Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-02-2024 13:05
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://steamcomunnutiy.com/gift/activation/feor37569hFvrba1
Resource
win10v2004-20240226-en
General
-
Target
https://steamcomunnutiy.com/gift/activation/feor37569hFvrba1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 3012 msedge.exe 3012 msedge.exe 4756 msedge.exe 4756 msedge.exe 3204 identity_helper.exe 3204 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
msedge.exepid process 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe 4756 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4756 wrote to memory of 1896 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 1896 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3052 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3012 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 3012 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 4496 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 4496 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 4496 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 4496 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 4496 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 4496 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 4496 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 4496 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 4496 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 4496 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 4496 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 4496 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 4496 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 4496 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 4496 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 4496 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 4496 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 4496 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 4496 4756 msedge.exe msedge.exe PID 4756 wrote to memory of 4496 4756 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcomunnutiy.com/gift/activation/feor37569hFvrba11⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b42246f8,0x7ff9b4224708,0x7ff9b42247182⤵PID:1896
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2260,15637526660897113585,9936470675494260360,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:82⤵PID:4496
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2260,15637526660897113585,9936470675494260360,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3012 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,15637526660897113585,9936470675494260360,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:22⤵PID:3052
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15637526660897113585,9936470675494260360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:1216
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15637526660897113585,9936470675494260360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:1756
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,15637526660897113585,9936470675494260360,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:82⤵PID:3740
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,15637526660897113585,9936470675494260360,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3204 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15637526660897113585,9936470675494260360,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:12⤵PID:2484
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15637526660897113585,9936470675494260360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:12⤵PID:4176
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15637526660897113585,9936470675494260360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:12⤵PID:992
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15637526660897113585,9936470675494260360,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:12⤵PID:744
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1808
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1324
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5fd7944a4ff1be37517983ffaf5700b11
SHA1c4287796d78e00969af85b7e16a2d04230961240
SHA256b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74
SHA51228c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a774512b00820b61a51258335097b2c9
SHA138c28d1ea3907a1af6c0443255ab610dd9285095
SHA25601946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4
SHA512ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
456B
MD513623816fbe0811217606deb4c26c28a
SHA1777a3f2678a109e24271f9098efcac0489a92d38
SHA25620845afdbd218ab10b5501a424a30398d367962a8929b6c42df42b12618cd7b1
SHA512013d02709478f755f4ea31a4c468f3fdd9c817dd65de4d6fdae69521cf090aac6d6c0814d2c3f6c87fc842833d5dee15dcdd8965ea225a7e621df2940e239358
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
384B
MD509209b7327a3a231a120cc2da58b2efb
SHA1718448a2c0ece15ffad2ff4189faffdfdd6b0669
SHA256ee9db0d574d5d2d844c24369fb28f16716ebcbfacd1004c206e3d0d49dea046e
SHA512f56912c55fb079858cea990321bdccafcea92e520c53a6eb47972e142899dadcc3103b76d450937df5452e98ec5b661f6f891b148369709cb1077a5ae5ca2304
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
543B
MD5ef0e3e8b976c91d69fca224dcd57e21c
SHA1ee8a9454af5e059a93015ca2461fb1ed0f595c7c
SHA256d750324cfd75b7aec37c4c63cbcca363872712cc854d2d09a3a3a820c64cb5c8
SHA51253492e7a9c54181889b8773fec210254b93662fe351345715a387b1f2042f1d09d0fa690fc44a4ff9455ebef461e2039f547a5d3272a1e9d8826c6665bf460fe
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5f8f23663605590b86506124f7683d50f
SHA1707a864e7601b20072cf4abce40c2df039ab2fef
SHA2560d6863dbc234eac4cf106d5ae9f1e0bd0f615bad1ba075d512f38163171ca986
SHA5120b083b5651b56aa6d4cf18f33f57229f4e9b0d02c112b2420f1a0575b80dea175ec298aeae8e8e7ea47f0d754b8c44f5acae929099c8895acb5092675a0b846d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD55b8e9228fe6d0761d39e5738b2c689ae
SHA1f26d06ea4a25f3bcb51ba151ae9f9986e7f747f2
SHA2564e677fbcb6eab494277daa0298511dacac6ba2db1aed64d9258058f38ed0b997
SHA512b9ee072d509bbbee3a571850298cc13f190409b0b7e41908b50ead338ac376e83d39636487325265ad088564da76905b3b4c95f7a618e0b87e5e5b06f083b194
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5794b1c0229734ca909b6167c759a22d4
SHA110d94682a645de108ab85faaff8ac9fefd34aeff
SHA25644b5095e38f5f22e9d1418c8077682383066cd4c99a1713f2746b5ec556bef06
SHA51258d011ae988e9e5fd0cc5fc01bbe73bc30e23692a7c2ecf5c22f326f9ffcf174d92da8006f6b3a469342333a8e6158f272a2846c6a9e4228929ead4e728c89b5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD506e381c97b098300c38ea2fb0f6eac90
SHA1f320e14e34aa0f3b6b038d534ea2a9f95ebc37ec
SHA256c7d9951494805697e44bca101c3d78ea8ea03dc7d17dc2d74815bc4a27f4ea8c
SHA512fdbd3c24f5de78b4fafb4122962fac7d750980ea6d0074b36021ed26775ba8057b3d746bcf603a47b8940c0588711917d06e797bc1ece972f7ed83c970c20846
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD5a0d3e434e9f290227b83ea6f7b281562
SHA1e9e4a7edc744f7365be5ceeb58176d7813641a0a
SHA256321c2cc048be8f21a06f8b0706588e9958e88be38ee19f117622abe20444c94f
SHA5127826a9bac2721d2afddbe59c0aba1368db2df1a703f4e9336630d91afd30324d3fe943f1621def56bdef2b9be485bb1bb0c0982978fc02cd74e619663eb69c42
-
\??\pipe\LOCAL\crashpad_4756_MWPGXSYDZAFXQCLCMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e