Analysis
-
max time kernel
73s -
max time network
79s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-03-2024 20:01
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://steamcomumity.com/gift/activation/id=6723574616
Resource
win10v2004-20240226-en
General
-
Target
https://steamcomumity.com/gift/activation/id=6723574616
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 2596 msedge.exe 2596 msedge.exe 864 msedge.exe 864 msedge.exe 3096 identity_helper.exe 3096 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 864 wrote to memory of 4540 864 msedge.exe msedge.exe PID 864 wrote to memory of 4540 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2880 864 msedge.exe msedge.exe PID 864 wrote to memory of 2596 864 msedge.exe msedge.exe PID 864 wrote to memory of 2596 864 msedge.exe msedge.exe PID 864 wrote to memory of 5016 864 msedge.exe msedge.exe PID 864 wrote to memory of 5016 864 msedge.exe msedge.exe PID 864 wrote to memory of 5016 864 msedge.exe msedge.exe PID 864 wrote to memory of 5016 864 msedge.exe msedge.exe PID 864 wrote to memory of 5016 864 msedge.exe msedge.exe PID 864 wrote to memory of 5016 864 msedge.exe msedge.exe PID 864 wrote to memory of 5016 864 msedge.exe msedge.exe PID 864 wrote to memory of 5016 864 msedge.exe msedge.exe PID 864 wrote to memory of 5016 864 msedge.exe msedge.exe PID 864 wrote to memory of 5016 864 msedge.exe msedge.exe PID 864 wrote to memory of 5016 864 msedge.exe msedge.exe PID 864 wrote to memory of 5016 864 msedge.exe msedge.exe PID 864 wrote to memory of 5016 864 msedge.exe msedge.exe PID 864 wrote to memory of 5016 864 msedge.exe msedge.exe PID 864 wrote to memory of 5016 864 msedge.exe msedge.exe PID 864 wrote to memory of 5016 864 msedge.exe msedge.exe PID 864 wrote to memory of 5016 864 msedge.exe msedge.exe PID 864 wrote to memory of 5016 864 msedge.exe msedge.exe PID 864 wrote to memory of 5016 864 msedge.exe msedge.exe PID 864 wrote to memory of 5016 864 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcomumity.com/gift/activation/id=67235746161⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe849146f8,0x7ffe84914708,0x7ffe849147182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17346283455083743519,4793646689165798895,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,17346283455083743519,4793646689165798895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,17346283455083743519,4793646689165798895,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17346283455083743519,4793646689165798895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17346283455083743519,4793646689165798895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17346283455083743519,4793646689165798895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17346283455083743519,4793646689165798895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17346283455083743519,4793646689165798895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17346283455083743519,4793646689165798895,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17346283455083743519,4793646689165798895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17346283455083743519,4793646689165798895,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5cbec32729772aa6c576e97df4fef48f5
SHA16ec173d5313f27ba1e46ad66c7bbe7c0a9767dba
SHA256d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e
SHA512425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5279e783b0129b64a8529800a88fbf1ee
SHA1204c62ec8cef8467e5729cad52adae293178744f
SHA2563619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932
SHA51232730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
240B
MD5bc9fea26fff31972f0092c674454f1f9
SHA1531cefd6ba6ff26d1f41b3113a14df7404031ef0
SHA2566f87ea0b3d8816ab59e56625036d6c19c2d20a8313de7fe974f37488c6338850
SHA5127ef04bcf773cdf91ae41867f757f7888853c4d7e2e9b29a0dda01fa729a71edbe20c09bb0fd633a4eaee24bcf2663375f1185354dc155f4cfb304a57835559dd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
985B
MD5138198b2463c964e917d61fafd461651
SHA1247efeb76df68021e125a5d9c59e7faaf9d33fbb
SHA256a70e8efc814be31538a9fca1d7c7f96a1ec745ae4ca1cbef880e9cf28e58519c
SHA512462e32ab1233580998f1112e10e38a24d03d6c7eeeac0b0f5864ec0fd9dd1c948753acc514700be47d9006da7681cfcc58e96f62ef00a6d2d47c1f666b7eba31
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD58604d22736299e08f8dd630e5d069ebd
SHA11a4ebe5c7b73817946f2acfe4218a4210eda77a0
SHA25614e88d964e83f7e530e2833b1bdef455385fdda86f5fb3d2e84686938f60960e
SHA512be0778aa98aebe9e0700d108a9745ec6d5f43e1930d0c9cf1b2f72e13960b8aabc54a46dc3c5cb3acb207b74ca962ccd1273b85d9290bfa6c681895c82ba3e1b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD58bb76171788b9af218d4f7159483adbe
SHA107f6aad9d8dcbcc7fb9b0c4baee6459c8640e821
SHA256b7f68e55cb3719b608fd7d156aab05418d6b0da5ca00d98c64d604244964ab48
SHA512f2678458804c03533d10507fcbc9da4c90a3542eb67865cc0c5d8e5f0a20fad391bf9ba871ee3d83863a4799efe6ea00e0eaef8849a7028565311be09b5c18d5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD5f6b96560820a07c6e457563827b98c54
SHA1964b2f86feb27b2d0fe8cab87cf7f646027aecff
SHA25684a944744c61f142bb2ccc9f69e79abc1c321f54b06a1ed1e20e6cda6a10cba6
SHA512c085588907347db6843b6c4a20518a24535f504ea3f042151df66fb9612f5c06ed6ec54306dac33555a2354d13f73ffe9ca53fc905b406419d9351aef97dc98f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.excFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
\??\pipe\LOCAL\crashpad_864_XGCQGNHBPIBMPREZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e