hxxps://steamcomumity[.]com/gift/activation/id=9561943697

Analysis

max time kernel
599s
max time network
591s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamcomumity.com/gift/activation/id=9561943697

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133565572918533642"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

4856 chrome.exe
4856 chrome.exe
880 chrome.exe
880 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

4856 chrome.exe
4856 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4856 wrote to memory of 4036	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 4036	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2112	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2176	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 2176	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe
PID 4856 wrote to memory of 3660	4856	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://steamcomumity.com/gift/activation/id=9561943697
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7ea79758,0x7ffc7ea79768,0x7ffc7ea79778
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1912,i,4943202771671551886,5322953291672843220,131072 /prefetch:2
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1912,i,4943202771671551886,5322953291672843220,131072 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1912,i,4943202771671551886,5322953291672843220,131072 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3128 --field-trial-handle=1912,i,4943202771671551886,5322953291672843220,131072 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3144 --field-trial-handle=1912,i,4943202771671551886,5322953291672843220,131072 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 --field-trial-handle=1912,i,4943202771671551886,5322953291672843220,131072 /prefetch:8
  2⤵
  PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 --field-trial-handle=1912,i,4943202771671551886,5322953291672843220,131072 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5160 --field-trial-handle=1912,i,4943202771671551886,5322953291672843220,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:880

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
0f45a3628b63659b044a0954d30d6422

SHA1
c4b836e506186a0f939d3cf2c034e68e9e9c30da

SHA256
2365be22df161a63bd80d2f4ba109713c551f87a310cd3cb98ef89cd4f0172dd

SHA512
8cd252de0288c40654a1296c6529b439c456c01856839def4e48f12b90704c82ea907c6768020a89e19768cc2153507a92e9a2e8722e2dbdd859eeefe380e0bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
7f1c2f95f60fb1a1b9ad12641fe5288c

SHA1
5d906d3a3651ca356cf7b5d45a4b44c0ef9b839f

SHA256
a29d8a99e8bf1e44844815798a99369042c2ef335c88d4f700197eae1fd19281

SHA512
fe7bae50f06a88e1f38fa29bce22f9fc64921e04829c93320706856aed951b50ee59d19cd844f0e72a5b66e733ebb930733d4416a824de03aac424c3fa27deb5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
7d3e9b6cc5be6c78001d1d06076a60ab

SHA1
e4b3cf0a0484eb06d764ac676f17425ef711eacb

SHA256
bf15c7749978cf27c32764661a03f2ee1396456c960021f976b04a7247600fee

SHA512
5a08c1739420afdda159c78143358af0cd2275536ee3cc83c47625585285d9ec62c68c7061155a682c31cfcc0a59eac9fa8120b072551f38e22285940e2062b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
702B

MD5
18d905d4fbaa26677f28605deee271c6

SHA1
cf7415aedf9995578e6fac578509579f9bed9576

SHA256
54b15e17231753a9cdee9fc18ba9b86756bd475323f367e8b98213fdeffc4b95

SHA512
987cfc8dff1678329e6a7160056f465494c18d225070c64878fa5cad0b03584fae260122860d6295bc375929371f9b712520aa9040d4a7fc0cc8316732460ebd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4ef2572dab4ef9252cecfc0e279ee91b

SHA1
3a9cf51f6b7f43661107d351f03adbdfb927a993

SHA256
9d16b8805bd257d5e74f67c0a44281b996f0d1ab2d974f3cd6ef00db0eb2512d

SHA512
95f8747273e38b68c8e2ef25488ad8e38b79499035b18013676816141f324263d0822d84eb2ae7a168747d0e2838156a9a352727828d65e3ae4fdfbcc3281bed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
024553c72e89215db9fecd5087b30100

SHA1
98b7de2c59faaab5a6829f291eae2cb441d0e6d1

SHA256
d7ad2f4e310b5ef36a0e80db71e04d95878179fb6f51ac649a60a5d8ffccf8a5

SHA512
ed722272621d567f7ddae13d1810969e5a841c2ad88cd9e617ae4ba2cfea283e7bca54a200ee942f89c1969b4e5343a1bf728669f1d55097c74fc9fe460742d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_4856_XGHSYXENYZVUACRW

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit