Analysis
-
max time kernel
600s -
max time network
589s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06-03-2024 16:40
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://steamcommujity.com/gift/906353439838
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
https://steamcommujity.com/gift/906353439838
Resource
win11-20240221-en
General
-
Target
https://steamcommujity.com/gift/906353439838
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133542171891115802" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 916 chrome.exe 916 chrome.exe 3692 chrome.exe 3692 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 916 chrome.exe 916 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe Token: SeShutdownPrivilege 916 chrome.exe Token: SeCreatePagefilePrivilege 916 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe 916 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 916 wrote to memory of 5056 916 chrome.exe chrome.exe PID 916 wrote to memory of 5056 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 760 916 chrome.exe chrome.exe PID 916 wrote to memory of 4188 916 chrome.exe chrome.exe PID 916 wrote to memory of 4188 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe PID 916 wrote to memory of 2516 916 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://steamcommujity.com/gift/9063534398381⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8d6b9758,0x7ffa8d6b9768,0x7ffa8d6b97782⤵PID:5056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1832,i,17736639979376860678,16404361452725929173,131072 /prefetch:22⤵PID:760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1832,i,17736639979376860678,16404361452725929173,131072 /prefetch:82⤵PID:4188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1832,i,17736639979376860678,16404361452725929173,131072 /prefetch:82⤵PID:2516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1832,i,17736639979376860678,16404361452725929173,131072 /prefetch:12⤵PID:3552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1832,i,17736639979376860678,16404361452725929173,131072 /prefetch:12⤵PID:1556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 --field-trial-handle=1832,i,17736639979376860678,16404361452725929173,131072 /prefetch:82⤵PID:2816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1832,i,17736639979376860678,16404361452725929173,131072 /prefetch:82⤵PID:5044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3304 --field-trial-handle=1832,i,17736639979376860678,16404361452725929173,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3692
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2908
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Filesize290B
MD5c98b1a1ab477bfde35dc44d28b28a62d
SHA126cd3b57d44333576099d605f58dcbf183d268c3
SHA25640a5e790698e64912b3dd4acc3a15ebfadc08266d48c4d2d8f333687d8d304ad
SHA512c91d59fd4d9bca07a57d94d52401f608a2d5a0e4d899bb1918e0588ee96571f46f4cbfd80a15285dfe6d7788d9aae18616b85eed2c1fa9fc2d56da871c5d5688
-
Filesize
648B
MD5880057277048ac8aa7e68ba1a56f907a
SHA1ade27b0d8d5b0d72f8cadaaff484466666f213a4
SHA256ab9cf3c030cb161e24e95aed50e471ce5300aa695841421176efdc89eba3d77a
SHA51233e0419f11b3f17f8cd81b1db303a5b06706c041c5b8f44d7f0d9b5a07516c99ba6ada78bfaf04988198193289329656a832c096be1e29384e354943469de4bf
-
Filesize
2KB
MD58d540fb3f353ee05326734828d731fe2
SHA12579c80698b65c379d9d521b15b0578a174b2507
SHA25637c2832793342090df307dcef759127827692f71eb9486bdbe3ed2af14435833
SHA5123181f228a1dce95b44e3d6762b946900b08f84b5431a573b6477abc01e658a323813f6532e920ffe80489f1348a65aef1c5f862f5c3fc8b6997463e43c29d43e
-
Filesize
874B
MD5d23444eefc89a2b096aa5bdcc24c5afc
SHA139e00fe57a6e0725babb7e48ebcc504bf027ce3c
SHA256082180b2aede68c0f611a4ba9fc7aaf3b166f7fe67b065776c6fd22e1569a2f5
SHA5129a815bce9cdcf9aa04279d624de911f9f9225ae00edd0f901ce88d8e8056daf628d05a083fbd026bc4163462a625746b39dc0961bc81657e0fe7916f0b916796
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ffb42511-dadc-42e5-a328-a77860fc7a81.tmp
Filesize2KB
MD5d13869e849e94c3f5ac63c1b55d9b435
SHA1dbcaac323b8a40c2f924131a5c4b7043828b3020
SHA25672b92c25fb75e4a2f11b12492195d21cb155b248e7dd371b812436f6623eabfa
SHA5127e0eec4df765ba6c29c2b7ae0fac15973ab45d104f7a2fd0087348855eb52a1395d8751f9ccc52b69d5c9533257ca75f7e08087a2e1023dae2c123a154329a3c
-
Filesize
6KB
MD5609f471b3bc3a5d85d4adfb5764921a0
SHA1e218b9beab1e0b3c188b8800503ae5fb0d7b2cac
SHA256acc3b9ef2fca19a894538607033c2ee96ace92ec13c65e53069968899def0538
SHA512c525fbeb7f9b6e1b2d757f94b5a564e829c7fdca2beef93539b7596ab372cb16c9acbd5ed9dd0a0723c89fa46e114b17d514520c66d8df8bb8e72c228f3c45a3
-
Filesize
6KB
MD5f5470ccf017b4c99c0798d257f8adfd9
SHA1f0930943bc2efa5206a73e9dc1b0c9cbeb59625a
SHA2565850f2d12822ef3a521b89b67b7671c80a75235b661a12a5c412f8be227cd9e7
SHA512f6dc1112cfbb3e07a1de592ab647c5d909672e96f4702ada7911d21680a267aa7d7b51c797803751d0973b638b51b6d4782bd12b45367b60218653e0e910deee
-
Filesize
6KB
MD555ec6b9d77467f69cea5010f5a7c39e8
SHA18d4a3710444f6b719aa278229e404da2139f450b
SHA2561b0f72a48db12c0153f76c2253fb6429a720fffeddfb048c3293c92742c60ab1
SHA512a01008465f7cca295d097cc7bb093a9d39a080a5f68e4a713c199c66fd000801cffddbd56cb1b91aadf530c9d61dbf8a05bd023ecf9e6c651e1476b79bcf7e39
-
Filesize
128KB
MD595dce1cf7990d2834a84080b92ee9f97
SHA19531d3fd9a623b7f9500d32e4111994bcd9d3dc0
SHA2568249139054b5dcf6e4120e4b08c79839bff60376de8dd9a9380a4ad6e5e9efb9
SHA512cc4bac7dd67518b36c856c43a72d4304da67077e7bb42a9d8464f4841d37b4595e4602aa0f1a22acca816af07efcdb1c83e36f119d271d2f9273d7e9ae6366a4
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e