hxxps://scnv[.]io/H63Q

Analysis

max time kernel
145s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
20/02/2024, 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://scnv.io/H63Q

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
3896	msedge.exe
3896	msedge.exe
1056	msedge.exe
1056	msedge.exe
3948	identity_helper.exe
3948	identity_helper.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 5012	3896	msedge.exe	18
PID 3896 wrote to memory of 5012	3896	msedge.exe	18
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4816	3896	msedge.exe	39
PID 3896 wrote to memory of 4420	3896	msedge.exe	43
PID 3896 wrote to memory of 4420	3896	msedge.exe	43
PID 3896 wrote to memory of 1956	3896	msedge.exe	45
PID 3896 wrote to memory of 1956	3896	msedge.exe	45
PID 3896 wrote to memory of 1956	3896	msedge.exe	45
PID 3896 wrote to memory of 1956	3896	msedge.exe	45
PID 3896 wrote to memory of 1956	3896	msedge.exe	45
PID 3896 wrote to memory of 1956	3896	msedge.exe	45
PID 3896 wrote to memory of 1956	3896	msedge.exe	45
PID 3896 wrote to memory of 1956	3896	msedge.exe	45
PID 3896 wrote to memory of 1956	3896	msedge.exe	45
PID 3896 wrote to memory of 1956	3896	msedge.exe	45
PID 3896 wrote to memory of 1956	3896	msedge.exe	45
PID 3896 wrote to memory of 1956	3896	msedge.exe	45
PID 3896 wrote to memory of 1956	3896	msedge.exe	45
PID 3896 wrote to memory of 1956	3896	msedge.exe	45
PID 3896 wrote to memory of 1956	3896	msedge.exe	45
PID 3896 wrote to memory of 1956	3896	msedge.exe	45
PID 3896 wrote to memory of 1956	3896	msedge.exe	45
PID 3896 wrote to memory of 1956	3896	msedge.exe	45
PID 3896 wrote to memory of 1956	3896	msedge.exe	45
PID 3896 wrote to memory of 1956	3896	msedge.exe	45

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://scnv.io/H63Q
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffebdd93cb8,0x7ffebdd93cc8,0x7ffebdd93cd8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,644601765785368961,3805048561485243085,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4152 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3ac94e49addbb0b2b78b1cc0c4fdc41a

SHA1
41dda9076097a81d24a814805f80979eb5736a72

SHA256
259e79a3a5696dd704f943a3146b6622715c38d269751ea5b90c4858aeecaec5

SHA512
9890dd31736bf96b3669a9ba135e029d02a0245e31795f71f15bdb79066e95f8d43233643a78e1a36780b6983d88a5a82f71a07eb91133d9319c014e935fc9fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
090a0ee71184ac881728db7eebab5ac8

SHA1
40f2c0623335e24982749a1e400196d4314f378b

SHA256
c123285ff328b44d7817c51b72c17aa8f81a4da1cb333e7acb7e125ce3cc0225

SHA512
9c275ce3b6c4413680c2758c1f7bdc15989df8aa39e5490e50f434eee607c9cfc49ad3905f3802fe4cda97b3011c0358d4176e1898a537498a66eda37f872781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
430B

MD5
5f3d7e6421951d6cd35b7f0de5ffb15e

SHA1
81a6ff79607aa8f8b13a2e521d61eb75c78082a8

SHA256
41f27eff250f6ea4de5fda3b2b4ef91a27aeba74819fb17c7d5c09261e26e1cd

SHA512
e89e0e3dce3efe90f90f12d7e35c8c5682460c39775944c9a8371f705e7c29c9d2559ffbe19052e057c39e8d16ee827cf501f43ec705d961f3cdaeac263aa270

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d513ba7adef728fd7d5f35b695303f33

SHA1
05313470adb2435e6c1777363336906450a9ecb4

SHA256
ea8b02e5e303cadc910bbf4c569b7f91d3d177c9d05db7d252bd424b1f3e49be

SHA512
cdca5422987f2a928cef76b1d10552bdec4b5291587d2934352a13eb86e7b67a6d43f572d69fe549fe67c5c7ca03fefbfe416407945edd48223e27007f6d2408

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
353e63f9712dfaece61cd39563a76ad1

SHA1
f18c759efbf82efafd0ca8ee7a2e7f0d14093ec2

SHA256
b0a382454a028a299bcdbc89e41b856e5f03d46e0a537482359e4fd45fd7252d

SHA512
2ed7fdb055a12f08b9d6f6422cd938b64d8132c16bb1f59a59f4943f69f61393de5c3d1c3b8924ddd5b1df2e580c2a738c1d41aad94517aba7cffb467742c858

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
0ee370fd0b36aa248467fe639b6efd62

SHA1
8d05ed1594e797f3b884c0640b394305cca30521

SHA256
7546533b63e8d119b7d4d58459a88b1bfeb060128844de5ffa9a2800a07505ba

SHA512
9f36083d5068d2b293bd459c8a03e7d79b1f005f7386dccd2df7599b8f94875bfb7bec715e8141d02dbcd92043c8dc621493939cae7bdfa96763927487bc261c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3e1ffbfcba7e879cca65a32ce2a8ce4a

SHA1
1fbfaf46a6d771063ac58bf43540c134bad7e908

SHA256
049aa718d2f7d489f104aa593d6c470a075c0652fd53e67ce2c4d7c154e5aa11

SHA512
23367157f26665b961233ee055eef4ef30118fb4845a961493b7aea6716e59c9f65b4cf5270011248b89dd7a884bbd9a03a2f0f6e5ca88342cfb5e47c9ffff7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8b6ee3d93905b40f404aa35c31dc9163

SHA1
d1fa3c4629876c557efaa3a4db3ad5ab2ac7b0b8

SHA256
0e0ec678c56f4d00160432acec8179395a6d6b953c97794bedd4ad5aeaca0750

SHA512
78e06231686eecbc7f882f9c94263a6f7c2f80f35b42d9da6851e5110cf919381a3cc0c25542a9c6d9c8333bd9eeae07e78346fc9123f68ebaae918890e4e051

Download Submit