Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
61s -
max time network
64s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03/04/2023, 19:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://bit.ly/TAPSCAN
Resource
win10v2004-20230220-en
General
-
Target
http://bit.ly/TAPSCAN
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133250299390976064" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4796 chrome.exe 4796 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4796 wrote to memory of 4456 4796 chrome.exe 84 PID 4796 wrote to memory of 4456 4796 chrome.exe 84 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 548 4796 chrome.exe 85 PID 4796 wrote to memory of 4804 4796 chrome.exe 86 PID 4796 wrote to memory of 4804 4796 chrome.exe 86 PID 4796 wrote to memory of 1604 4796 chrome.exe 87 PID 4796 wrote to memory of 1604 4796 chrome.exe 87 PID 4796 wrote to memory of 1604 4796 chrome.exe 87 PID 4796 wrote to memory of 1604 4796 chrome.exe 87 PID 4796 wrote to memory of 1604 4796 chrome.exe 87 PID 4796 wrote to memory of 1604 4796 chrome.exe 87 PID 4796 wrote to memory of 1604 4796 chrome.exe 87 PID 4796 wrote to memory of 1604 4796 chrome.exe 87 PID 4796 wrote to memory of 1604 4796 chrome.exe 87 PID 4796 wrote to memory of 1604 4796 chrome.exe 87 PID 4796 wrote to memory of 1604 4796 chrome.exe 87 PID 4796 wrote to memory of 1604 4796 chrome.exe 87 PID 4796 wrote to memory of 1604 4796 chrome.exe 87 PID 4796 wrote to memory of 1604 4796 chrome.exe 87 PID 4796 wrote to memory of 1604 4796 chrome.exe 87 PID 4796 wrote to memory of 1604 4796 chrome.exe 87 PID 4796 wrote to memory of 1604 4796 chrome.exe 87 PID 4796 wrote to memory of 1604 4796 chrome.exe 87 PID 4796 wrote to memory of 1604 4796 chrome.exe 87 PID 4796 wrote to memory of 1604 4796 chrome.exe 87 PID 4796 wrote to memory of 1604 4796 chrome.exe 87 PID 4796 wrote to memory of 1604 4796 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://bit.ly/TAPSCAN1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffa29aa9758,0x7ffa29aa9768,0x7ffa29aa97782⤵PID:4456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1788,i,2425771588916071323,3151573598969521591,131072 /prefetch:22⤵PID:548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1788,i,2425771588916071323,3151573598969521591,131072 /prefetch:82⤵PID:4804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1788,i,2425771588916071323,3151573598969521591,131072 /prefetch:82⤵PID:1604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3124 --field-trial-handle=1788,i,2425771588916071323,3151573598969521591,131072 /prefetch:12⤵PID:3752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3132 --field-trial-handle=1788,i,2425771588916071323,3151573598969521591,131072 /prefetch:12⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1788,i,2425771588916071323,3151573598969521591,131072 /prefetch:82⤵PID:2392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5048 --field-trial-handle=1788,i,2425771588916071323,3151573598969521591,131072 /prefetch:82⤵PID:4532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 --field-trial-handle=1788,i,2425771588916071323,3151573598969521591,131072 /prefetch:82⤵PID:432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5076 --field-trial-handle=1788,i,2425771588916071323,3151573598969521591,131072 /prefetch:12⤵PID:3276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5296 --field-trial-handle=1788,i,2425771588916071323,3151573598969521591,131072 /prefetch:12⤵PID:2348
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2804
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162KB
MD5b81d6636c3ad72c63e532e5180eaf7f9
SHA1ddcd059999fff6218e98af62dbe3fa9c885a0de8
SHA2562fb4351c49b47b7cdaa9516237a8b1e690e4448339d09d70a84c658729e461ef
SHA5124f0b87bbf60061a8efca4906554f958b7c28cf582452e01a8316d8c5ea8c98beda6c3230afff207f0b92d316c4c2e0ca1b4631e7d7364344b4a76394115af06b
-
Filesize
432B
MD5cc003394db8669f9ab48448f849f022e
SHA1fd8b5f2028dcfc27d87bb2df594dfe38e0c62455
SHA2562d8305b31b1ebc05d9fea1183a2887374e56d3187172126afc5c158b2384ad37
SHA512991d47a930af21b4e2c1b4a95fb8f8eb0ed807a4ebea219243a730d86e4ee8492d30061ef929035fadf32efd49b553e5372b835c959a01195a49f20b102c1241
-
Filesize
873B
MD5cded4db299ba2a605e516984b5a6a6ab
SHA10743948bb976e66b4db50444451cafc35aa73524
SHA2569e111baef5c4bf936dfae97146b8c754be029c2a7bdde1dceda013e2cafbebec
SHA51294060fe4caa54ccf1784b0061804473e5c83929038af59a78a0ee54d42ca33a00cc30c790d6f4b61eaf4c2b623af5a33adfd88d9be645a8d090ef51f3f07951b
-
Filesize
6KB
MD562ae0f941cf69fa4c372bbb0f3508894
SHA19d6542a615a056c4db2198c00b66ce1f2c55c93f
SHA256bba28314044bd15dc9216a27063632b959f26102649da11d9bbed43ad1938efa
SHA512b70f0bb8949fcfa045724d3466168ebeba3949175be16c9028860eee215eaf7b71c40ea26b5a2aad8b65a1a95f92208b4777c5adcb7affc04cffdc0f4ce171b8
-
Filesize
6KB
MD50593a31588c1ef139cd2c06f621ce8da
SHA13dc876ffbbb0b403afb0933de2e9b6e3b1dc2212
SHA256cf851884c04779225d43e09d2cc74decee7ae77cf8887069c62c0ed317e1e004
SHA512934bd071c9dd84ebc9056c7cda5ee5964ba07dd517232e09d82d49dd5aabf8754f65acbeca733c8357389ce7cf5166c3ec2510617288ee6b355adae6c192322a
-
Filesize
15KB
MD50b86091b68718b322a4cefcd3d49dbb0
SHA115041d36ff5c2434a740bb4fac11f3a973adeb43
SHA256cbd56980665af303614f83b4a8acaf2f8084d17e09189e6f8a4e34a201706fda
SHA5125892824dc9a8addcd9e65bba1161d9254f29774132d944d25ef613755e5b0cf0b51cc60206e6719905dad1be297703e3ff322ad56aff1fcdf4d1638febbdf006
-
Filesize
174KB
MD51096bce28bc9ebe878a00ce4888209cd
SHA1aa84b76bcefbb5454f907ad28e47c5f887117a82
SHA25603b25d0e87c869030c465e482e4819edc7b75b4e330b0377cfdb299c45ef55fb
SHA512621d0a97da4b80945c0879d420ea639bcb489dd7d1c0fefc8958f9f36b87497c5ab53c898d2d512b629f1cf2f8b21fd85c43c2aedd735cc1f04c4bbc62c21ae7
-
Filesize
174KB
MD52666d2c77da2a6fb1cfde0a3749c5988
SHA170d56b8f0cb134ba79d9d96bd0f91fc0871b3b18
SHA256a9a8e199c7c8e972206fe53f4052e87420c064f9cc06cd47a5508ab141a1faef
SHA51216b4df430588306d3cb1588e661ec40ad8d5dfa0635d526de0bddd3fe3f6026479f42f9bc1d67fb326d08d02a3bb72017f3fba4d3aa02ef09a5e6d5ac879abf8
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd