hxxps://steam-card50[.]com/gift

Analysis

max time kernel
49s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-03-2024 16:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steam-card50.com/gift

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

1152 msedge.exe
1152 msedge.exe
3012 msedge.exe
3012 msedge.exe
388 identity_helper.exe
388 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3012 msedge.exe
3012 msedge.exe
3012 msedge.exe
3012 msedge.exe
3012 msedge.exe
3012 msedge.exe

pid	process
1152	msedge.exe
1152	msedge.exe
3012	msedge.exe
3012	msedge.exe
388	identity_helper.exe
388	identity_helper.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3012 wrote to memory of 2180	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 2180	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3712	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1152	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1152	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 4868	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 4868	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 4868	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 4868	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 4868	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 4868	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 4868	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 4868	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 4868	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 4868	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 4868	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 4868	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 4868	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 4868	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 4868	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 4868	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 4868	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 4868	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 4868	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 4868	3012	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steam-card50.com/gift
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8595b46f8,0x7ff8595b4708,0x7ff8595b4718
2⤵
PID:2180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,17448721284195648874,1303494391617265434,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
2⤵
PID:3712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,17448721284195648874,1303494391617265434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,17448721284195648874,1303494391617265434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
2⤵
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17448721284195648874,1303494391617265434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
2⤵
PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17448721284195648874,1303494391617265434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
2⤵
PID:3760

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,17448721284195648874,1303494391617265434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
2⤵
PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,17448721284195648874,1303494391617265434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,17448721284195648874,1303494391617265434,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5172 /prefetch:8
2⤵
PID:1512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17448721284195648874,1303494391617265434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
2⤵
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17448721284195648874,1303494391617265434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2264 /prefetch:1
2⤵
PID:2152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17448721284195648874,1303494391617265434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
2⤵
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17448721284195648874,1303494391617265434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
2⤵
PID:3308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5088

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
624B

MD5
15d6f46a3526472d3122a51bc858c489

SHA1
ad4e6ca35646ff26c3a04c56f89ed4826657daa9

SHA256
0a12c319d082c4ae7e660c8e5419524c660a3f3db54bded6f8117106079675bd

SHA512
00b01502d228104c5f966d522667e6a097bdfb0472cdb1568dc2485364df11b206d4b9e357a2ad450ee0fae45fd140589cd4d1a8ac9d887ac45e0b760b3dd0a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
92bdd78aed102de801e8970a50b03abd

SHA1
f4adfe78f6d9f406b67cd345e7ef64146af94a01

SHA256
9efb74650713376f734b9528e4fbd33b05170b980f4c4cbf9d8442239f533061

SHA512
616c90839d97e88bcd3a0acb2f509b616d7a2873b421e0428dc7120ce13711e903d087bbc6c981af91ffe098e662d23947711b60764e15bc68c88c3168260a43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
159cd6e7b368ffc249cb32d638000642

SHA1
a1a6b298c0cacfd2b0b3459adbd4018624f5ffa5

SHA256
4b626af224b9c099e8a548cc8df5bc5b797681e670fde7c63fd92c333500dba8

SHA512
a7b031494642c7b0dd392a8fe9a2e19e92211a99093789836aed1f80f26813ecd151990f10c297424f4e7eac0b72fa3874dffa0df1d03fc9f329a4ec39e9b6ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
dd4ddbd564c6d1ed6fad8e7e7b383a01

SHA1
5cb2a68037ff586b43aa1f53a8478f0cd0a625f0

SHA256
ebeb65d3400dd119500519e513ad9a0fe8fa5a0b8c9ded40570c3a059205c9fb

SHA512
14079635df899c879c26cbe853aeca8d14f8fe88dfafd4618725f89e430932e54dac0df1a469a1fd50cc37c88045d751117e6073b2e0e1f8758d827b54e31528

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
ec2697a6775e3e2337b29e2cf13c23e0

SHA1
c8cf65af7629045967fdda0cbeccff4144701423

SHA256
fbc3a2521ee9184bfa932288de615a6883a34bd743dac4da16fca00f0e852791

SHA512
bfac5b9c120348c78a84f9f42c40b352a168d6775cca69008aca18e40ffea4ff70a1969f8e9bd54bc878671e1e2831c627c07828e6860c10c1bf43353d06b08a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
253b20c9df06c90015d10b227d132695

SHA1
48e7fed1c262601f449e32f6a56fd8079ce1947c

SHA256
528907f0798ba0cdb81772de6f54fa6335b649792a5f438a1cbbdbd10e7c20f2

SHA512
30cc8409f58e6841394e2e4c6b443ca429c5049de28bfbb015de4780cf9d13b30d3cf774a181a60fb1ad22bc2b51838d29e1f461ab98fb4ab1405d47d15e9b61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
e7a5260e8f2003ebdb7feaa801dfb6bb

SHA1
c99bcaf5f3e4048389b42d5877d7709ee84ee9e9

SHA256
92e27ab99b6273c4da633c84f5f90f34d34046c141021d5831bd5ebd3da49fac

SHA512
599ef0baa6173588b55750f175e67bd4136aa13f423de941affe182fb24b6593b3c6eec1c89c0607d024c282c7e9f46588cf28fbc5f6c646243137c635a31bef

Download Submit
\??\pipe\LOCAL\crashpad_3012_UGCRQJHRULBWHRPM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit