hxxps://steamcommunitn[.]com/10598432090961

General

Target

https://steamcommunitn.com/10598432090961

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133571508066538168"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

1092 chrome.exe
1092 chrome.exe
4252 chrome.exe
4252 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

1092 chrome.exe
1092 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 1092 wrote to memory of 4384	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 4384	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2032	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1968	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1968	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1060	1092	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://steamcommunitn.com/10598432090961
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfe089758,0x7ffcfe089768,0x7ffcfe089778
2⤵
PID:4384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=1888,i,5934440651950311252,2031383164584776397,131072 /prefetch:2
2⤵
PID:2032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1888,i,5934440651950311252,2031383164584776397,131072 /prefetch:8
2⤵
PID:1968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2068 --field-trial-handle=1888,i,5934440651950311252,2031383164584776397,131072 /prefetch:8
2⤵
PID:1060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1888,i,5934440651950311252,2031383164584776397,131072 /prefetch:1
2⤵
PID:960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1888,i,5934440651950311252,2031383164584776397,131072 /prefetch:1
2⤵
PID:4560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 --field-trial-handle=1888,i,5934440651950311252,2031383164584776397,131072 /prefetch:8
2⤵
PID:1956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 --field-trial-handle=1888,i,5934440651950311252,2031383164584776397,131072 /prefetch:8
2⤵
PID:4264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4416 --field-trial-handle=1888,i,5934440651950311252,2031383164584776397,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4252

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1748

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
432B

MD5
fb0da865264402a6b26e6eb201885752

SHA1
5f37786eac96ade603c2104e70a1d73c642edb00

SHA256
53d378b336b84a199cce5e756e9e11dfa9d34f0f72f610e4d7f659196cf61208

SHA512
23ddfa441a587c91131cb8bdcc090b384fa37a2f3d694768c0a075c1ba5d931f832c55a77470eb9f23e04d2fc186069ddc66ff896a451c3df1808eba85804a4b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
fc36c943d20f00e7ccaf94b39ca20fb2

SHA1
0e77285651e7b38774b91d83563a044f850959db

SHA256
ad62d5b78b9b95e86992e38ff04d95330c80c8917eb51372d28d35cccfbe19a2

SHA512
c8b48c98da979ebe710032e6e653575772f2c571e40af9284b38e11f2f5aad10bcc41c32502b2c76ed3627e8c9ceb7592ea32d2c31e3603cfcd7cedd8ee41de6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
c2d39c60ed5530707203b12bdbc28bcb

SHA1
c6688c98bb0f2b73d608ec4f0caf8b342b9fab33

SHA256
4339955076eaaaff8ac5cc86e1d41563e907006fa4b162d3656a09deee833d13

SHA512
ac0d072203c7d6c171f04e25a817ec55cd85843a32bbfe344022c1b2e96145ec738076955ef09bdfa01b42c68c18f969887dc00194a896f678fdd246289da024

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
873B

MD5
7c65b624c88539a8baba6337ced798d3

SHA1
efe3ce564127287f63b6f5e275954df2408daf4e

SHA256
7cc22e5c26d2cf2257b14d6da5abbac15971681ff82b84f8200cf3d865f804ef

SHA512
d7c0fb27fbb5c669b1e4ef393f130f3839042841efe0f257caa312319e30a00e7dbaadef4eb681dd00b95974c3ac643add7b9ac37b242a61b410f8e3e6ca52dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
861176e4e05e8f399e9291fe6c3446a3

SHA1
0f2addd21c0b1a65c2de6c98f4c23f3133a9d8e4

SHA256
65e8b4f2361303de0bd66a21ffdc7a7fb1d5c08580dfbd16a05fe413c3e9f304

SHA512
a9f7eef82329a96a9e21acc1aa69a78528330f9a7e242d09e715ca90336361d9ccec5ae8d6a87472a2150bc0d4167447d748543ccc6b80a9c69556ea6e28ad95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
253KB

MD5
75294f14507313ca2033e8abbf3d7a58

SHA1
a3f08d7e5035dcc412b7b41088061985b7f6c270

SHA256
aa8d7685358e9b7e583801b67dd7d0bd6351bc786126ac2a23fc68e129f4118c

SHA512
6fc9683d79c4fb65bb854191f5281f49c052848662b8ed16bec778345c6a0b48fceb8911db2375ad2890bc327480470dda727bdcdeb486db713777bdd97d5cae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_1092_TAZUBEQOPJWLJZGF
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads