hxxps://steamcommunmitly[.]com/gift/activation/feor37569hFvrba1

Resubmissions

02-04-2024 18:32

240402-w6klsahg8y 10

Analysis

max time kernel
123s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamcommunmitly.com/gift/activation/feor37569hFvrba1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

4612 msedge.exe
4612 msedge.exe
1468 msedge.exe
1468 msedge.exe
2448 identity_helper.exe
2448 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1468 msedge.exe
1468 msedge.exe
1468 msedge.exe
1468 msedge.exe
1468 msedge.exe
1468 msedge.exe

pid	process
4612	msedge.exe
4612	msedge.exe
1468	msedge.exe
1468	msedge.exe
2448	identity_helper.exe
2448	identity_helper.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1468 wrote to memory of 776	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 776	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 908	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4612	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4612	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4960	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4960	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4960	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4960	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4960	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4960	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4960	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4960	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4960	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4960	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4960	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4960	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4960	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4960	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4960	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4960	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4960	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4960	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4960	1468	msedge.exe	msedge.exe
PID 1468 wrote to memory of 4960	1468	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunmitly.com/gift/activation/feor37569hFvrba1
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd395646f8,0x7ffd39564708,0x7ffd39564718
2⤵
PID:776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,11596586413081859657,1816657040821511798,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
2⤵
PID:908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,11596586413081859657,1816657040821511798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,11596586413081859657,1816657040821511798,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
2⤵
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11596586413081859657,1816657040821511798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
2⤵
PID:3568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11596586413081859657,1816657040821511798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
2⤵
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,11596586413081859657,1816657040821511798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4192 /prefetch:8
2⤵
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,11596586413081859657,1816657040821511798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4192 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11596586413081859657,1816657040821511798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
2⤵
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11596586413081859657,1816657040821511798,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
2⤵
PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11596586413081859657,1816657040821511798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
2⤵
PID:924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11596586413081859657,1816657040821511798,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
2⤵
PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1444

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
456B

MD5
816797358ec1e69ef4270a942ea57f5d

SHA1
46a0d6b5ced347966bd5b2689e3a80c81400e67c

SHA256
7bd932c1d66db20a295c29ba569fa803f12ef4ad690ab851af642a0dc05a2bef

SHA512
1ccafc23c077c539f6d924a392b9572560b9329e25d065a8081668e40b5c9e21c0f036a15058f502f2dcc68450efbb0566475a1f7eae5b25a508c6ad4cf05258

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
544B

MD5
dec9023c1badc99cff08a1d437f0c401

SHA1
7b3244ee66e391761c3bb81b71eae0469eb5b64d

SHA256
c7262113d8efcfdcb5cdcdcf66191df8f0d9a35aecbac52ee02db7596c5c9a61

SHA512
5a70595d0d8980d915d53ab6ed6b0fc13e600be2acf417e338a795452afa12cc8991d84348e22b36fe07e0e6f7babec1cc7b06ce658add879f26ed7a64c989ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
9aef79caaccddaa5aafaf8b382a2d957

SHA1
0043c28cfbe8665de69a41c6ca57549e21cac592

SHA256
ce483a12004a64fc320dabd4bd1f999f47e84b7b1ebd5e6804c9eddf1f965309

SHA512
049a157e5ea2fec33b7b73116349741233f18db0a94b8766b641a23d3b31f12a95d736cb1fcb186ed27a7587b9e952307d89d5521b97281edeee9b0470ef8082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
628da60fe6695a58b23b172b171efc23

SHA1
591ddc8016e55a4f026d0a459da1b52784b06839

SHA256
94c1e27ca931e3749ae4daeb29a4fc33a61d2935975acd44728ceb714d69a7af

SHA512
02132ac701ee195e78f5cfe41293fd5c7e8aafed055882955eaeb99403fe468c8199b18161ebcc2406e235ad86544da6ba5bb235c37bd64c37bf462a31451e87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
47d0f99c5d569560b79163e0de1d15a7

SHA1
84a91573af249af5e6b4d0810b99c729f040ae46

SHA256
27485ea12c1a8f2bcee700fb64145e001c3f28bbf7af3891cdf527c81ab01295

SHA512
d5aae9625f4d10509206054295aea0ea4d82b81a875cda3a31d144b8bb09d99d7d6505452f979352fec63136ada5d486b19c6e5a49b0360e2af1c0af1201d5b0

Download Submit
\??\pipe\LOCAL\crashpad_1468_UFWNOLQVRJCAUILW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit