Analysis
-
max time kernel
53s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 14:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://steamcommumnuty.com/gift/activation/feor37569hFvr1a
Resource
win10v2004-20240412-en
General
-
Target
https://steamcommumnuty.com/gift/activation/feor37569hFvr1a
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 2452 msedge.exe 2452 msedge.exe 3416 msedge.exe 3416 msedge.exe 4692 identity_helper.exe 4692 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe 3416 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3416 wrote to memory of 4664 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 4664 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1040 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 2452 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 2452 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1080 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1080 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1080 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1080 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1080 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1080 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1080 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1080 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1080 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1080 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1080 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1080 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1080 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1080 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1080 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1080 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1080 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1080 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1080 3416 msedge.exe msedge.exe PID 3416 wrote to memory of 1080 3416 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommumnuty.com/gift/activation/feor37569hFvr1a1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9872f46f8,0x7ff9872f4708,0x7ff9872f47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,10093308577929219786,18169418641418850305,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,10093308577929219786,18169418641418850305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,10093308577929219786,18169418641418850305,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10093308577929219786,18169418641418850305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10093308577929219786,18169418641418850305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,10093308577929219786,18169418641418850305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,10093308577929219786,18169418641418850305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10093308577929219786,18169418641418850305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10093308577929219786,18169418641418850305,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10093308577929219786,18169418641418850305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10093308577929219786,18169418641418850305,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b56675b54840d86d49bde5a1ff8af6a
SHA1fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811
SHA25686af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929
SHA51211fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD548cff1baabb24706967de3b0d6869906
SHA1b0cd54f587cd4c88e60556347930cb76991e6734
SHA256f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775
SHA512fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
384B
MD55f55207c79d2e7926d7aa4ce7e9c162d
SHA1e236883856095d6c343d724c3a9f8530926c9ac6
SHA256b92c546a241a549b008a67fcbd2225101c5ef017bb4c1ba4163a185d3b962d84
SHA512bf68fcd54ba1db29c55594304ecc185210e3eef6c42ddfb71a606a957d8b34360c85aaaa82f268d34031875dd7a1b4a149ab30268a8f779a46541ff19a8862fe
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
456B
MD5052a6de79e72224102e243d469738b6a
SHA1f0e0546505a1ee40186cd9bf9e8f207738eb76c0
SHA256888b9d0afc3155239b1e7ce4b98c296d6a99f2917be5a4b68fe92efed7b458e8
SHA5126c707432cad2a58d42c8ea7417934bad12acf267f351ca03a783fa786bc83b9f805ca72b017ed9c5a920e3c8719231ca00b16bc1d02d9f470ae2925140ed921d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD55cf1cda05b430614e603109bab033c04
SHA1a3a3b9d4e46026eb07499dce73e33048060b7893
SHA256d2a53bcf85bf1807e08357df21da05427a07bb26a78caa253bb8e6be1cbc6901
SHA51284da29c13a8fac9a9dfc8125ae13d5207fd42e0fd466ecc21df3313456e9556210a89e75bee722ed592e116a5eecef280525f598beffc477e19767e5ec08eee2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5202ca5b6a3c05b0e858fe2cfc79f53a8
SHA18b5e118fa419658339c85ad6046bd5b5b0fb2d78
SHA2564b3a17d4720b7445bb15744aada80fa51a712b66f330ff64b4b116a322e4a386
SHA512f51558a2ca93f97769dc74b5871b90b39316bce22ac4ef086022370e6b1ae5a6012bfe11a5a4b064cacc1e50d8535018ee2e1e1a9eefed60c180e00298f4c343
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD55a0e216a7b53a6fe43ba11f884bebd27
SHA1f6dc896cc9e11193a5f78d1995d2151b1a1810b0
SHA2567c0ad0c95747805ff5e35f6e3e92dcc4486e16389b4d986b4e4bced571ccbb09
SHA512e25e91971175df83d0ebb09cec253acd76326331000bfaff681a9fdff50a177d0a2e2e43f0c13a47baddc2e8f7ea2b4521294d8597c89193b08979d0e0a66bbc
-
\??\pipe\LOCAL\crashpad_3416_CATLZJLMQLVAAYAEMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e