Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
12/01/2024, 20:36
240112-zdjqkaehem 112/01/2024, 19:25
240112-x5akvsegb5 112/01/2024, 17:37
240112-v7njdsdca3 112/01/2024, 17:33
240112-v481xsdbc6 1Analysis
-
max time kernel
179s -
max time network
621s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/01/2024, 19:25
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://constancia-rfc.info
Resource
win7-20231215-en
windows7-x64
6 signatures
600 seconds
Behavioral task
behavioral2
Sample
http://constancia-rfc.info
Resource
win10-20231215-en
windows10-1703-x64
8 signatures
600 seconds
General
-
Target
http://constancia-rfc.info
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1752 wrote to memory of 2668 1752 chrome.exe 28 PID 1752 wrote to memory of 2668 1752 chrome.exe 28 PID 1752 wrote to memory of 2668 1752 chrome.exe 28 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2780 1752 chrome.exe 30 PID 1752 wrote to memory of 2756 1752 chrome.exe 31 PID 1752 wrote to memory of 2756 1752 chrome.exe 31 PID 1752 wrote to memory of 2756 1752 chrome.exe 31 PID 1752 wrote to memory of 3060 1752 chrome.exe 32 PID 1752 wrote to memory of 3060 1752 chrome.exe 32 PID 1752 wrote to memory of 3060 1752 chrome.exe 32 PID 1752 wrote to memory of 3060 1752 chrome.exe 32 PID 1752 wrote to memory of 3060 1752 chrome.exe 32 PID 1752 wrote to memory of 3060 1752 chrome.exe 32 PID 1752 wrote to memory of 3060 1752 chrome.exe 32 PID 1752 wrote to memory of 3060 1752 chrome.exe 32 PID 1752 wrote to memory of 3060 1752 chrome.exe 32 PID 1752 wrote to memory of 3060 1752 chrome.exe 32 PID 1752 wrote to memory of 3060 1752 chrome.exe 32 PID 1752 wrote to memory of 3060 1752 chrome.exe 32 PID 1752 wrote to memory of 3060 1752 chrome.exe 32 PID 1752 wrote to memory of 3060 1752 chrome.exe 32 PID 1752 wrote to memory of 3060 1752 chrome.exe 32 PID 1752 wrote to memory of 3060 1752 chrome.exe 32 PID 1752 wrote to memory of 3060 1752 chrome.exe 32 PID 1752 wrote to memory of 3060 1752 chrome.exe 32 PID 1752 wrote to memory of 3060 1752 chrome.exe 32
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://constancia-rfc.info1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef74a9758,0x7fef74a9768,0x7fef74a97782⤵PID:2668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1236,i,4255135598790667788,17534835029689397747,131072 /prefetch:22⤵PID:2780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1236,i,4255135598790667788,17534835029689397747,131072 /prefetch:82⤵PID:2756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1236,i,4255135598790667788,17534835029689397747,131072 /prefetch:82⤵PID:3060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2272 --field-trial-handle=1236,i,4255135598790667788,17534835029689397747,131072 /prefetch:12⤵PID:1580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2264 --field-trial-handle=1236,i,4255135598790667788,17534835029689397747,131072 /prefetch:12⤵PID:2564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1228 --field-trial-handle=1236,i,4255135598790667788,17534835029689397747,131072 /prefetch:22⤵PID:2324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3068 --field-trial-handle=1236,i,4255135598790667788,17534835029689397747,131072 /prefetch:82⤵PID:2480
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
1KB
MD5749e87069f286af5ddd9357818185ef3
SHA1c0e0dc6abf9e6b8e23c623e89d5f7d8981d4069a
SHA256e0da4258994cfc4c68c4de94a65d4d5f94d52053e965d3f652be54a55087bdae
SHA51269ae511990c26ea0875ff440007e7765e90c987fac1eca1db4bcb0744ac0f2733b33d83cce8f27eebf64945b71fab462372729a879910b1e52fd4877c59f96e6
-
Filesize
5KB
MD59e01bfe564132253e5fb7bcfa44329a8
SHA14362405c045a066fa4aa6b2570aba847ef15f428
SHA256d9845abec8f3d51fc9e5803a10b2cdfaa0270a28492cbe65dd2a78f85ac81ed5
SHA512fa5a0060dd6cacc62134801a3926af74b0c08df71b16bbbc90b0442cd1886518f91907742445ca6354833a9b348e1f299889c4bd9caf1b254f8a43641c159267
-
Filesize
5KB
MD574bb9fafb0ac6c4bc1474c61fe1aa34e
SHA1ab66619994be6304fe9892fe844acce2f6d7a03a
SHA256790a5fc8790f6cdb83642e0ff988c144f12571d3b576e8777b397b5d91b9a787
SHA51249738947fcd1a234e846fc5e22f15ecf8442e4490fbd4199b35a5533ea1df6a4fda42a3554733f5e3ca5bb04732500d353984858c15f506f04b53991edeac60e
-
Filesize
4KB
MD5bec60807d4e5418633b65b33f8d6bafd
SHA157d118c70f2fb2a042ee552230cb728af477b57e
SHA25662efc0da81ad4deb3e128ae74c68c9abf617014d4e8a9fe907d28ba8ac6767c0
SHA512bff6e2cd3f42f040e59916f3244178e488cbfaae59d1599c138a46533656b574dd30a2894de1bc34e667d4034e2b3065027f856fa95fdb802b00d0ded12501ab
-
Filesize
5KB
MD54203bf53fb6766091adcf6b0eed28168
SHA1c8b72ccb0683fb022b19deff75f3288b19f22cfb
SHA25680275d76d113ca41b615ee107bbd9c406e9673ed6afd8d2f83e60908df93a427
SHA5129d434cebf39383e5f283cfdb6a1cb949c02981f26b7bf741858c84ab4e503fa25e2b5885451aa25661fb3baf3951d01536742417c0a210a13fbb3a6c03d1b0f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2