Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-03-2024 15:36
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://steam-card50.com/50
Resource
win10v2004-20240226-en
General
-
Target
https://steam-card50.com/50
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3924 msedge.exe 3924 msedge.exe 4876 msedge.exe 4876 msedge.exe 3152 identity_helper.exe 3152 identity_helper.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
msedge.exepid process 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4876 wrote to memory of 3928 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3928 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 1480 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3924 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3924 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3032 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3032 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3032 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3032 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3032 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3032 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3032 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3032 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3032 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3032 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3032 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3032 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3032 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3032 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3032 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3032 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3032 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3032 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3032 4876 msedge.exe msedge.exe PID 4876 wrote to memory of 3032 4876 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steam-card50.com/501⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3bcf46f8,0x7ffa3bcf4708,0x7ffa3bcf47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2292,5363134201097880459,10169081499680011681,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2304 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2292,5363134201097880459,10169081499680011681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2292,5363134201097880459,10169081499680011681,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2976 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2292,5363134201097880459,10169081499680011681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2292,5363134201097880459,10169081499680011681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2292,5363134201097880459,10169081499680011681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2292,5363134201097880459,10169081499680011681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2292,5363134201097880459,10169081499680011681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2292,5363134201097880459,10169081499680011681,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2292,5363134201097880459,10169081499680011681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2292,5363134201097880459,10169081499680011681,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2292,5363134201097880459,10169081499680011681,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD59ffb5f81e8eccd0963c46cbfea1abc20
SHA1a02a610afd3543de215565bc488a4343bb5c1a59
SHA2563a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
SHA5122d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5e1b45169ebca0dceadb0f45697799d62
SHA1803604277318898e6f5c6fb92270ca83b5609cd5
SHA2564c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
SHA512357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
648B
MD598878a98cf9fd5eabeffc840ac2dedc7
SHA121507033c3c589d151cbfa777e0337d3e9e96314
SHA2562c6f17748dd38ee8005e1380fe77060dfa1629b4f6f76b59a492b3ea046e0609
SHA512450353ad0f208fd8a5c8684570cd10ca3e3faa9b6c5e6bd631e96c8d9da9a57cd5907258a590681171f1c7fadee0558505294ee7aa94c77c1dfb518412c38e0c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
989B
MD5379e5fcf660fbe125d54454289c8c58d
SHA1630da1e96f4bee7e69a4cf7d56edfba613b32d12
SHA256e48fdfd3b80e63c02840b63ea2765aad39a546456da25a36772ffadd8f439678
SHA512124a372d2a82ba42bcb40cf867d89cbfd350e0a49b99d1421b670986a4040298da2acdcd1dc944675813726bb384a1f0eba58c3f1b1d45a3f72ff96011aec192
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD557267b04ab8879683467ce917dc17cd0
SHA16fa12ada57e629c00e070d2d701804b5498dc207
SHA25693aba88aff076b49de6e24b55f6731cb86d7b99fbc4275e9a4d3217f6dfa817c
SHA512b14e9814d4f37e69cc708efa6b254d018140c965b30049dd5f1b722f22968568690a00158271728f35a7ae53d4f4164e7067ce0a055854564cb155831eb7e780
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD57bef4703cf1ef299da592951c61adacc
SHA11cb61c03ced9a910546b4836f7f00dc4584453f8
SHA25667afd9f950947e4822579d2ee71be08adb18ec3d56b526ebc88c0b1097601366
SHA5127281beb30147f43edeed5b242587f5b2d69832fb70ba47844bc643a50d564ef42f2d2aff3d3e9370169a8997a7787fa39325d412d79a3f8dd36511940d0b6fcc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ea0f926f-726c-4584-a361-593800d8847e.tmpFilesize
6KB
MD55c98decc779add89da2cca96a5fb32a5
SHA1b41119c7f8f2793af87fbc951e6adf891ccafe83
SHA256c8d51841f0330b9ef0654965f2eac0efa529f83ace27b125845bdb3fef1bec6e
SHA5123e18f6c17c776fb449442d6cfcb25c2dd482d95b3d130d49f9378fdb43ee1ba0de26cf5926525b6547711aeb239528f47c3eaef4b243dbf00134eccc4fb87217
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD51b2724984b05dd54e30966345acc3eb9
SHA17dab094371f015f07dac99f354925f8febdd3bd9
SHA256163806aee7445692ae78a59e36bcd08677c4b9682af525cf4b857c1a6ecc342f
SHA5126cc6b6db99a6d0c37c471c19019e25e9b18fc5c60eaa19a937ce766b75f182d89011c2566151d46d5eb07e48e166c67a96d9b2d600aba85904e417deebf1eb4b
-
\??\pipe\LOCAL\crashpad_4876_GUNMFFTVNUNCCASMMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e