hxxps://steam-cardcode[.]com/gift#

Analysis

max time kernel
1693s
max time network
1686s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14-03-2024 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steam-cardcode.com/gift#

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4568	msedge.exe
4568	msedge.exe
1584	msedge.exe
1584	msedge.exe
3312	identity_helper.exe
3312	identity_helper.exe
5908	msedge.exe
5908	msedge.exe
5908	msedge.exe
5908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1584 msedge.exe
1584 msedge.exe
1584 msedge.exe
1584 msedge.exe
1584 msedge.exe
1584 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1584 wrote to memory of 3620	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3620	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 3412	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 4568	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 4568	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 100	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 100	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 100	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 100	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 100	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 100	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 100	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 100	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 100	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 100	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 100	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 100	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 100	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 100	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 100	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 100	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 100	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 100	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 100	1584	msedge.exe	msedge.exe
PID 1584 wrote to memory of 100	1584	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steam-cardcode.com/gift#
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb44f446f8,0x7ffb44f44708,0x7ffb44f44718
2⤵
PID:3620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,11689118106367943416,7926438003632233084,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
2⤵
PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,11689118106367943416,7926438003632233084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2812 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,11689118106367943416,7926438003632233084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
2⤵
PID:100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11689118106367943416,7926438003632233084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
2⤵
PID:2172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11689118106367943416,7926438003632233084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
2⤵
PID:2136

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,11689118106367943416,7926438003632233084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 /prefetch:8
2⤵
PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,11689118106367943416,7926438003632233084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11689118106367943416,7926438003632233084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
2⤵
PID:4392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11689118106367943416,7926438003632233084,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
2⤵
PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11689118106367943416,7926438003632233084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
2⤵
PID:3280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11689118106367943416,7926438003632233084,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
2⤵
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,11689118106367943416,7926438003632233084,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2712 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
624B

MD5
127f7ca293d8fd7e71b7188a747e6d6a

SHA1
94f1cb3f2afd6d5e484bdad5903f6b6ce2b45bc1

SHA256
33c12b36bff70cdbd0befd4f2095f90ef0961bfb00d3dac1f49c8443a4b14590

SHA512
48a9848707ed95b88bd5973437dab7aea423cabadf26f49795d33baafbb115c17b7c3a15a1c8a827e83cc1ea6b9406c794653af3e15c16f5ef3ea4d2a49dc92d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
990B

MD5
f9e2c964e73271f1da7402c37d7f5e43

SHA1
3202697955c4cae9a207e5e75c8e82f7e85f0a5a

SHA256
b357a8c3032096722ad1e6d3619e125de2fb79683febd4ce5f009dbefb805a02

SHA512
bbc96e91d40ad66217bf42117529ccb92141d57f3386279ff7757b4f4f1340696d7dd86dd375e5844e11a5e2e73587974456e04b4a51fc153d223f04f61fbbf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
990B

MD5
fffca76c97f2b0d70dd07fb36a8c3113

SHA1
f288a5e91b2c3390f1d778bed19f0702e0852ed7

SHA256
a2cc320b77945ca9e25d8ebfef944b26c7e01854400f800055e88643b3375988

SHA512
f06924ce2740197060697eb21a4a0e44301cc454cf485b29779b5b41bc5c29b418e299b91c8f2397414ba480b07e0c593608587e980d41200db8b7e0456a8c42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
1c00d6db085a3f88fdfeb9631b8cf4da

SHA1
510cf97c9bfffbff9c4f31d6bdb454d32f1c0858

SHA256
04d03c2ff0c9d0d9c61f023ece3d60979e6081eeacd84caff89c63e7e40ce769

SHA512
7aa8d4b218db8cdafb8915d96f58155b7d1d7302ad2bf303bc95730b20d15492f26b2616d4252e90bf5b20058ceed0545fb630f55012490100d5dc53cbab8a29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
90bfb183db6cb605e0ea8a01d5d118bd

SHA1
16aa42668b3d7b2c8646b85de2a63f2ae7a84237

SHA256
898465fd98ca6aea38e5154c88547ab8f4a5b01aebee8ebd8f0ac409a03ffa78

SHA512
4515d3b84bc750f87eefbea2693c5bf9bcabe1198be5ed3ef39c4b6f27a4e0700e84c16426252d17fc99624e07b5f64b9144cd613a89074a0fb7c6cd18a562ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
2bc116f783889aabe355c7cfde36aeda

SHA1
aabe5526420a4e5114ba4de1d155ecb5b7d116e6

SHA256
c23c25ced261a672375c178ac5d7b6f189cb7a48d5734a21b1f3745cc2368b53

SHA512
c214568ef544d31437c50a88599c737a53e860461e9ae70b0a4339dd79fa659783dc22027b5137b91d66af713547e7d63b47ca1ab5230f03230d0fc3946566d5

Download Submit
\??\pipe\LOCAL\crashpad_1584_HOFKCJTIZNKORMCI
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit