hxxps://steamcomunnutiy[.]com/gift/activation/feor37569hFvrb1ga

General

Target

https://steamcomunnutiy.com/gift/activation/feor37569hFvrb1ga

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133532114885415453"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

2036 chrome.exe
2036 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

2036 chrome.exe
2036 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe
Token: SeShutdownPrivilege	2036	chrome.exe
Token: SeCreatePagefilePrivilege	2036	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe
2036	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2036 wrote to memory of 2032	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2032	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 2812	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 3188	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 3188	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe
PID 2036 wrote to memory of 1052	2036	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://steamcomunnutiy.com/gift/activation/feor37569hFvrb1ga
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaabb59758,0x7ffaabb59768,0x7ffaabb59778
2⤵
PID:2032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1868,i,13026345573442816260,17386291173824362962,131072 /prefetch:8
2⤵
PID:3188

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1868,i,13026345573442816260,17386291173824362962,131072 /prefetch:2
2⤵
PID:2812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1868,i,13026345573442816260,17386291173824362962,131072 /prefetch:8
2⤵
PID:1052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2976 --field-trial-handle=1868,i,13026345573442816260,17386291173824362962,131072 /prefetch:1
2⤵
PID:4616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1868,i,13026345573442816260,17386291173824362962,131072 /prefetch:1
2⤵
PID:4644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 --field-trial-handle=1868,i,13026345573442816260,17386291173824362962,131072 /prefetch:8
2⤵
PID:4248

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3880 --field-trial-handle=1868,i,13026345573442816260,17386291173824362962,131072 /prefetch:8
2⤵
PID:368

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4968

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
576B

MD5
0afa80f768f5056301fef60b33edaf34

SHA1
9ce86a22952711f34830b2b9f8de43e4783d05a0

SHA256
b34ae9b5f05099ff5f8a8ba348bb0dc6ca1aaff663a0c6314bc0c61bdd4c3202

SHA512
ad53848c037daf9bfff23ffea5cf9d2c8cf04822cb66594e374a0369d5b409c6421347f72a7acb5f9e5f54529a15e3bc036966085b789e90e9dd0f722263e5a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
0778cf00204272340dbdf1e68d706110

SHA1
e65eae39ea0dffe276ca06a2a2ce6c283c0fb63e

SHA256
6f04852cc496353eaad2e075ab0499ac4535a2079663706667cdc8aec31603f5

SHA512
33db0164b741fcab4c4008f119cfdc6983d1b599d6a8f2562635ad2b4ab722a6d216e6a1bc0f082a4f88b3003ed82086c2bb0495944127fe6723b9b4340b5e9e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
fb47697e8d633ba591e47f2bef8bfdfd

SHA1
dd7abff7abc9c096be281030ce2c72bec164ad31

SHA256
322fbcc8ef8635912e8d46a96bdb34c45527f009a734b0d53632e26e5ba9a9d5

SHA512
1902d7b31404588b7f6d43affd167c0b3c62de5021fa20737b9d2d34ccdc57029c4d5b2c74f03a1c0cc7214fe62cf16c0be59f03c79ab3486bb62c8fa143733a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
16d5b2eb73deb742a558513160164c20

SHA1
365d0e7461e548d55599329b8a26bedbd684c591

SHA256
6ff93599af022e79e860aeaaf6fd589a9c4821e97952a6f0f0a92231b7e3b6a2

SHA512
4653ccc478cf66703aed2321ee55851934d2716d16c5ee0b57667651d9b7f040ea4a85414ed664786242c17856e605f15521b4a6696c2a68d535fd8b9b32480e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
130KB

MD5
7d18f56b2e79bb6c4839c3953f0a118e

SHA1
3c48adef58de2961da8767defe570e5a97f302c2

SHA256
ee749417c45b61678ad31229846c88a7bc32e50fc62b53e0550ee199f5dc6b30

SHA512
06fde3bf38826a2d8e651ce7b1a2d9512d2efce72e2557395e398141357639878b7ca6a1138933b9a0cc0cf4d0ed50db9b5e70689a94801ddc17ac46446c7dc1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_2036_WCNBFHLNKHBCWFYB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads