hxxps://steamcomunnutiy[.]com/gift/activation/feor37569hFvrba3

Analysis

max time kernel
146s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
26-02-2024 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamcomunnutiy.com/gift/activation/feor37569hFvrba3

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2800	msedge.exe
2800	msedge.exe
4944	msedge.exe
4944	msedge.exe
1012	identity_helper.exe
1012	identity_helper.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4944 msedge.exe
4944 msedge.exe
4944 msedge.exe
4944 msedge.exe
4944 msedge.exe
4944 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4944 wrote to memory of 1816	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 1816	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 3332	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2800	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2800	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2384	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2384	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2384	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2384	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2384	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2384	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2384	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2384	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2384	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2384	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2384	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2384	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2384	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2384	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2384	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2384	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2384	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2384	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2384	4944	msedge.exe	msedge.exe
PID 4944 wrote to memory of 2384	4944	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcomunnutiy.com/gift/activation/feor37569hFvrba3
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4f3546f8,0x7fff4f354708,0x7fff4f354718
2⤵
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
2⤵
PID:3332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2508 /prefetch:8
2⤵
PID:2384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
2⤵
PID:3040

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
2⤵
PID:2684

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
2⤵
PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
2⤵
PID:3404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
2⤵
PID:3100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
2⤵
PID:1124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3120 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
d62cefeb0c8fbab806b3b96c7b215c16

SHA1
dc36684019f7ac8a632f5401cc3bedd482526ed7

SHA256
752b0793cf152e9ea51b8a2dc1d7e622c1c1009677d8f29e8b88d3aa9427dd01

SHA512
9fc3968fec094be5ca10a0d927cb829f7f8157425946ebd99a346b7e63c977cb3f37560af1a4bc8f87ab19b43b3ed86fd5b37f89d1a9b2dc86e3c73142c3065b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7ee1c6757da82ca0a9ae699227f619bc

SHA1
72dcf8262c6400dcbb5228afcb36795ae1b8001f

SHA256
62320bde5e037d4ac1aa0f5ff0314b661f13bb56c02432814bffb0bd6e34ed31

SHA512
dca56a99b7463eddf0af3656a4f7d0177a43116f401a6de9f56e5c40a49676cea5c38b6c458f426c6bff11165eec21104cfa9ca3e38af39d43188b36d3f22a0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
456B

MD5
77b85c65f324bd65293d715b5ec4d179

SHA1
fd278503db07ac5450969a1efae84549ee8c4d23

SHA256
251f5e6e64267484ae53657b01c4e780dbb07497f0c534b9e18494a48ccbd985

SHA512
ba9ee79a869aa13373178852113a5c030f23a092216e5d7e3e381bf545deb327477386b2d588fef617767298045b8dcf25fb0b8f33466c40e6de922fd5251978

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
543B

MD5
0e0d0d03601d451c17aaa67132124eba

SHA1
0bc9e940103fcb927085fac3501bdb06e496758e

SHA256
af18d065d9465a169f8694ff3b6dd70a2e2eb80914748f2f679ca0baacaeedcf

SHA512
55b4986dc478211d64da346573e267d7f98b47843a4b88320508594eba7ca38e4ac8ecfea29c540fcd57c4affb3f39e3258c02ac42642408cb1cc08b14000de5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
e0b6d40b8eee565d97234339140e3333

SHA1
d10510e8f5986335fbf2a6cd732244224e9214fc

SHA256
844c84b8e029894255e8e8241c957889134893c9f743c00626a155bf1ad9f132

SHA512
3d487a562328b62d58f42d871e30c6eca42ca3845d72e96f75b152e7b2437ac8215f6689b7e69c686f899dcacbe8967fbd3813c66126085631b4366ea13796bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
b9a7da4ea6f72fac054a786551f80ea4

SHA1
eedbd606b989ef1c7bf8bded4a6b2dec53f3e540

SHA256
a2c34ea7624fb869fe740a52bcf6c9be6c07da3b86b03492f83cbd67ddaa46cd

SHA512
51ee1bdfb93b59e2efbcc2927063feec817c1aab1fb059f9f25b1f2a23fc8001d05778a70ea6589b862e035dc14dc71a1b3e36ab9b716f2f51e50d363ba21bb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
0034f7964206b0b4849946801053f822

SHA1
52087eb42513a84245f7f4534dab8a76bf3e159b

SHA256
50de91b4a4c7834992641e8adf61f0d68884aa5b3286dbb40ed64467a0c22d6f

SHA512
46aaeca2c5698194a9823856f09e23a0211d049d3704e938b2ba6ae941a8c4bb0fabd65adb47feb7be97d5f0b44cd6a85f514ecd6cae2bf648f3ed95d8cdbde8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\LOCAL\crashpad_4944_ELXWCXLDAEXLRBVO
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit