Analysis
-
max time kernel
1680s -
max time network
1685s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 18:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://validcdkeys.com/pc/game/palworld/
Resource
win10v2004-20240226-en
General
-
Target
https://validcdkeys.com/pc/game/palworld/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2124 msedge.exe 2124 msedge.exe 1988 msedge.exe 1988 msedge.exe 3428 identity_helper.exe 3428 identity_helper.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1988 wrote to memory of 4796 1988 msedge.exe 88 PID 1988 wrote to memory of 4796 1988 msedge.exe 88 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2288 1988 msedge.exe 89 PID 1988 wrote to memory of 2124 1988 msedge.exe 90 PID 1988 wrote to memory of 2124 1988 msedge.exe 90 PID 1988 wrote to memory of 3624 1988 msedge.exe 91 PID 1988 wrote to memory of 3624 1988 msedge.exe 91 PID 1988 wrote to memory of 3624 1988 msedge.exe 91 PID 1988 wrote to memory of 3624 1988 msedge.exe 91 PID 1988 wrote to memory of 3624 1988 msedge.exe 91 PID 1988 wrote to memory of 3624 1988 msedge.exe 91 PID 1988 wrote to memory of 3624 1988 msedge.exe 91 PID 1988 wrote to memory of 3624 1988 msedge.exe 91 PID 1988 wrote to memory of 3624 1988 msedge.exe 91 PID 1988 wrote to memory of 3624 1988 msedge.exe 91 PID 1988 wrote to memory of 3624 1988 msedge.exe 91 PID 1988 wrote to memory of 3624 1988 msedge.exe 91 PID 1988 wrote to memory of 3624 1988 msedge.exe 91 PID 1988 wrote to memory of 3624 1988 msedge.exe 91 PID 1988 wrote to memory of 3624 1988 msedge.exe 91 PID 1988 wrote to memory of 3624 1988 msedge.exe 91 PID 1988 wrote to memory of 3624 1988 msedge.exe 91 PID 1988 wrote to memory of 3624 1988 msedge.exe 91 PID 1988 wrote to memory of 3624 1988 msedge.exe 91 PID 1988 wrote to memory of 3624 1988 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://validcdkeys.com/pc/game/palworld/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffac72346f8,0x7ffac7234708,0x7ffac72347182⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,14267537361268086158,4238323310517198573,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:22⤵PID:2288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,14267537361268086158,4238323310517198573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,14267537361268086158,4238323310517198573,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:82⤵PID:3624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,14267537361268086158,4238323310517198573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:4048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,14267537361268086158,4238323310517198573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:12⤵PID:3504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,14267537361268086158,4238323310517198573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:12⤵PID:1612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,14267537361268086158,4238323310517198573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:82⤵PID:864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,14267537361268086158,4238323310517198573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,14267537361268086158,4238323310517198573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:12⤵PID:2004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,14267537361268086158,4238323310517198573,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:12⤵PID:2376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,14267537361268086158,4238323310517198573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:12⤵PID:4508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,14267537361268086158,4238323310517198573,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:12⤵PID:684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,14267537361268086158,4238323310517198573,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4588
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2372
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2424
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3560
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59ffb5f81e8eccd0963c46cbfea1abc20
SHA1a02a610afd3543de215565bc488a4343bb5c1a59
SHA2563a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
SHA5122d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
-
Filesize
152B
MD5e1b45169ebca0dceadb0f45697799d62
SHA1803604277318898e6f5c6fb92270ca83b5609cd5
SHA2564c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
SHA512357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize384B
MD50fd886c3069f708daa422c39af912ec1
SHA19a87c63182015e47f51048de94d2ac859f5dcbcc
SHA256e8c14aa8171503352677b2c9a767fff44d2ff39bf8d6790944bafb8b6db5a392
SHA5126a2d8f749c8454832d126cd922b170a22d9363819d1cf717e03f24080e56783c4d16066561397bacf064ab2c8146d72629975e8a46c1d1a778c74286beada761
-
Filesize
2KB
MD570884d182c1178e8ae3c4a4a35bb1e6c
SHA1edea9aaec36f81bddddaecad5fc7deda546ce9b2
SHA256652c39a42e564a117417c2b9310edfe4fe94542b0ad9b570067fa204ea245e20
SHA512aab830df7016545b91279f047430cf391ea9df9b5c0ac7a63042b041f0628eb93c2c1bba0195fa67264c175ab856a7660c256339edbeae34b12a6eb10ad77a2d
-
Filesize
2KB
MD54fb6714b421b20d2dd357b642f2ee022
SHA14c0c9bbd82fedc727a7ddd69960952c1bdd853de
SHA25655dee049df119db280a73cc7817453a0ae62f68b9ec57ce5c44714324726eda3
SHA5125dc7a33b719687909980fc9d0ea3619b422c2b4794adb83ec3784d9fe7acb18a8405362dbd6cb1826e9d061b856e28efb7013cbab40a5097150666a8cc9c4225
-
Filesize
2KB
MD5a175b375678d35bb418e9ebafd0bb1af
SHA1733aadaa7976593f0dfe593cff8848659e3d8aea
SHA256236c460afe1554fda88f7f51c40cf0c54f02ce5816b905f0152b1404a8a19312
SHA512fd9435ab8642226ed2e5ae79a2f524bf28ae1e2785955ed5c33f7ad4786b1de61540fb6c849df437479fc8a5cb581cb58b363f63abc87c99bf896f5880b810f4
-
Filesize
2KB
MD50007a38071cbb6e43e3546afb8e6bda0
SHA1baf50d21b09d4ef29ebe27ead86c7f93664b93e6
SHA256a8af4bb83115a90e01be20bc0866c501ab2d1397ebeafc546aa063661a231fc5
SHA512dcafaec83ef89a58d91099f4b8a8e8e766649da36513c708525923c31ed224165ace817605933b97bc62cb4694d5cc53bf1e1c0bc743a84a0482fc9d87e46943
-
Filesize
6KB
MD59bed2a84634ce2eccbb04d880d88e369
SHA1aac16d6980ec0a0d85e2623eaab2064a731fb7a5
SHA256a6124b5f1b49729a85792d96285de2d2f76d0b21b16dfa7e9731cd16f23df0f8
SHA512d5f4093f6a8fa3fa67a98c65cbd16e89f21721b9b909f6ef467a9c811b77fff993985775e280bc44fc75febf3602fd9c24e86524810dec72590c475c1bb911c9
-
Filesize
7KB
MD59c708b2f5b900601bae3278c914f4c5b
SHA1ce6293d3119a53e235c3736137ccad3d491f35db
SHA25653a294dcb24e898810de289d50108cc5163dbc0323d85398c4fad067f8c61e72
SHA5122af32de0dd0b84269d00a044644f0ffdea96af3c9f0908e0e28f8023f78db2daaba1412e879efc836cd0183d8460f4b89d582ed1a468e52ecb1f13395d66dcd3
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5e612e3bb43bab75a86c2141c561ae893
SHA1665055072265d40b4b613e6de7f0c10747d44c48
SHA256043f5ec2aa4b19c89a4f57d2c70418bf473f4c1e8e62c3cf9eac3fc9e11296ea
SHA512fc815718c33a401ef0d9c86a88ddbed5cc83a328f4651b7f6d11964387f5cd7b6fca267ca77850d2420cbd4b49b4a1dd2896ad26475e47836e6c52c6b312a707