Analysis
-
max time kernel
65s -
max time network
66s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-03-2024 04:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://steamcommunijty.com/gift=7250687445
Resource
win10v2004-20240226-en
General
-
Target
https://steamcommunijty.com/gift=7250687445
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 3204 msedge.exe 3204 msedge.exe 4936 msedge.exe 4936 msedge.exe 5052 identity_helper.exe 5052 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
Processes:
msedge.exepid process 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4936 wrote to memory of 3048 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 3048 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 4300 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 3204 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 3204 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 2768 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 2768 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 2768 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 2768 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 2768 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 2768 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 2768 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 2768 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 2768 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 2768 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 2768 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 2768 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 2768 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 2768 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 2768 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 2768 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 2768 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 2768 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 2768 4936 msedge.exe msedge.exe PID 4936 wrote to memory of 2768 4936 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunijty.com/gift=72506874451⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe4,0x100,0x104,0xd8,0x108,0x7ff8bd1546f8,0x7ff8bd154708,0x7ff8bd1547182⤵PID:3048
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,10488340872954658015,1684728575751855263,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:22⤵PID:4300
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1840,10488340872954658015,1684728575751855263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3204 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1840,10488340872954658015,1684728575751855263,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:82⤵PID:2768
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,10488340872954658015,1684728575751855263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:3828
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,10488340872954658015,1684728575751855263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:4552
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1840,10488340872954658015,1684728575751855263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:82⤵PID:1468
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1840,10488340872954658015,1684728575751855263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5052 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,10488340872954658015,1684728575751855263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1796 /prefetch:12⤵PID:1468
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,10488340872954658015,1684728575751855263,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2772 /prefetch:12⤵PID:4668
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,10488340872954658015,1684728575751855263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:12⤵PID:4024
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,10488340872954658015,1684728575751855263,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:12⤵PID:1572
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1188
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD59ffb5f81e8eccd0963c46cbfea1abc20
SHA1a02a610afd3543de215565bc488a4343bb5c1a59
SHA2563a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
SHA5122d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5e1b45169ebca0dceadb0f45697799d62
SHA1803604277318898e6f5c6fb92270ca83b5609cd5
SHA2564c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
SHA512357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
648B
MD5c9f90ed44101c6bf32d1d1318618ae87
SHA1abf0c917d3c42b3d56bb0a90db6bcaec3a1b8550
SHA256722f23a62d97392ae7286fa0355c03f392fbad5b645ecde9c28bb8899ff3b4f9
SHA51298b7cff2e8e5da1ad675bf1589069d1abd94183ba1a11f34bb9f20c0601dd72a48493f4e3b2b9ae56ee2a49168a4d0050a791155be28e8979e30f98b4d798765
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5e9eee2b017915a83e82cc3e3e55d8bc3
SHA114ceed55e43787005b7976a6ce8c9c4faaae1885
SHA256884dde794cf9bbfd0e5d48e64de58100805daf23deaf502ed91b06cfb4d9bcd6
SHA512b7acc72b15424457183868fdd4a0804b93e876ab0b2326b8d06edbec42895a836671ccea4b32d683a03c84b76c98ca7303dec0106fcb5ebeff4bb2eab372f8b5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD553bed0532f51edfaf6c816bf2ae45411
SHA1485cb9f18cf37eba25793346edba2ede0d6c6dd9
SHA2561d4864a3c55be7e8729bbaa100bbfdec58e3fd7e28fe9196f919412ba9ebbf1d
SHA512ead4eb5807bad893b92c3a747bf576cf6cd3245c007f90b1e8a4b39a5fbe045ab2a705cefeca0a91a7fdc32685d460e79fe752b14c8cc6cbcbd28a81a53d2d07
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5e5c66ffd8305584d857bc3bd596f866f
SHA1910227b07a3f23907a41b1e3992f324214803e6c
SHA25688436c8ce4046803df77e9629a90823c4d7fd9f1ec69e551d5427d5b7dbe8ce7
SHA512be3bb5695ef0abb3b4e32374874accff6d3732d3ac125ead283e9c911593e9965bba8ba5c25f9503b370c9d0ca8ec3b6fd3585187ac23b3e35c8c3d30b58a7aa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD526b93ea966ef1320f1071ed59c1a5c88
SHA149ba6a31ac648c34df9001d57f98edc9c638a7c4
SHA256888a4978446c48b2b3e976cd4c5b0d39a362122e5b3e9ea1fa77db121d442c5a
SHA512faff37080b8df4d10138ef99d7c9ce1f1dc3ca62088bf8f6cd8be1bf3004e5edfe11e6f0684a5503c6453b4e05c6190b97f204dbc5f269b0e624fa8e91a47398
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD5def1e00809bbaa6a1f3dc69d39c674b0
SHA1ae8643ff41da175a7736a8d37aacc96e5aa0bb8d
SHA2567bd6f39819c2d6f98e2b702fd81db33d4b6f2ca1fdc8fe23790eda830652a7c0
SHA512e8b8149976f907a00c8ffb3b0f014765219bcdc60b180ed9a779f9d394c6754f43698036183dc936fdc1f36d0f0c3e94f4269d40260f3e28e1c3ee48e627bc4c
-
\??\pipe\LOCAL\crashpad_4936_IKLPCYXJCXZAFLCSMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e