Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows11-21h2_x64 -
resource
win11-20240214-en -
resource tags
arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system -
submitted
20/02/2024, 01:09
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://scnv.io/H63Q
Resource
win11-20240214-en
General
-
Target
https://scnv.io/H63Q
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4420 msedge.exe 4420 msedge.exe 3896 msedge.exe 3896 msedge.exe 1056 msedge.exe 1056 msedge.exe 3948 identity_helper.exe 3948 identity_helper.exe 4148 msedge.exe 4148 msedge.exe 4148 msedge.exe 4148 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3896 wrote to memory of 5012 3896 msedge.exe 18 PID 3896 wrote to memory of 5012 3896 msedge.exe 18 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4816 3896 msedge.exe 39 PID 3896 wrote to memory of 4420 3896 msedge.exe 43 PID 3896 wrote to memory of 4420 3896 msedge.exe 43 PID 3896 wrote to memory of 1956 3896 msedge.exe 45 PID 3896 wrote to memory of 1956 3896 msedge.exe 45 PID 3896 wrote to memory of 1956 3896 msedge.exe 45 PID 3896 wrote to memory of 1956 3896 msedge.exe 45 PID 3896 wrote to memory of 1956 3896 msedge.exe 45 PID 3896 wrote to memory of 1956 3896 msedge.exe 45 PID 3896 wrote to memory of 1956 3896 msedge.exe 45 PID 3896 wrote to memory of 1956 3896 msedge.exe 45 PID 3896 wrote to memory of 1956 3896 msedge.exe 45 PID 3896 wrote to memory of 1956 3896 msedge.exe 45 PID 3896 wrote to memory of 1956 3896 msedge.exe 45 PID 3896 wrote to memory of 1956 3896 msedge.exe 45 PID 3896 wrote to memory of 1956 3896 msedge.exe 45 PID 3896 wrote to memory of 1956 3896 msedge.exe 45 PID 3896 wrote to memory of 1956 3896 msedge.exe 45 PID 3896 wrote to memory of 1956 3896 msedge.exe 45 PID 3896 wrote to memory of 1956 3896 msedge.exe 45 PID 3896 wrote to memory of 1956 3896 msedge.exe 45 PID 3896 wrote to memory of 1956 3896 msedge.exe 45 PID 3896 wrote to memory of 1956 3896 msedge.exe 45
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://scnv.io/H63Q1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffebdd93cb8,0x7ffebdd93cc8,0x7ffebdd93cd82⤵PID:5012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:22⤵PID:4816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:82⤵PID:1956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:12⤵PID:1220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:12⤵PID:3604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:12⤵PID:4912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:12⤵PID:3868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:12⤵PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4044 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4152 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4148
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4868
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD53ac94e49addbb0b2b78b1cc0c4fdc41a
SHA141dda9076097a81d24a814805f80979eb5736a72
SHA256259e79a3a5696dd704f943a3146b6622715c38d269751ea5b90c4858aeecaec5
SHA5129890dd31736bf96b3669a9ba135e029d02a0245e31795f71f15bdb79066e95f8d43233643a78e1a36780b6983d88a5a82f71a07eb91133d9319c014e935fc9fa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD5090a0ee71184ac881728db7eebab5ac8
SHA140f2c0623335e24982749a1e400196d4314f378b
SHA256c123285ff328b44d7817c51b72c17aa8f81a4da1cb333e7acb7e125ce3cc0225
SHA5129c275ce3b6c4413680c2758c1f7bdc15989df8aa39e5490e50f434eee607c9cfc49ad3905f3802fe4cda97b3011c0358d4176e1898a537498a66eda37f872781
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
430B
MD55f3d7e6421951d6cd35b7f0de5ffb15e
SHA181a6ff79607aa8f8b13a2e521d61eb75c78082a8
SHA25641f27eff250f6ea4de5fda3b2b4ef91a27aeba74819fb17c7d5c09261e26e1cd
SHA512e89e0e3dce3efe90f90f12d7e35c8c5682460c39775944c9a8371f705e7c29c9d2559ffbe19052e057c39e8d16ee827cf501f43ec705d961f3cdaeac263aa270
-
Filesize
5KB
MD5d513ba7adef728fd7d5f35b695303f33
SHA105313470adb2435e6c1777363336906450a9ecb4
SHA256ea8b02e5e303cadc910bbf4c569b7f91d3d177c9d05db7d252bd424b1f3e49be
SHA512cdca5422987f2a928cef76b1d10552bdec4b5291587d2934352a13eb86e7b67a6d43f572d69fe549fe67c5c7ca03fefbfe416407945edd48223e27007f6d2408
-
Filesize
5KB
MD5353e63f9712dfaece61cd39563a76ad1
SHA1f18c759efbf82efafd0ca8ee7a2e7f0d14093ec2
SHA256b0a382454a028a299bcdbc89e41b856e5f03d46e0a537482359e4fd45fd7252d
SHA5122ed7fdb055a12f08b9d6f6422cd938b64d8132c16bb1f59a59f4943f69f61393de5c3d1c3b8924ddd5b1df2e580c2a738c1d41aad94517aba7cffb467742c858
-
Filesize
25KB
MD50ee370fd0b36aa248467fe639b6efd62
SHA18d05ed1594e797f3b884c0640b394305cca30521
SHA2567546533b63e8d119b7d4d58459a88b1bfeb060128844de5ffa9a2800a07505ba
SHA5129f36083d5068d2b293bd459c8a03e7d79b1f005f7386dccd2df7599b8f94875bfb7bec715e8141d02dbcd92043c8dc621493939cae7bdfa96763927487bc261c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD53e1ffbfcba7e879cca65a32ce2a8ce4a
SHA11fbfaf46a6d771063ac58bf43540c134bad7e908
SHA256049aa718d2f7d489f104aa593d6c470a075c0652fd53e67ce2c4d7c154e5aa11
SHA51223367157f26665b961233ee055eef4ef30118fb4845a961493b7aea6716e59c9f65b4cf5270011248b89dd7a884bbd9a03a2f0f6e5ca88342cfb5e47c9ffff7d
-
Filesize
10KB
MD58b6ee3d93905b40f404aa35c31dc9163
SHA1d1fa3c4629876c557efaa3a4db3ad5ab2ac7b0b8
SHA2560e0ec678c56f4d00160432acec8179395a6d6b953c97794bedd4ad5aeaca0750
SHA51278e06231686eecbc7f882f9c94263a6f7c2f80f35b42d9da6851e5110cf919381a3cc0c25542a9c6d9c8333bd9eeae07e78346fc9123f68ebaae918890e4e051