hxxps://steamcomnumnity[.]com/gift/activation/id=4923466314

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamcomnumnity.com/gift/activation/id=4923466314

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4808	msedge.exe
4808	msedge.exe
4588	msedge.exe
4588	msedge.exe
3196	identity_helper.exe
3196	identity_helper.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4588 msedge.exe
4588 msedge.exe
4588 msedge.exe
4588 msedge.exe
4588 msedge.exe
4588 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4588 wrote to memory of 2204	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 2204	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4420	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4808	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4808	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4536	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4536	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4536	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4536	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4536	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4536	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4536	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4536	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4536	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4536	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4536	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4536	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4536	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4536	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4536	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4536	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4536	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4536	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4536	4588	msedge.exe	msedge.exe
PID 4588 wrote to memory of 4536	4588	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcomnumnity.com/gift/activation/id=4923466314
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffb9046f8,0x7ffffb904708,0x7ffffb904718
2⤵
PID:2204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,5535994337103300007,13244402367154117836,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
2⤵
PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,5535994337103300007,13244402367154117836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,5535994337103300007,13244402367154117836,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
2⤵
PID:4536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5535994337103300007,13244402367154117836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
2⤵
PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5535994337103300007,13244402367154117836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:2032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5535994337103300007,13244402367154117836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
2⤵
PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5535994337103300007,13244402367154117836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
2⤵
PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,5535994337103300007,13244402367154117836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3340 /prefetch:8
2⤵
PID:1596

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,5535994337103300007,13244402367154117836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3340 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5535994337103300007,13244402367154117836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
2⤵
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5535994337103300007,13244402367154117836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
2⤵
PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,5535994337103300007,13244402367154117836,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3096 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3548

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
5f5bbd5f3b21636ee19989183b7e0155

SHA1
4889e2f8c054d29b2d4334b4b87bf6311c73959c

SHA256
cd1fccb36360f2c8519f20b085e86770e5e2b23dce875b5b87adff99299c14d3

SHA512
37e31711105f72b206c8b6a09ed9fe0451272aca3158430a1f50b530a41c1b5d6a6966eae09ef14ccb218c1e2409d3e065a46aeae0305ab4b5a38cba95afdd03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
894B

MD5
7da116ef1b7f00bbbf88fbc16dfd36dd

SHA1
4ba6d4c5fd3153cf69efd6ffe29f99fbba598b2d

SHA256
c3567edaf947f95840eac926ae6932dc9988d84514b2f8628e41f9851c61bf6e

SHA512
21962bd8658b7c0bcf909027179f47456b93612cee3b8bbafd3bc1c249fe6139616f9cf6d76a7f1a6a06172731d3e6aa76307a7aedf55502053045e600fffcb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
f712ef89e28b634a5c5e97165cb2292e

SHA1
42d4719dcd95a69396223e5ae86767d67bb5bdf9

SHA256
ee35e6809e36868f510f630c4b7e50f4cab7c219bd750b2126be79c58d3fabad

SHA512
633c4e8e491046ebdc2e3247074b2719e323a9d7be64c841634ea8e4d2ad1e367360cf255fc525f3ebac08d66f176e160c9f36d11505709b315b476debdbf868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
9a72a4138ec70051ff0563bca8602546

SHA1
15193160dc4a3974016c196f65214be8b0064c2e

SHA256
2040a3e1f9668ca98feb1faff41d7fedfae3bbd85065f3b4de60290f262f64ad

SHA512
df04cec1f30ef1935c443fe27b09cb5fb71554cae45adb7aa6451c45bd183312308386276e7abe240ebb8c7bd310fc4c0f8efaf665ab16c582458d3f47e2c0a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
2be5b5ed880f2693c372ee7ffb447f71

SHA1
e7b56fab90da2d3faf03ee961c11884038ffc04d

SHA256
d238b72761871dc2e684729358f1b649997f2ddfdaa4f4ff19153da268b4767d

SHA512
66e56261b362f8e23518c0168ab1994d05e3657840dabec413006d962a28c2acd3163260de5d97c86e0074972d526516183a9476187513d6405795326925a261

Download Submit
\??\pipe\LOCAL\crashpad_4588_BIZWSHPDBHAZNPHM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit