Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
12/01/2024, 20:36
240112-zdjqkaehem 112/01/2024, 19:25
240112-x5akvsegb5 112/01/2024, 17:37
240112-v7njdsdca3 112/01/2024, 17:33
240112-v481xsdbc6 1Analysis
-
max time kernel
18s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/01/2024, 17:33
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://constancia-rfc.info
Resource
win7-20231215-en
windows7-x64
6 signatures
600 seconds
General
-
Target
http://constancia-rfc.info
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2512 chrome.exe 2512 chrome.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2512 wrote to memory of 1552 2512 chrome.exe 28 PID 2512 wrote to memory of 1552 2512 chrome.exe 28 PID 2512 wrote to memory of 1552 2512 chrome.exe 28 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2752 2512 chrome.exe 30 PID 2512 wrote to memory of 2620 2512 chrome.exe 31 PID 2512 wrote to memory of 2620 2512 chrome.exe 31 PID 2512 wrote to memory of 2620 2512 chrome.exe 31 PID 2512 wrote to memory of 2180 2512 chrome.exe 32 PID 2512 wrote to memory of 2180 2512 chrome.exe 32 PID 2512 wrote to memory of 2180 2512 chrome.exe 32 PID 2512 wrote to memory of 2180 2512 chrome.exe 32 PID 2512 wrote to memory of 2180 2512 chrome.exe 32 PID 2512 wrote to memory of 2180 2512 chrome.exe 32 PID 2512 wrote to memory of 2180 2512 chrome.exe 32 PID 2512 wrote to memory of 2180 2512 chrome.exe 32 PID 2512 wrote to memory of 2180 2512 chrome.exe 32 PID 2512 wrote to memory of 2180 2512 chrome.exe 32 PID 2512 wrote to memory of 2180 2512 chrome.exe 32 PID 2512 wrote to memory of 2180 2512 chrome.exe 32 PID 2512 wrote to memory of 2180 2512 chrome.exe 32 PID 2512 wrote to memory of 2180 2512 chrome.exe 32 PID 2512 wrote to memory of 2180 2512 chrome.exe 32 PID 2512 wrote to memory of 2180 2512 chrome.exe 32 PID 2512 wrote to memory of 2180 2512 chrome.exe 32 PID 2512 wrote to memory of 2180 2512 chrome.exe 32 PID 2512 wrote to memory of 2180 2512 chrome.exe 32
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://constancia-rfc.info1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7429758,0x7fef7429768,0x7fef74297782⤵PID:1552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1120 --field-trial-handle=1308,i,17961741561174952057,13070661380593364559,131072 /prefetch:22⤵PID:2752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1308,i,17961741561174952057,13070661380593364559,131072 /prefetch:82⤵PID:2620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1592 --field-trial-handle=1308,i,17961741561174952057,13070661380593364559,131072 /prefetch:82⤵PID:2180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2296 --field-trial-handle=1308,i,17961741561174952057,13070661380593364559,131072 /prefetch:12⤵PID:1988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2308 --field-trial-handle=1308,i,17961741561174952057,13070661380593364559,131072 /prefetch:12⤵PID:2984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1580 --field-trial-handle=1308,i,17961741561174952057,13070661380593364559,131072 /prefetch:22⤵PID:1372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3068 --field-trial-handle=1308,i,17961741561174952057,13070661380593364559,131072 /prefetch:82⤵PID:2480
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114KB
MD5c976ad6637a4bf5a845b128f3764e801
SHA195c236302cf34d73806b22fcfc0b36ceff84848f
SHA256157b27e3c317843158ee9b14d8e59638cc62d3a347f6ae0852615ed3341d8072
SHA512c3b85135fd54434fb69dc3fc35685cced22638cc168743fd836f380045ecb7e0b867ddaad530020b8c733ed0fc36159b9f0a1eba2c5726dc340364ab7178f85c
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
5KB
MD58d93e809b2cd61bd08dd8455c1ee6a63
SHA1837a553b0d5ec0024839f5bce9ae342a3993e9ed
SHA25632b32c7ef47b45cac971232b0dc96a9d43ab11efbff8f9cc710fa2aef055cae2
SHA512d67766a2dc7b3eda48ce3a4325c74a1a0c1d58e1bfcf1fc5b5eb2aa90acd0ca423f453bbc61427c633cf2ad4a08c81c4c5a8f45b475f39ccba07806b8ce29c0a
-
Filesize
4KB
MD5846934db0f56c5c8fac9a06a4d6c4798
SHA1fb42e5e48e6b3f9ba5093be408763120e8cf12e0
SHA25655b4a54cc5b980e9e80cf01e81774f4ffafa3760bb8f2918a2d770fddcc93529
SHA51216eedfede8ce1095ddbe3e609a94ecc142183d05f64b2f076f7fc4cf65e1beac2fec945bdd37a34b1d1aecfb4618ad6b598c5edd1b203d2fc0fcb90587826620
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
114KB
MD5bdafcc02b37ba26f6db036603f71de95
SHA16b0392aab3f71b6560c442521b293d76405bebaa
SHA25668493f1fd9b0e5be764f6c89a0ec12cc5bd86fc38a309489b09f41d169e30c52
SHA512f5f792f5ff305fc67d5f3cd618b4e4248c67bd854c203e63f506e222c00e0fd350ebd6ecbd07ff5f73f2646c5e71bd92725dfccd7e43d236f6aab4d9de932d51