hxxps://steamunlocked[.]net/dd1590-people-playground-free-pc-download/

Resubmissions

22/02/2024, 07:49

240222-jn7x5sed21 1

22/02/2024, 07:49

240222-jnwj4seh77 1

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 07:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://steamunlocked.net/dd1590-people-playground-free-pc-download/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4076	msedge.exe
4076	msedge.exe
1912	msedge.exe
1912	msedge.exe
840	identity_helper.exe
840	identity_helper.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 4288	1912	msedge.exe	54
PID 1912 wrote to memory of 4288	1912	msedge.exe	54
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4080	1912	msedge.exe	86
PID 1912 wrote to memory of 4076	1912	msedge.exe	87
PID 1912 wrote to memory of 4076	1912	msedge.exe	87
PID 1912 wrote to memory of 516	1912	msedge.exe	88
PID 1912 wrote to memory of 516	1912	msedge.exe	88
PID 1912 wrote to memory of 516	1912	msedge.exe	88
PID 1912 wrote to memory of 516	1912	msedge.exe	88
PID 1912 wrote to memory of 516	1912	msedge.exe	88
PID 1912 wrote to memory of 516	1912	msedge.exe	88
PID 1912 wrote to memory of 516	1912	msedge.exe	88
PID 1912 wrote to memory of 516	1912	msedge.exe	88
PID 1912 wrote to memory of 516	1912	msedge.exe	88
PID 1912 wrote to memory of 516	1912	msedge.exe	88
PID 1912 wrote to memory of 516	1912	msedge.exe	88
PID 1912 wrote to memory of 516	1912	msedge.exe	88
PID 1912 wrote to memory of 516	1912	msedge.exe	88
PID 1912 wrote to memory of 516	1912	msedge.exe	88
PID 1912 wrote to memory of 516	1912	msedge.exe	88
PID 1912 wrote to memory of 516	1912	msedge.exe	88
PID 1912 wrote to memory of 516	1912	msedge.exe	88
PID 1912 wrote to memory of 516	1912	msedge.exe	88
PID 1912 wrote to memory of 516	1912	msedge.exe	88
PID 1912 wrote to memory of 516	1912	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamunlocked.net/dd1590-people-playground-free-pc-download/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd931546f8,0x7ffd93154708,0x7ffd93154718
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,16854208799814906009,5212096078689845679,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,16854208799814906009,5212096078689845679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,16854208799814906009,5212096078689845679,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16854208799814906009,5212096078689845679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16854208799814906009,5212096078689845679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,16854208799814906009,5212096078689845679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,16854208799814906009,5212096078689845679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16854208799814906009,5212096078689845679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16854208799814906009,5212096078689845679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16854208799814906009,5212096078689845679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16854208799814906009,5212096078689845679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,16854208799814906009,5212096078689845679,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
91746379e314b064719e43e3422d0388

SHA1
65f1a2b5a93922d589142a6edf99b5b35d986dba

SHA256
0b3cf8ae20afd84c9bf06546e876c84922cb5800526df72a628479f4d5487df7

SHA512
a783d8d9613cf92020fc36fd27d384dbd4e105a1ebd02c4507bf7263e61ff5b377e6d1734b066700782fa64bcbeb11af31ac3972d404625cbdb587cfa3bc0808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ccf8b7b618672b2da2775b890d06c7af

SHA1
83717bc0ff28b8775a1360ef02882be22e4a5263

SHA256
ef08e2971a9ba903c9b91412275b39aabfd6d4aa5c46ade37d74ff86f0285420

SHA512
eb550889db8c4c0e7d79b2bd85c7d0e61b696df10ce3d76c48ab21b935c7ecc7b12403a00d6570e7d8e4121f72747242c2358f8f0823f804e704bd44ed603b97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
45a5b8da36cff4512e64c92141dd525b

SHA1
0e8ab8195b60e4d4f481de193dd1cba0353f146b

SHA256
7cdaa793e0bcf7aadceeb5c8e8a668347108364f8b0575ea9929891bafdba480

SHA512
0d1a844666bf264fd9a20c1a4127c1063a3554bfe6cfd1904edd9c56817fff387290d07d7ce504498bb8af51f268ac125ddf3afbda5730821340fb16a72fd881

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
990B

MD5
e3a4aeb8979e0e9a688ae112350ad0cb

SHA1
6613b148ef3d4769669068487ba56711f3386283

SHA256
3285def793aa7f4c08ce63e543c4e064fcd86b5451564522d28b77480721f5c6

SHA512
9fd1733efce39f4d6f2f8a5fd05f291bfb34c1cae95e61ae20adeec6c144ea05905e6066f7afad7a7087bdf9ecf7c0a6228cf9408706b0cc218d09ef4aafbd30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eeb8514d7ebe6306c34f7c208a497f20

SHA1
7a9e0f908f8b48f006a5391705a2f802128bbed1

SHA256
d8d7810014e42950a5f29b4165521a880b7e5c5e35a5b890985f00d327aa9df4

SHA512
86c24a02d1a1b17c5dd063139f1a6b83e84ec1cb27969760d25463ddfc538a2c4b0ca531987f348cc5d1ddbc77e00be400bf4c48c93d4f84c2e9c3c62480674b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
118dc9ecb624d32bf6565c722e1ebce1

SHA1
5d2fce12642f49648808ceba2a7f43ccfa73d86e

SHA256
e9efa52a70a6b7fe9e5f6d54cca67015429469ada1b46ec2c6ca389db7dc7bcc

SHA512
8da6b130a93b67871fb01fd7b778079e24d98ffa626b7eb6742eddf140dfba394443bb4c49b0d7d9033c8fa41c187f1372405c8d40ce26b37bd35310e6b39d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ddfcc02e1057fb2ff448bd8f2d051c89

SHA1
e3f80614d1b78c9618a17b9397a997f3f2ecc67e

SHA256
9235edf83bd2117383e54bfc5faab407da1741189f35c057c1bec25df12d0b36

SHA512
0ee2dcab6bfd233e9b510f73dd125cf2ba8197e7e3cc856a0bd50fe9615f40557133649be1c583cb966ad83c20726f1d694485675cf7d611ba82ea6f07ac163e

Download Submit