hxxps://steamcommujity[.]com/gift/906353439838

Analysis

max time kernel
599s
max time network
600s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
06-03-2024 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamcommujity.com/gift/906353439838

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133542173498105427"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

4864 chrome.exe
4864 chrome.exe
2800 chrome.exe
2800 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

4864 chrome.exe
4864 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	process
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4864 wrote to memory of 4992	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4992	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 4788	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 2184	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 2184	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe
PID 4864 wrote to memory of 3916	4864	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://steamcommujity.com/gift/906353439838
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffc84069758,0x7ffc84069768,0x7ffc84069778
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1768,i,3317662027378965485,15248913906202034026,131072 /prefetch:2
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1768,i,3317662027378965485,15248913906202034026,131072 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2156 --field-trial-handle=1768,i,3317662027378965485,15248913906202034026,131072 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2904 --field-trial-handle=1768,i,3317662027378965485,15248913906202034026,131072 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2912 --field-trial-handle=1768,i,3317662027378965485,15248913906202034026,131072 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 --field-trial-handle=1768,i,3317662027378965485,15248913906202034026,131072 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 --field-trial-handle=1768,i,3317662027378965485,15248913906202034026,131072 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5016 --field-trial-handle=1768,i,3317662027378965485,15248913906202034026,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2800

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3ccba4a9-feb7-40ae-9234-19868b9a49cf.tmp

Filesize
6KB

MD5
8932a7d2fe19ed5809983826b06cafb5

SHA1
cbacb663a9afe1b9597010cdcab79f651d439226

SHA256
10b6be7a15c7ab366c4d424870971b07a80996e65d8b89d87c42519ed179f2ee

SHA512
59237a3ecfdfb0b8e3e88e45fc293eb5420a2245854500a5701e807c01cca40f52f73a83a209a82c62a34d91039b86e27a4fc9bf807f756a3cb36172e3381493

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
6ff17157c1b71b71d3783d5fe036b630

SHA1
e8e7a2df23a197616917f3b20237c815df287182

SHA256
9ee6729577c79fd8b25b4b782bc5df7f19c989d0b1233bc32bef563587f5adc0

SHA512
074ebeb9d1cdd1d3a8fa177d77c182efa0c906dc582e4f9572c928524a8b81e2c3ae6e2585b0c24b9086d5907245de228f86a68e6ae5e7565aa2b0e2672f7e81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
6431aba46d15ff2a7c25e37262adacd9

SHA1
c0a9954fde7f0b843241c17982f993ecf47da180

SHA256
e8d13490417d2cc9e4f8c8bfa752d6b7d10e8a4978c90d37c13d092cb934e840

SHA512
2d2d8bfbf9fe906025781437e70153279ac7080148d11df79d2e0ada448cf18ef9e158020380c83a27ae8a58e2968e53955e23718dd976580a1f5141d496ef79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
6e03bc1387e0377e8d15ade5865ca70a

SHA1
fa82c942bb576db9bb37b51eea45ec2360b72465

SHA256
960b6b8319174cc9f9961653539ae3804f8507c84f56e369900f3742218cc859

SHA512
2fb5bc9f5064b729516e5cfcd7263c544b2a5e07ad1b335c09b9c6fd0ec9547f7347625f557f3ea460292c8459f7fd6e8f97e9a88e25eef50f4911ca2c1e759c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
874B

MD5
c22883e09111a1cf50002b2ed50bd19f

SHA1
1e68e03355e79e676162899ff987ed357a729c80

SHA256
c7ce5c771aa7a3368821a2550af500e12f56ecf9503d4ab97a10d72810a298e5

SHA512
4a04e4ac9fff4fef66e351f028a8987ee0ba5869a20079995b8d87547d0f273b0d34db527418f35c402f47e592fb13aea58ab10f9737e84703c566dce4185c50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
a0097674a30ec47ea57507cc7069f017

SHA1
83af1c4eb583361ecd9fa25d531158a4a688b0df

SHA256
f38566758b6c884a7c8022902d2398a1d8f57c5e1a37eecdc7d8474a46925025

SHA512
d326bc31559aa99c904164ec1b1d72ff58ac62acaf40c2869d796e3ba2de6a4fa22853b2995f1039ebd020b514548b1b7f5404ed90fcef06f25eb8f12ce92cdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_4864_DSMMTDYVBDEJHJHQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit