233b80a739ed
SHA1c6c11b1d461bf16dac5a22bb12cd687c9da298a9
SHA256deb2257c5961c939c4ac0ac84323115424ec50f7f8be9f57f38c64ca00d1274f
SHA512e71e5737e1b1dda42d05b57e5139dcd327354bf88b04bc879254e3334b6985a6d285f25a5e98cc9ba3d7afe764885e22d176acb43ace848102bf1f7715c6a534
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb5a3c2444190c0d781f699f118f7b43
SHA1a7690c7128476253d01694b1f761ce7060f4081a
SHA256e4754d2ddfe11fae509f1910632350b2e76656438e7543fc94ebc09c3f8f05b2
SHA512bea6854b5264e83dd75524b2848b6de0d416b99d2cc551dcfc39efb990cf4dc9332e4bc2528da0bb42ef8f97048b4d24bc47e2b55ebf5c0c8fe551f2700767d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565f70230138572fb39b5851c22282c6a
SHA19e1cf7700b28de1cc49ebad183d7efc42fb8320f
SHA25627effb227370836cb2378907e41fbb8489060e4ae18b09ea49a47928f3be4d8b
SHA5122106421d327798dd110669629e4e42d7ab3b797f6eb289b52aefde6ee24d1afffa8eff0fdbaab380e8744d28a49cc926236220a1871c7eb8dde84435a550daae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598a505a9bbd3d947c2af6f8b43040153
SHA18bd8c3747f346c1e863b653968417d9b2b6ceb5e
SHA25691beb7f47cf8dfde89f0cb8d0de0fd9a9576b314d2f07068b59ca19f2b7c43ab
SHA512c6613df9e56698bcfcf77315dca4a0d4d89b03268a179d25ccd1c3e2ab78782f44590a5cb29514c83deefc61d89aee672b206df2cb269079633f86c6795b44d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1e1946cbfe0cd8a64eb2649838c86a0
SHA1a75d057aae8f6394442aca852de0b74a2ad1e767
SHA256880c866aa39e04f7ddcd37cac5a4815ee4fd312f9508374ee3e4145c4f7d7099
SHA512ed696380261d9f521955146c64b5a56363d2d7f4c250691aa25993b0d5916576fd2aaac5274eefb10675d171862ce55b3b94af65ee57105ac3ea3687adfc0c67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c43b5ef6698e5ee1a15d88506ee2e860
SHA1f22406609a75c938f0b1a4fe0127ed451fd3834a
SHA2564b2b9e9c84e0632d0cfa676a872d8d784189678eec2a4351ccf26c0c16ffa57a
SHA512690aacefc29830209ba72811c8150766765e9ef5892589875d31484875f20a169e8d777bbaac28915e2dd3712a65e23ee715f7e9e4475f3140c7bdff6f21e368
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5584a55b80e0503283486656a74f417ba
SHA1b7121ec78a33dfa5b8ccc2adeddddfe82f74b7bb
SHA2564412cd8166fb2bed2a0df7e206dedb8c819099235f18aa40322b0f61c74521f7
SHA512e22d32b1c84df6b16b0e6b5ee61f3d6776de8fab6e8ed20c9571da1738d9571f420037f01ea21d7ab193fdde11d3022f4f719a162c5680f117d43027ed5dbcd6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NZTPJYNO\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
603B
MD524984e7f025a6186ca90a33eab192957
SHA15c82c386c626044ea99322b45ff6af9e7c8f7173
SHA25677ae2929abab286c36514b4a13de15e24cfc9ce3f84eb41c184d02ea8934dcd8
SHA51214ceb47c02626643b8ad0262a6b50d4d8a9fdf36c1f669d1bf157e7f250ea526db76592a211ce0b5c4c34e07d3a9cc79da676490d9f0dfe153cdd6a61c4c1be6