hxxps://steamcommujity[.]com/104923960430529

Analysis

max time kernel
145s
max time network
139s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
02-03-2024 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamcommujity.com/104923960430529

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
5024	msedge.exe
5024	msedge.exe
3088	msedge.exe
3088	msedge.exe
1988	msedge.exe
1988	msedge.exe
2252	identity_helper.exe
2252	identity_helper.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3088 msedge.exe
3088 msedge.exe
3088 msedge.exe
3088 msedge.exe
3088 msedge.exe
3088 msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

msedge.exe

pid	process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of SendNotifyMessage 14 IoCs

Processes:

msedge.exe

pid	process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3088 wrote to memory of 2656	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 2656	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1940	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 5024	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 5024	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1272	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1272	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1272	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1272	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1272	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1272	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1272	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1272	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1272	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1272	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1272	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1272	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1272	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1272	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1272	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1272	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1272	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1272	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1272	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1272	3088	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommujity.com/104923960430529
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff19623cb8,0x7fff19623cc8,0x7fff19623cd8
2⤵
PID:2656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,4656831864227726920,15978576459081092975,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1948 /prefetch:2
2⤵
PID:1940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,4656831864227726920,15978576459081092975,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,4656831864227726920,15978576459081092975,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2588 /prefetch:8
2⤵
PID:1272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4656831864227726920,15978576459081092975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:2204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4656831864227726920,15978576459081092975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
2⤵
PID:1544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1936,4656831864227726920,15978576459081092975,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1988

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,4656831864227726920,15978576459081092975,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4656831864227726920,15978576459081092975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
2⤵
PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4656831864227726920,15978576459081092975,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
2⤵
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4656831864227726920,15978576459081092975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
2⤵
PID:3316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4656831864227726920,15978576459081092975,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
2⤵
PID:4124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,4656831864227726920,15978576459081092975,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5256 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3776

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c65e704fc47bc3d9d2c45a244bb74d76

SHA1
3e7917feebea866e0909e089e0b976b4a0947a6e

SHA256
2e5d6a5eeb72575f974d5fa3cdff7ad4d87a361399ffdd4b03f93cdbdec3a110

SHA512
36c3be0e5fbc23c5c0ad2e14cfb1cf7913bea9a5aeb83f9f6fcf5dbc52a94d8ccb370cef723b0cda82b5fba1941b6a9ff57f77ff0076a2c5cf4250711e3dd909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
5c3ea95e17becd26086dd59ba83b8e84

SHA1
7943b2a84dcf26240afc77459ffaaf269bfef29f

SHA256
a241c88bb86182b5998d9818e6e054d29b201b53f4f1a6b9b2ee8ba22dd238dc

SHA512
64c905e923298528783dc64450c96390dc5edbda51f553c04d88ee944b0c660b05392dc0c823d7fb47f604b04061390b285f982dfcc767c8168ccb00d7e94e21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
432B

MD5
dd8724810f120c18f3b5c74cd88fd814

SHA1
9458c9f2e29564d04719a37cbee5670ed8ca060a

SHA256
da33d56127313cfaea5890f5c3d68d9ac740d1a85f05e7d92f9331f1a3452575

SHA512
b1a19f38d6077b833fcbc20e1d43ef87ac264d30999d2e462ce0c7a849d1b74925541e250360ec8ffca56b44384572ac3c5dfb9e47feeb6fc1f850aa3fcd7f6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
787B

MD5
a38421a4d129088ecf6b02d64c43a084

SHA1
7745398e14d7db7c6301911e6dc1f2e819a3ffcb

SHA256
98d2810255e0ed36da3cb683f21f9f43826aa02f8ea3ad5e860bce6b2f310553

SHA512
3d556dfc9ef672b5a5ab47cb53250509a8dc3a9bffdb828f9c027aad3b12502c6cb800cfcd913eabcd5a5053d2cd3e3daf3a6f987820063ad24f264ef6afb233

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
8893f8d55076ee640be6e73ff2d6c1a5

SHA1
00797c481da65d0573070dd4a8c17c7d3d5a6d55

SHA256
ea2219127b5c77d4c0e5b003224685962d2962b8742bf1b866945f0c9c5fc153

SHA512
4b8f2a46a4525a6c1699d1a3f19bbfeb28c20972c7a4da006809087a68777ca2b238f6bfa9ce3b3469f0569bf2492b1017de9d6a6ce0d20b47fa79598ee51f9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
f12d17161b05fd22e9678c893cc9a350

SHA1
81364da0da1ee91e6d468da3ad0eb66e49a21e55

SHA256
4d5f505cc02b823a49fc82696bc6056e10169a5ab1bef749874de997e9d45047

SHA512
e144f536684528ace3e98907f9d30a0dfc43e834e506dac3f9b780e96b21fe506a5418ab177ff823ad2f544c4decb33ddcf7a91a4aab07ed05fdf16b2241f361

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
69d70b53ec11872a29fd4b38da9c83fa

SHA1
583ea5e2d32be8a9274483a210989b9cd95686a7

SHA256
5a4888640bf3569a476a508e55b9542a9f6056368fb4354b3fadb29e5ccdd563

SHA512
627808db9e711d864d96e511faf94f227e3b5913c5b4429d514a0fa2fce96e9c94e21f97149731b242079874d693ef31e0f51964b1246736ec707463f7ddc76c

Download Submit
\??\pipe\LOCAL\crashpad_3088_OQCGTWJAMNDMXQFS
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit