Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
858s -
max time network
856s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 12:52
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://inversionesequicol.com.co
Resource
win7-20231215-en
windows7-x64
6 signatures
1200 seconds
Behavioral task
behavioral2
Sample
http://inversionesequicol.com.co
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
1200 seconds
General
-
Target
http://inversionesequicol.com.co
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133477232403128091" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4664 chrome.exe 4664 chrome.exe 3924 chrome.exe 3924 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4664 wrote to memory of 3932 4664 chrome.exe 87 PID 4664 wrote to memory of 3932 4664 chrome.exe 87 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 2376 4664 chrome.exe 89 PID 4664 wrote to memory of 4416 4664 chrome.exe 91 PID 4664 wrote to memory of 4416 4664 chrome.exe 91 PID 4664 wrote to memory of 1148 4664 chrome.exe 90 PID 4664 wrote to memory of 1148 4664 chrome.exe 90 PID 4664 wrote to memory of 1148 4664 chrome.exe 90 PID 4664 wrote to memory of 1148 4664 chrome.exe 90 PID 4664 wrote to memory of 1148 4664 chrome.exe 90 PID 4664 wrote to memory of 1148 4664 chrome.exe 90 PID 4664 wrote to memory of 1148 4664 chrome.exe 90 PID 4664 wrote to memory of 1148 4664 chrome.exe 90 PID 4664 wrote to memory of 1148 4664 chrome.exe 90 PID 4664 wrote to memory of 1148 4664 chrome.exe 90 PID 4664 wrote to memory of 1148 4664 chrome.exe 90 PID 4664 wrote to memory of 1148 4664 chrome.exe 90 PID 4664 wrote to memory of 1148 4664 chrome.exe 90 PID 4664 wrote to memory of 1148 4664 chrome.exe 90 PID 4664 wrote to memory of 1148 4664 chrome.exe 90 PID 4664 wrote to memory of 1148 4664 chrome.exe 90 PID 4664 wrote to memory of 1148 4664 chrome.exe 90 PID 4664 wrote to memory of 1148 4664 chrome.exe 90 PID 4664 wrote to memory of 1148 4664 chrome.exe 90 PID 4664 wrote to memory of 1148 4664 chrome.exe 90 PID 4664 wrote to memory of 1148 4664 chrome.exe 90 PID 4664 wrote to memory of 1148 4664 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://inversionesequicol.com.co1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x108,0x10c,0x110,0xd8,0xdc,0x7ff9a7609758,0x7ff9a7609768,0x7ff9a76097782⤵PID:3932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1572 --field-trial-handle=1824,i,11498628223223282031,5505707501207033763,131072 /prefetch:22⤵PID:2376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1824,i,11498628223223282031,5505707501207033763,131072 /prefetch:82⤵PID:1148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1824,i,11498628223223282031,5505707501207033763,131072 /prefetch:82⤵PID:4416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1824,i,11498628223223282031,5505707501207033763,131072 /prefetch:12⤵PID:3788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1824,i,11498628223223282031,5505707501207033763,131072 /prefetch:12⤵PID:3540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1824,i,11498628223223282031,5505707501207033763,131072 /prefetch:82⤵PID:2204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3908 --field-trial-handle=1824,i,11498628223223282031,5505707501207033763,131072 /prefetch:82⤵PID:1564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4720 --field-trial-handle=1824,i,11498628223223282031,5505707501207033763,131072 /prefetch:12⤵PID:3980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3764 --field-trial-handle=1824,i,11498628223223282031,5505707501207033763,131072 /prefetch:12⤵PID:8
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4020 --field-trial-handle=1824,i,11498628223223282031,5505707501207033763,131072 /prefetch:12⤵PID:1332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=212 --field-trial-handle=1824,i,11498628223223282031,5505707501207033763,131072 /prefetch:12⤵PID:548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4748 --field-trial-handle=1824,i,11498628223223282031,5505707501207033763,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3740 --field-trial-handle=1824,i,11498628223223282031,5505707501207033763,131072 /prefetch:12⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5004 --field-trial-handle=1824,i,11498628223223282031,5505707501207033763,131072 /prefetch:12⤵PID:1240
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD510416cfa9ea443cafd5c7e6fa4bfc4f0
SHA167002c725199133ecd329fa068ede2f4a256182b
SHA2563aeec2213d79f389f697f47b25b6db9e4f67781669a2532245448f4cedaa3276
SHA51290aa1f086d1d09ed598e57bb3a4fdfc5932f02ee11fbbd4bbfb0f35b7052b45c936be459eef384eebe59ebd68f20bf7720b96fc97063f162579676a033dcff1f
-
Filesize
6KB
MD56309b3358ebe09bc852e58b1741392b4
SHA1ef759e973465b7955d001e598a2eff4328ea60aa
SHA2560c5b298b34be0063100e444fa64b856c522d960b59b2a942f174f31f360c93ff
SHA5125102780841109ca5148dd72b5ad9484a5a738cddd7263fc02fb7817d1fef08e3b388799c07159e323ddc96c63b839b44c4ac5440d73f90b37f02cf1f96039407
-
Filesize
114KB
MD51a668250c12250b7d41a54e0ef6bcb8a
SHA1539c2c0bf98922d28a3a61a4ff6fec394cba1780
SHA256a67f287cb3b30bedf275c3f662a202ec94b4c322b3093f7e960a2db9aaf10983
SHA512f18ec19409e89b9d45e503d65c6cd71e48983dc56a777427556c6b795795bed0b8fb9564cb7798a4478d6064d1f580113628892ba22713d96c9e69a92b7761bd
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd