Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
09-03-2024 19:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://steamcommujity.com/gift/76566894433982450
Resource
win10-20240221-en
General
-
Target
https://steamcommujity.com/gift/76566894433982450
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133544880015505431" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 300 chrome.exe 300 chrome.exe 3064 chrome.exe 3064 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 300 chrome.exe 300 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe Token: SeShutdownPrivilege 300 chrome.exe Token: SeCreatePagefilePrivilege 300 chrome.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
Processes:
chrome.exepid process 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe 300 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 300 wrote to memory of 2996 300 chrome.exe chrome.exe PID 300 wrote to memory of 2996 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 1864 300 chrome.exe chrome.exe PID 300 wrote to memory of 904 300 chrome.exe chrome.exe PID 300 wrote to memory of 904 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe PID 300 wrote to memory of 4320 300 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://steamcommujity.com/gift/765668944339824501⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb61a69758,0x7ffb61a69768,0x7ffb61a697782⤵PID:2996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1668,i,11201955911278120495,17099679968062041976,131072 /prefetch:22⤵PID:1864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1836 --field-trial-handle=1668,i,11201955911278120495,17099679968062041976,131072 /prefetch:82⤵PID:904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1988 --field-trial-handle=1668,i,11201955911278120495,17099679968062041976,131072 /prefetch:82⤵PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2936 --field-trial-handle=1668,i,11201955911278120495,17099679968062041976,131072 /prefetch:12⤵PID:4796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2944 --field-trial-handle=1668,i,11201955911278120495,17099679968062041976,131072 /prefetch:12⤵PID:4736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 --field-trial-handle=1668,i,11201955911278120495,17099679968062041976,131072 /prefetch:82⤵PID:2348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 --field-trial-handle=1668,i,11201955911278120495,17099679968062041976,131072 /prefetch:82⤵PID:588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4408 --field-trial-handle=1668,i,11201955911278120495,17099679968062041976,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3064
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4956
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5bf261c6999dde98aef6ff2aaf046427c
SHA132cf991c67bb4c09439cd042f5317f549f05dd65
SHA25628284fe473687df4d2efc9c712075ffc84064d9eb63138cd00ff8e4a434725b2
SHA512ddd1fd8497b430c9c9be846868d2ca9bbd7ddaab9b27d9e3b5f512f328b02b7e30532060a8a6bd297664a0d53d83c0be486c134b2d1dbad882d56bf18b19fea3
-
Filesize
1KB
MD5d566409b1fc019a77f7867f461ceb1bc
SHA19314aadb6aeff989a079ee59224ab2476bf2376b
SHA2565a337441eface416e3b2803414355c640aa75cb7a4daa70720b861e8b7dc3bfe
SHA512993e61fe3386b03165ac755ed09857409babc004b5bd1484f969aac6dd76ed6e0d4e48cd474b3c8c9a800b01126e04f31155bc917063c0c15aa96222d72b377f
-
Filesize
539B
MD5e596c19afb39374703644ac63c498df8
SHA105da02bd45686e5b9780899e0b888b03c839654d
SHA256a2a57e9fafbd762dfa7c1256a4097fc50b7cdfc3c6c63eeb35df228b5113abc5
SHA5124ce643616e5dcc8034d7a5bd1c9ea29094f3a5dc1fd74d6bd0175928095759ce6d59da3a740162c0851dca98eb52e1de4bfd405f700eb9f13527b55131232965
-
Filesize
5KB
MD5947a90906a48e61a232fa849b9b0020d
SHA1ff20a3f079fc6a6c9ff9f9b1b6ef33ed342535e5
SHA256140e300090365d7266ac2f0dd30f867cae3d93da4439f9e13378c27f7d36e567
SHA51226ea74c88b16d9ff4216826e8494ccf963e6ba89c07e3723451644f6028ce3bbead49ce0056b543e52977e5eb2e0a111ad4bd09d7a2ce5d09be8a113ed481857
-
Filesize
6KB
MD563bb4361baa82ebb4dc3052829f5bcb7
SHA1dc6c7875653d0a1f7bd2bf0c06a665ddf401fa4c
SHA256439e6bfa5472a71f70449b2029116c18e070b9951556e9ad1eea7069f9386899
SHA512706336b8034940acd0df3a9e287764be52729c9e2815ee6ba9621f383a9592fa5fde1550445bf733baa3e9a8660a0414dbce5ccb6c101ffb49f35f0a3d1a9425
-
Filesize
6KB
MD505fb034b2d73bbddd133f06a66797dde
SHA1c8f5824b63a78bcf6e8e9ae2c6988ba0d0a7b224
SHA256216789e98b53f1dae96c03898e547a29f53be8e0d1d6606b6ec372f2c8fb6d24
SHA512941a38037e89229901d72eea044b016bc706d6180e570a7b25647c30ee14f340a1b8b8cf560cae702895e2a493f5132050861e1cfd63bb5fc43017032b099e5e
-
Filesize
5KB
MD5bb3bcdb60802bb9f44dfc94321ef7de3
SHA15bb917dda2d4b9155343ba99695eda46656849cd
SHA2569b63b007681ce2d8883d3b43913fe1333e8cdb9460c7d296a682b3f05e3f9ec7
SHA5125311cb5e4a4fa5622e9c9605f89a291f6e9c8ecda7148d0b6dea2d6266fb768aae66562e44a425fd193185809b935a29ca727988074a5701481d267842b22b7c
-
Filesize
254KB
MD56da9792b6aacf411c6e165c46b98810f
SHA16b9290a0c43b06edb35b8c94b01183431368c3ce
SHA256e1e04d37c7523ceb40ca6f1f7a1a0229219a4b0ffa0fb70abd0c3468a5e93195
SHA512b7dd7bb1bd353788cf8e103af3e373277189490d87c37885042036274281248bbb2dc4fec5b5df23dea5dbe79ebc5618fa06340c569fac3508707b007f8a6b20
-
Filesize
254KB
MD5bbacb87807004534a8864521ee2e9f79
SHA165541106ed98d7638268905dc0401616875157ac
SHA25639b1e05338d2e73528441ed44d222488c5be6576ad6df9e3959987fba2865fd7
SHA512ac8d68ca5a4941b8fd2d35130a77928bd065070b32a924143b99a319c918e26acc0df5557a6d24307fe3bb8f6cb959eb9458f2f0a57f16a56020e9826c7ef320
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e