Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
168s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20/12/2023, 02:42
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://govatoservices.org
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
http://govatoservices.org
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
http://govatoservices.org
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral4
Sample
http://govatoservices.org
Resource
android-x64-20231215-en
Behavioral task
behavioral5
Sample
http://govatoservices.org
Resource
android-x64-arm64-20231215-en
General
-
Target
http://govatoservices.org
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 64 msedge.exe 64 msedge.exe 4812 msedge.exe 4812 msedge.exe 3988 identity_helper.exe 3988 identity_helper.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe 4812 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4812 wrote to memory of 3608 4812 msedge.exe 87 PID 4812 wrote to memory of 3608 4812 msedge.exe 87 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 4768 4812 msedge.exe 88 PID 4812 wrote to memory of 64 4812 msedge.exe 89 PID 4812 wrote to memory of 64 4812 msedge.exe 89 PID 4812 wrote to memory of 1784 4812 msedge.exe 90 PID 4812 wrote to memory of 1784 4812 msedge.exe 90 PID 4812 wrote to memory of 1784 4812 msedge.exe 90 PID 4812 wrote to memory of 1784 4812 msedge.exe 90 PID 4812 wrote to memory of 1784 4812 msedge.exe 90 PID 4812 wrote to memory of 1784 4812 msedge.exe 90 PID 4812 wrote to memory of 1784 4812 msedge.exe 90 PID 4812 wrote to memory of 1784 4812 msedge.exe 90 PID 4812 wrote to memory of 1784 4812 msedge.exe 90 PID 4812 wrote to memory of 1784 4812 msedge.exe 90 PID 4812 wrote to memory of 1784 4812 msedge.exe 90 PID 4812 wrote to memory of 1784 4812 msedge.exe 90 PID 4812 wrote to memory of 1784 4812 msedge.exe 90 PID 4812 wrote to memory of 1784 4812 msedge.exe 90 PID 4812 wrote to memory of 1784 4812 msedge.exe 90 PID 4812 wrote to memory of 1784 4812 msedge.exe 90 PID 4812 wrote to memory of 1784 4812 msedge.exe 90 PID 4812 wrote to memory of 1784 4812 msedge.exe 90 PID 4812 wrote to memory of 1784 4812 msedge.exe 90 PID 4812 wrote to memory of 1784 4812 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://govatoservices.org1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc236446f8,0x7ffc23644708,0x7ffc236447182⤵PID:3608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,9251653100789886074,10890499989141714855,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:4768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,9251653100789886074,10890499989141714855,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:64
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,9251653100789886074,10890499989141714855,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:82⤵PID:1784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9251653100789886074,10890499989141714855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:1860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9251653100789886074,10890499989141714855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9251653100789886074,10890499989141714855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:12⤵PID:2596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9251653100789886074,10890499989141714855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:12⤵PID:3084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,9251653100789886074,10890499989141714855,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3444 /prefetch:82⤵PID:4300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,9251653100789886074,10890499989141714855,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3444 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9251653100789886074,10890499989141714855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:12⤵PID:3832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9251653100789886074,10890499989141714855,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:12⤵PID:2660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9251653100789886074,10890499989141714855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:12⤵PID:4588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9251653100789886074,10890499989141714855,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:12⤵PID:3692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9251653100789886074,10890499989141714855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:12⤵PID:1996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9251653100789886074,10890499989141714855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:12⤵PID:4960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,9251653100789886074,10890499989141714855,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3412 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1872
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2012
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD57a5862a0ca86c0a4e8e0b30261858e1f
SHA1ee490d28e155806d255e0f17be72509be750bf97
SHA25692b4c004a9ec97ccf7a19955926982bac099f3b438cd46063bb9bf5ac7814a4b
SHA5120089df12ed908b4925ba838e07128987afe1c9235097b62855122a03ca6d34d7c75fe4c30e68581c946b77252e7edf1dd66481e20c0a9cccd37e0a4fe4f0a6fe
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD52664f9f04823287c50598887c3eead47
SHA1048e134027558735cc385a995be8cf4579f36ab8
SHA2565c99ccc4275159f07a88666f22ed99333d2eaee2fd804d4a6a1d16cff9378e0d
SHA51208185fd7578498204307298b7418fac3219f98d656e671df7e7e6c5f10bd9f78a67712f1ccfa885d9e918aac09cd34a886a304f7ee45227979204713425bcab0
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
557B
MD5d0450d4f56e452de779e7ea89a3f7d74
SHA111b34fd92a413ac6ba3dedcd408cb4f900c5bdaf
SHA2560eb3a297cc448649c8834811d8a64d99010778dfd04bd354b81ebe8db1d46496
SHA512abb8db55058a8f000a535caf127d2b93093ccef44eed75c5ded4a4901fa6785b956fa2dfaaec284a637be88c2f529aee81e6e329b5ea83cfd413612b085050c2
-
Filesize
5KB
MD59f7a4467fd1487fe56f647064e441f62
SHA1add22c7a1d61e5aa47b8242be664e37f1b413bb3
SHA25605134dac714b414bb0cc690c12a90aa366260de2b1fd2d7d60346b6c9ccf2653
SHA5127c4fa0bfcdd4f35b259863b4f4ea97b9448697106f049bba72280127d3d17ff418a34d65114be3a46a105d2823d6f70b3ae426349332277d1008dd9a06d0b93f
-
Filesize
5KB
MD5a6bcebffdf4bbc4b859bb17dec635c3d
SHA1667f958f32b029ac227b907920cd9c2f8ea31847
SHA256be767e1b8c46f0111665dbbc9e6988ceb0d61f210fd5a73196b390fbd2ac2c61
SHA512af12706ce7ec3d0c1cf9cf75b452c902fbd64748284c795266cba614890e5f015c5729c952338ebcc2fd0e3b68bcfcb403ad6a7ab45c4d7acc07cbe6c13746f9
-
Filesize
5KB
MD5ffa4bc4db77bdd8efc2afce63f765410
SHA1ce39e36de696be0cfef5cbb336360c7a45a3a43a
SHA25689664b5b1ff9f7f2c5ca6e68a508c41104bb9e16aee10454eeefc75ba75e5172
SHA5126d4e29ffd76c1721ba607c601b1a2e4a807161c14b12731c76c21707377eebed6b6b6b291fd5cb1990429c0758f8355780daa7defcb002fcc3762d42bf92ccbf
-
Filesize
24KB
MD552826cef6409f67b78148b75e442b5ea
SHA1a675db110aae767f5910511751cc3992cddcc393
SHA25698fc43994599573e7181c849e5865f23b4f05f85c1115dff53c58764d80373fb
SHA512f18df18cab6b5ecd71b79c81a2a1fdac42cc9960f62f06ac25f4d6487792705f2766ee3a10239eaac940d090186e6bc820e4eb7a5ee138f6e5c1c64f951b960c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD56968886917f5b3af82a94dad2b650ea8
SHA16ab8aa426980f4175c909240de2080a147ee255a
SHA2562793be8f2d8cc0944a70f0e890b02a32e62ac3e7b8b5fb058adc200676b5b298
SHA5129611a8218b8cb8c29008eeea49e75bbf259fe8bd19f463b80ed1f7708b4104467f6587669ac0b91d7aded22b336cc1c5a8e538520b6d2466b4453af613d8072e