Analysis
-
max time kernel
146s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
26-02-2024 12:25
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://steamcomunnutiy.com/gift/activation/feor37569hFvrba3
Resource
win10v2004-20240221-en
General
-
Target
https://steamcomunnutiy.com/gift/activation/feor37569hFvrba3
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2800 msedge.exe 2800 msedge.exe 4944 msedge.exe 4944 msedge.exe 1012 identity_helper.exe 1012 identity_helper.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe 3504 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4944 wrote to memory of 1816 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 1816 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 3332 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2800 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2800 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2384 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2384 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2384 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2384 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2384 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2384 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2384 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2384 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2384 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2384 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2384 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2384 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2384 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2384 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2384 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2384 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2384 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2384 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2384 4944 msedge.exe msedge.exe PID 4944 wrote to memory of 2384 4944 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcomunnutiy.com/gift/activation/feor37569hFvrba31⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4f3546f8,0x7fff4f354708,0x7fff4f3547182⤵PID:1816
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2800 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:22⤵PID:3332
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2508 /prefetch:82⤵PID:2384
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:796
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:3040
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:82⤵PID:2684
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1012 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:12⤵PID:1708
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:12⤵PID:3404
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:3100
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:12⤵PID:1124
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,1896964989928079487,8068928807915111159,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3120 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3504
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2588
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3200
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d62cefeb0c8fbab806b3b96c7b215c16
SHA1dc36684019f7ac8a632f5401cc3bedd482526ed7
SHA256752b0793cf152e9ea51b8a2dc1d7e622c1c1009677d8f29e8b88d3aa9427dd01
SHA5129fc3968fec094be5ca10a0d927cb829f7f8157425946ebd99a346b7e63c977cb3f37560af1a4bc8f87ab19b43b3ed86fd5b37f89d1a9b2dc86e3c73142c3065b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57ee1c6757da82ca0a9ae699227f619bc
SHA172dcf8262c6400dcbb5228afcb36795ae1b8001f
SHA25662320bde5e037d4ac1aa0f5ff0314b661f13bb56c02432814bffb0bd6e34ed31
SHA512dca56a99b7463eddf0af3656a4f7d0177a43116f401a6de9f56e5c40a49676cea5c38b6c458f426c6bff11165eec21104cfa9ca3e38af39d43188b36d3f22a0f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
456B
MD577b85c65f324bd65293d715b5ec4d179
SHA1fd278503db07ac5450969a1efae84549ee8c4d23
SHA256251f5e6e64267484ae53657b01c4e780dbb07497f0c534b9e18494a48ccbd985
SHA512ba9ee79a869aa13373178852113a5c030f23a092216e5d7e3e381bf545deb327477386b2d588fef617767298045b8dcf25fb0b8f33466c40e6de922fd5251978
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
543B
MD50e0d0d03601d451c17aaa67132124eba
SHA10bc9e940103fcb927085fac3501bdb06e496758e
SHA256af18d065d9465a169f8694ff3b6dd70a2e2eb80914748f2f679ca0baacaeedcf
SHA51255b4986dc478211d64da346573e267d7f98b47843a4b88320508594eba7ca38e4ac8ecfea29c540fcd57c4affb3f39e3258c02ac42642408cb1cc08b14000de5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5e0b6d40b8eee565d97234339140e3333
SHA1d10510e8f5986335fbf2a6cd732244224e9214fc
SHA256844c84b8e029894255e8e8241c957889134893c9f743c00626a155bf1ad9f132
SHA5123d487a562328b62d58f42d871e30c6eca42ca3845d72e96f75b152e7b2437ac8215f6689b7e69c686f899dcacbe8967fbd3813c66126085631b4366ea13796bf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5b9a7da4ea6f72fac054a786551f80ea4
SHA1eedbd606b989ef1c7bf8bded4a6b2dec53f3e540
SHA256a2c34ea7624fb869fe740a52bcf6c9be6c07da3b86b03492f83cbd67ddaa46cd
SHA51251ee1bdfb93b59e2efbcc2927063feec817c1aab1fb059f9f25b1f2a23fc8001d05778a70ea6589b862e035dc14dc71a1b3e36ab9b716f2f51e50d363ba21bb2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD50034f7964206b0b4849946801053f822
SHA152087eb42513a84245f7f4534dab8a76bf3e159b
SHA25650de91b4a4c7834992641e8adf61f0d68884aa5b3286dbb40ed64467a0c22d6f
SHA51246aaeca2c5698194a9823856f09e23a0211d049d3704e938b2ba6ae941a8c4bb0fabd65adb47feb7be97d5f0b44cd6a85f514ecd6cae2bf648f3ed95d8cdbde8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dicFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
\??\pipe\LOCAL\crashpad_4944_ELXWCXLDAEXLRBVOMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e