hxxps://steamcommunitn[.]com/gift/29848101093491

Analysis

max time kernel
37s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamcommunitn.com/gift/29848101093491

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

1568 msedge.exe
1568 msedge.exe
4776 msedge.exe
4776 msedge.exe
1716 identity_helper.exe
1716 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

msedge.exe

pid process

4776 msedge.exe
4776 msedge.exe
4776 msedge.exe
4776 msedge.exe

pid	process
1568	msedge.exe
1568	msedge.exe
4776	msedge.exe
4776	msedge.exe
1716	identity_helper.exe
1716	identity_helper.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4776 wrote to memory of 3336	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3336	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3752	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 1568	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 1568	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3732	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3732	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3732	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3732	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3732	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3732	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3732	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3732	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3732	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3732	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3732	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3732	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3732	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3732	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3732	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3732	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3732	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3732	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3732	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3732	4776	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunitn.com/gift/29848101093491
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd06d346f8,0x7ffd06d34708,0x7ffd06d34718
2⤵
PID:3336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16471738001231602151,16032369381231499701,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
2⤵
PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,16471738001231602151,16032369381231499701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,16471738001231602151,16032369381231499701,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
2⤵
PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16471738001231602151,16032369381231499701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
2⤵
PID:3792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16471738001231602151,16032369381231499701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
2⤵
PID:1376

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16471738001231602151,16032369381231499701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
2⤵
PID:1004

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16471738001231602151,16032369381231499701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16471738001231602151,16032369381231499701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
2⤵
PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16471738001231602151,16032369381231499701,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2096 /prefetch:1
2⤵
PID:3380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:856

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017
Filesize
115KB

MD5
ce6bda6643b662a41b9fb570bdf72f83

SHA1
87bcf1d2820b476aaeaea91dc7f6dbedd73c1cb8

SHA256
0adf4d5edbc82d28879fdfaaf7274ba05162ff8cbbda816d69ed52f1dae547f6

SHA512
8023da9f9619d34d4e5f7c819a96356485f73fddcb8adb452f3ceefa8c969c16ca78a8c8d02d8e7a213eb9c5bbe5c50745ba7602e0ee2fe36d2742fb3e979c86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
Filesize
121KB

MD5
2d64caa5ecbf5e42cbb766ca4d85e90e

SHA1
147420abceb4a7fd7e486dddcfe68cda7ebb3a18

SHA256
045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f

SHA512
c96556ec57dac504919e806c7df536c4f86892b8525739289b2f2dbbf475de883a4824069dbdd4bb1770dd484f321563a00892e6c79d48818a4b95406bf1af96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019
Filesize
119KB

MD5
57613e143ff3dae10f282e84a066de28

SHA1
88756cc8c6db645b5f20aa17b14feefb4411c25f

SHA256
19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14

SHA512
94f045e71b9276944609ca69fc4b8704e4447f9b0fc2b80789cc012235895c50ef9ecb781a3ed901a0c989bed26caa37d4d4a9baffcce2cb19606dbb16a17176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
456B

MD5
e40048b403295dc4f28cd779f594305f

SHA1
a27d45e29ab50b758d83091549d85f820202cadb

SHA256
4fbd6b86ec2796b5c7cd202b818504f725ced5fe50070cb73d79e1339503baab

SHA512
c9bb672102da1be7579f69fdc1ebed4ccac0e92bc51488c419b2e1ebac78f136f271a78095440f0e5f5bdf82451aa1a0be3251d84bb1e83bbf78dc18a8826377

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
57f023fd97a48802fa35980e19384765

SHA1
05844ffc98f28a1b26744a3cd29a40321f99e135

SHA256
6b09ae4850ce71b42501e74edda0fc664b2c13a2136e9a73ed342b3bc3d67892

SHA512
8073ff2297132e8317b623cc151f2f2a6fca3997f801d086be4b1aa5a745156873a6120d3c4f12be79d55908e9c9859b8a44ba497649a2049ce006c244dc7c51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
a211ce19c41b51bb21c31867e7505d90

SHA1
25163116303e8354b647c5e8399b3226f6920b4d

SHA256
c06575cb535a7449bd9714b5451e19d8dd8d438e9414c9cb4e7dd5e48c904dd8

SHA512
047699d286b268c5894b5b1ababf59da926fb7efefc215bba4238083c72dbf744fd4e7857a2a259fe6a15a5a286713b0e937318262b6b92fe53d0ea82e1a6c9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
5b6e94bf75a4b7eba8d6044182194f1f

SHA1
bc2b800acdde897cbd1c61b1fbc994cefb69b4e6

SHA256
67efb934f2e6ec0dda1b3d456afc9e9892a22e0f81163a27f91c615bde675972

SHA512
e776634ad1dd52f543ac82ff028e0282cfe700eae641082968750265c3f3acd1d25159d4037998176393ec1e664653e52090ea963d3c0e31044cd19acc7d2e8e

Download Submit
\??\pipe\LOCAL\crashpad_4776_POZITGIEOMKZXQVV
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit