Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
73s -
max time network
77s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
07/10/2023, 09:15
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://supercrossvr.com/ovq2s
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
600 seconds
General
-
Target
https://supercrossvr.com/ovq2s
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133411437282571513" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4784 chrome.exe 4784 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4784 wrote to memory of 4624 4784 chrome.exe 85 PID 4784 wrote to memory of 4624 4784 chrome.exe 85 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 3348 4784 chrome.exe 88 PID 4784 wrote to memory of 4340 4784 chrome.exe 89 PID 4784 wrote to memory of 4340 4784 chrome.exe 89 PID 4784 wrote to memory of 4480 4784 chrome.exe 90 PID 4784 wrote to memory of 4480 4784 chrome.exe 90 PID 4784 wrote to memory of 4480 4784 chrome.exe 90 PID 4784 wrote to memory of 4480 4784 chrome.exe 90 PID 4784 wrote to memory of 4480 4784 chrome.exe 90 PID 4784 wrote to memory of 4480 4784 chrome.exe 90 PID 4784 wrote to memory of 4480 4784 chrome.exe 90 PID 4784 wrote to memory of 4480 4784 chrome.exe 90 PID 4784 wrote to memory of 4480 4784 chrome.exe 90 PID 4784 wrote to memory of 4480 4784 chrome.exe 90 PID 4784 wrote to memory of 4480 4784 chrome.exe 90 PID 4784 wrote to memory of 4480 4784 chrome.exe 90 PID 4784 wrote to memory of 4480 4784 chrome.exe 90 PID 4784 wrote to memory of 4480 4784 chrome.exe 90 PID 4784 wrote to memory of 4480 4784 chrome.exe 90 PID 4784 wrote to memory of 4480 4784 chrome.exe 90 PID 4784 wrote to memory of 4480 4784 chrome.exe 90 PID 4784 wrote to memory of 4480 4784 chrome.exe 90 PID 4784 wrote to memory of 4480 4784 chrome.exe 90 PID 4784 wrote to memory of 4480 4784 chrome.exe 90 PID 4784 wrote to memory of 4480 4784 chrome.exe 90 PID 4784 wrote to memory of 4480 4784 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://supercrossvr.com/ovq2s1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c8459758,0x7ff8c8459768,0x7ff8c84597782⤵PID:4624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1960,i,16581525782762860377,2795575121473165658,131072 /prefetch:22⤵PID:3348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1960,i,16581525782762860377,2795575121473165658,131072 /prefetch:82⤵PID:4340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1960,i,16581525782762860377,2795575121473165658,131072 /prefetch:82⤵PID:4480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3196 --field-trial-handle=1960,i,16581525782762860377,2795575121473165658,131072 /prefetch:12⤵PID:3860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3236 --field-trial-handle=1960,i,16581525782762860377,2795575121473165658,131072 /prefetch:12⤵PID:3920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4616 --field-trial-handle=1960,i,16581525782762860377,2795575121473165658,131072 /prefetch:12⤵PID:1900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 --field-trial-handle=1960,i,16581525782762860377,2795575121473165658,131072 /prefetch:82⤵PID:208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 --field-trial-handle=1960,i,16581525782762860377,2795575121473165658,131072 /prefetch:82⤵PID:3308
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4012
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240B
MD5ac1b79af95bfab6daae434fe7f7f0b45
SHA1482d94bfd6737465834352bb0486bbdcd7bf32ad
SHA2562e1664449d6dbe78c560be61950015f0a71bbc01fb30f10f1af8eff8a06c357a
SHA512a776105903539ee42e1d4d6caf1e698436a43ca2734c31b22ed3712713b832ba3c68924ff720467875fdb0300133d3c4c361e2cbeaac2e695be45933aeb948d0
-
Filesize
2KB
MD5b0240a3dbb13c84ccb5e97fbad09c623
SHA1be7b5f1c3382e8455e9393bae592927a6ec70d61
SHA2560a692e008b2e24f57bffda11c843b0d6f59dce2f7eaa33db75e9bf77364a0abd
SHA512754a9bc4ef7a83514cc24153308d9358a9eac24408e87a357604a1a20ec39d103e9c104e4983e37539396a51d851b89ffaadef400e6a2e67d98e3c115a0e5a07
-
Filesize
539B
MD577000f6a39f1512cb8fe24f18b3f161e
SHA190ce717f2b9933980ccbaa6ecb15f746ffbf7bef
SHA2567c7aafc5bef8f934e06df8ca1bb6a817ebe345d36095c52cd38074b1aa4d8c64
SHA512c370350651aa9e712d7b0fdf31b262a2be579e8fce833a5cb3082ab702d519d5c8095c0e0886d807b28c44380975dc3728c475e9531b60aa49a1803add1f90dd
-
Filesize
6KB
MD5af39b3c3262534641e113d72bb761c32
SHA1dc5b811c96ea482e2bb9fe82731b1bf06ea32152
SHA256ab2d6174519faf6234a506f57e37148ec2ab8c0174de2210eb41c627e5070e30
SHA5129bf38683ba6b8529ed6beafa59d7a06fa890983a33526dc62c731f852f0a50715fb5dac19238045270da9cb658a85e828285a55a427c3cc04b5ad5613d367834
-
Filesize
101KB
MD55cba6397a485ce46407566bae2bdca55
SHA163388b62d6fcc17ba6f1c4955fc04d043f262fb1
SHA2563cfbbb03f3e4fc778762746892b3b01de34f26d1449bc42662383a45dc1c9ac6
SHA51264e9049354e8eb0689ce560af18470ca7d870f45d70917eb3bf801673df1ae3231c04649feac6bd7847da7665baaac124504e3cc34bc4b86314dd04fdcac4865
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd