Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
26-02-2024 12:32
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://steamcomunnutiy.com/gift/activation/feor37569hFvrba3
Resource
win10v2004-20240221-en
General
-
Target
https://steamcomunnutiy.com/gift/activation/feor37569hFvrba3
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1140 msedge.exe 1140 msedge.exe 2348 msedge.exe 2348 msedge.exe 844 identity_helper.exe 844 identity_helper.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2348 wrote to memory of 1636 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 1636 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4044 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 1140 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 1140 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4480 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4480 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4480 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4480 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4480 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4480 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4480 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4480 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4480 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4480 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4480 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4480 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4480 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4480 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4480 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4480 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4480 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4480 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4480 2348 msedge.exe msedge.exe PID 2348 wrote to memory of 4480 2348 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcomunnutiy.com/gift/activation/feor37569hFvrba31⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcde7446f8,0x7ffcde744708,0x7ffcde7447182⤵PID:1636
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12243752256213571985,10515395536246590266,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:4044
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,12243752256213571985,10515395536246590266,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1140 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,12243752256213571985,10515395536246590266,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:82⤵PID:4480
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12243752256213571985,10515395536246590266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:12⤵PID:4744
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12243752256213571985,10515395536246590266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:4248
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12243752256213571985,10515395536246590266,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:82⤵PID:4516
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12243752256213571985,10515395536246590266,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:844 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12243752256213571985,10515395536246590266,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:12⤵PID:4620
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12243752256213571985,10515395536246590266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:12⤵PID:3180
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12243752256213571985,10515395536246590266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:12⤵PID:4788
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12243752256213571985,10515395536246590266,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:12⤵PID:1620
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12243752256213571985,10515395536246590266,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5516 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4016
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4476
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3156
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a65ab4f620efd5ba6c5e3cba8713e711
SHA1f79ff4397a980106300bb447ab9cd764af47db08
SHA2563964e81a3b4b582e570836837b90a0539e820886a35281b416e428e9bf25fd76
SHA51290330661b0f38ca44d6bd13a7ea2ab08a4065ec4801695e5e7e0dea154b13ac8d9b2737e36ebe9a314d2501b5ef498d03c5617c87e36986e294c701182db41b9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5854f73d7b3f85bf181d2f2002afd17db
SHA153e5e04c78d1b81b5e6c400ce226e6be25e0dea8
SHA25654c176976e1c56f13af90be9b8b678f17f36a943210a30274be6a777cf9a8dc4
SHA512de14899cfaad4c312804a7fe4dcb3e9221f430088cb8bf5a9b941ac392a0bbad4e6ca974e258e34617bbffff3bf6490fa90d8c6921616f44186e267ddaa02971
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
456B
MD561b23cb3656acd034c7eca342ee6f0d5
SHA1678f45fc4c94a2e6f9b064356636eb7b03af5d56
SHA2561d9a9f201ea3cc33197487d8cd7225a5c2820dd3775dbfef1effa5b70eed85c7
SHA5128b989d6024f73f8635434a0125e527b48b30b7b94b3e13a93a0efb73244d16946f28539c17b5deaf95c2a4e0162390681e1be4b06379ad371311d809eed795ee
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
543B
MD5aa6cb4d4ea678a7b5e2f5533e154fb29
SHA16d99eeeeb0d9d06c9e0d9851e5034b6a19c62672
SHA256314cc27bca3abb6af43c3c97bf65b44007a09941695baf4ed647bd270b8a28b5
SHA5129dc857ec00c94027416f32fa48175d8b528b0cfd4276d1945c3f4a59b90361c45b10f33aa15c29aa17dfff6818d9282c35a87ad8c1c2fe4c56892569a3c15d9c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD53b2fbbc3a9cdc7cadb8c3342124d5d10
SHA145ecbaa5ae5fe5cfc1f8d1d562f5c38a6792cc89
SHA256bce3b2edfea63acc892d3411e57c0f4a9ccc98e2cb3252f83b99a985e9a96c05
SHA5129151488eff9d1d0cdf4a83676ac2c0573b163104b6dab48b68115f7d92e115ab65101b6d633923c3df455008a63beb5e90930e403fe301566bc1e53baf0f8e1b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD571ffe9ef172c942b1ebae744b09b46ff
SHA10d32032feb131414e6a2f24d928b95273bafa2ea
SHA2567d429627ce94f322c49ba6bc49f77e91a52bc0a5f23dc6eb58865e7673739942
SHA512398676dfd8dcf9f444bab594c0b85c1ae6b1c1cf28123b47bfaa7874a0907bd947f66f1a9ae073c4689e94333d3cdd4c4f03910ddf57c275bec79738a16cb5a0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD586fb269a99b028b636d46c556e5512c7
SHA14da932b8e640850b21536240693a5b0f31d00ee4
SHA256ca42331f90880bb46d410cd8e72dc470d9108833d83544d87ec59e1ac1b7cbd8
SHA512c3b8a6a364c5fcdb8b6c0db12f388715d35b948cd9b5bed210f1850672e300ab58d28ee398e3ad59185525e5736e8b0fb95c23d07da81eb589513316f53ffce7
-
\??\pipe\LOCAL\crashpad_2348_RJNIJZBXDHSOIHNMMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e