hxxps://www[.]gameloop[.]com/mx/game/arcade/bonetale-fangame-on-pc

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2023 23:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.gameloop.com/mx/game/arcade/bonetale-fangame-on-pc

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
3816	msedge.exe
3816	msedge.exe
3452	identity_helper.exe
3452	identity_helper.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 4056	3816	msedge.exe	84
PID 3816 wrote to memory of 4056	3816	msedge.exe	84
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 4552	3816	msedge.exe	86
PID 3816 wrote to memory of 2608	3816	msedge.exe	85
PID 3816 wrote to memory of 2608	3816	msedge.exe	85
PID 3816 wrote to memory of 1460	3816	msedge.exe	87
PID 3816 wrote to memory of 1460	3816	msedge.exe	87
PID 3816 wrote to memory of 1460	3816	msedge.exe	87
PID 3816 wrote to memory of 1460	3816	msedge.exe	87
PID 3816 wrote to memory of 1460	3816	msedge.exe	87
PID 3816 wrote to memory of 1460	3816	msedge.exe	87
PID 3816 wrote to memory of 1460	3816	msedge.exe	87
PID 3816 wrote to memory of 1460	3816	msedge.exe	87
PID 3816 wrote to memory of 1460	3816	msedge.exe	87
PID 3816 wrote to memory of 1460	3816	msedge.exe	87
PID 3816 wrote to memory of 1460	3816	msedge.exe	87
PID 3816 wrote to memory of 1460	3816	msedge.exe	87
PID 3816 wrote to memory of 1460	3816	msedge.exe	87
PID 3816 wrote to memory of 1460	3816	msedge.exe	87
PID 3816 wrote to memory of 1460	3816	msedge.exe	87
PID 3816 wrote to memory of 1460	3816	msedge.exe	87
PID 3816 wrote to memory of 1460	3816	msedge.exe	87
PID 3816 wrote to memory of 1460	3816	msedge.exe	87
PID 3816 wrote to memory of 1460	3816	msedge.exe	87
PID 3816 wrote to memory of 1460	3816	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.gameloop.com/mx/game/arcade/bonetale-fangame-on-pc
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef7c846f8,0x7ffef7c84708,0x7ffef7c84718
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,5836131364008065323,5552149936106593890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5836131364008065323,5552149936106593890,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,5836131364008065323,5552149936106593890,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5836131364008065323,5552149936106593890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5836131364008065323,5552149936106593890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5836131364008065323,5552149936106593890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5836131364008065323,5552149936106593890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5836131364008065323,5552149936106593890,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5836131364008065323,5552149936106593890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5836131364008065323,5552149936106593890,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5836131364008065323,5552149936106593890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5836131364008065323,5552149936106593890,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5132 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8411007bafe7b1182af1ad3a1809b4f8

SHA1
4a78ee0762aadd53accae8bb211b8b18dc602070

SHA256
1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

SHA512
909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
0534077cd86c723690ee398827f74c5c

SHA1
89061a93b43cea95406ca10facf7881b9f7b1aad

SHA256
0225aebb334a05da6cc12b23a363fd38d4befeeef8f69ff670920efab62003e3

SHA512
9b03f595571839b54d7846aa42a394194ec1b5c8b91d05b560d81211091db0d26523c3e1232f9c37513e3a8c70e9e945e233b03d73fd34461a15365ace16b097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
eda1ca0621007ed92cb5188aa61e4d4c

SHA1
0c33e3de7f6ac444941a5995f665c6c363528583

SHA256
67cc4a5941b2d7c2d5226bc2e9e77eff171a9220fdbac3071ec7eb5e296cd685

SHA512
e1490c12ce55459c036afd459874d8c3a63c6f12e6c0f715df8c71273b4b52af4d78191c8e98f41144869a77545ad5146d188fd5a61c60caf717765af5c5d59f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0cf5df1378faf08e9c0b20466e785331

SHA1
a0d60a7e233cd3cdad42c36f3700c6ce2e575d15

SHA256
dc02c46c5d777f55fe20e0786f9eda81b62a3db31abbbbc68586d2d49e56b7ac

SHA512
da029a77fad54da3980960eb4a66d8dcc12a8a469b9117d243eba90075cd14a1bbe76ddc20e6c5373ef4a98081f9e5dde83c9eea005327eff7c2e4a75212669c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8290b50743d81a390c98fa1eb72e7c5c

SHA1
43314a716db31a92d3f63cc4363d2cef261faae3

SHA256
e4df8b8bebdf06afaea285f041021e52fca4f7b7e872a37c13c29252201944e0

SHA512
f5a90edd58fee0fa00fb9a3e7cf5814bea6880288aee92ba393456f427e4d691285b2117d580000f020b1e34671aa42be6b5d9d018a88badc5f9578ea3a37137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8caf4d73cc5a7d5e3fb3f9f1a9d4a0cc

SHA1
83f8586805286b716c70ddd14a2b7ec6a4d9d0fe

SHA256
0e0c905b688340512e84db6cf8af6dbdfe29195fefde15bd02e4917a2c5fda8c

SHA512
084ef25ea21ee1083735c61b758281ba84b607e42d0186c35c3700b24a176ada47bf2e76ed7dadd3846f2b458c977e83835ced01cda47cdd7ab2d00e5a1a294e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2a701e37e2150f2a3d0f7f9e81493d00

SHA1
ad287a60da36b4b36e441813831f65ce22dac1ed

SHA256
3008e44137aaf367231c37348c7edcb0dd06401291d2b38c2aad10b03f03d9b8

SHA512
dafa7c9ddc0e61edc979e43beb80172ccb224c025252bf9459b28fed0f533fbda70f9c0c08c8549f45c90dcbf444ba0bc81fc4d33dee5ed6b09137ff7beca125

Download Submit