Analysis
-
max time kernel
42s -
max time network
38s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2024 08:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://steamcomumnity.com/present
Resource
win10v2004-20240226-en
General
-
Target
https://steamcomumnity.com/present
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133561740358364843" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 3568 chrome.exe 3568 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 3568 chrome.exe 3568 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3568 wrote to memory of 4848 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 4848 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5428 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5404 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 5404 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe PID 3568 wrote to memory of 2244 3568 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://steamcomumnity.com/present1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd94569758,0x7ffd94569768,0x7ffd945697782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1876,i,9980923372529673221,2792205110666883152,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1876,i,9980923372529673221,2792205110666883152,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1876,i,9980923372529673221,2792205110666883152,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3004 --field-trial-handle=1876,i,9980923372529673221,2792205110666883152,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1876,i,9980923372529673221,2792205110666883152,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 --field-trial-handle=1876,i,9980923372529673221,2792205110666883152,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4624 --field-trial-handle=1876,i,9980923372529673221,2792205110666883152,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
872B
MD50bc7130d5973f233c381906df06f8bb5
SHA1bcd58217b4fa18216528e44228f99dfc9ee18859
SHA25630a54bccf8ce98a62ab239610cc071cfce59384171a57697863f6217086672a6
SHA512e6d06d3510d0dbe62981a84c25ca4e5dcdb5fe727aba916ad0cd8a68084c0fccc049870f75215faeef1d774070099b06e90d0f700aeb4bdf0018a392740c548c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD567b06aec1d743eb1ed86b19051b81d8c
SHA103e4189fec0f848885a27bdedfa74df5e6a39b54
SHA2563741492caad29e7ca33d72ed4f927a81a2766aa7b63c37260c3f51366f1ad710
SHA5123a8d1e7080ce5b69c93e013ace2b5fec0547c3f581acd88ba4e889f14c49c82a77bf67978a367f88c39924b336810af535a0a00e0850c01dff5201dae33d322c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
128KB
MD5de340e97858850ae5897a8d58169cb07
SHA1c7b3217f9afdc2c5eb5ff94cb779573737b42ce7
SHA256751ebf31c50770bdac4e96516cebbb8b212719f982ff99d3cc6e848e64a726d0
SHA5128f33a724023a366318fa55be502753bf43a4dc702529b386bd358c3685d3d96e522ea063e63bc1ab6c90c758034ab8960369da954ecbf2d6edb90ae358243076
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_3568_CXLXTYUEESRAXMTGMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e