Analysis
-
max time kernel
32s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 22:31
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://steamcommunity.com/gift/7655685934763976
Resource
win10v2004-20240419-en
General
-
Target
http://steamcommunity.com/gift/7655685934763976
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133587306929169007" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 4804 chrome.exe 4804 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
chrome.exepid process 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe Token: SeShutdownPrivilege 4804 chrome.exe Token: SeCreatePagefilePrivilege 4804 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe 4804 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4804 wrote to memory of 5052 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 5052 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4372 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 1660 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 1660 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe PID 4804 wrote to memory of 4060 4804 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://steamcommunity.com/gift/76556859347639761⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff129acc40,0x7fff129acc4c,0x7fff129acc582⤵PID:5052
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1772,i,14976097319996384187,47933771763416871,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1684 /prefetch:22⤵PID:4372
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2108,i,14976097319996384187,47933771763416871,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2172 /prefetch:32⤵PID:1660
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,14976097319996384187,47933771763416871,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2240 /prefetch:82⤵PID:4060
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3028,i,14976097319996384187,47933771763416871,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3064 /prefetch:12⤵PID:4560
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3032,i,14976097319996384187,47933771763416871,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:2148
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4568,i,14976097319996384187,47933771763416871,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4584 /prefetch:82⤵PID:5076
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4652,i,14976097319996384187,47933771763416871,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4864 /prefetch:12⤵PID:3380
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4012,i,14976097319996384187,47933771763416871,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3432 /prefetch:12⤵PID:3624
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3832,i,14976097319996384187,47933771763416871,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4876 /prefetch:12⤵PID:680
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵PID:3784
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3232
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsStateFilesize
649B
MD5c66178b6bacb0f23adf1596908458234
SHA119d61f0f73dac3df053a8885d796fe2fcf398732
SHA256a18296abc99fca8b0da91e46c25801bbe69a2f299671cb443549cc3135886cd7
SHA51232db9bd78fb72718a5bb77d4dcc5099f93119e4ae7821496fef0d1ba7eb3527be25ccdeb07421046953e3a482a9141a790a31353dc1ea02f94a0e87ec84edc4d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD53dfef4aefdf44b9ae323bcb7db6ca285
SHA1e5550aae4398b7fb87b4c075c84fa8c580d025c2
SHA256c5f9d6609bf41fd0f9c3f80fd0fdaeb236030403c3266658c2475753139cf610
SHA512184a4fd5741c35ada3f59a08a3bd48ba71e9de4f964af1ad07393ddf53d97e76e0cb5cacb3432470ffa0a9a5342b75b848a918da1d66ebfca120505945dd4fef
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD5506621682055bf911e478ae4a96831d2
SHA188ab203d8ef937f7c3229bb460a7db240cd8d9f5
SHA2562316eb3e0320aa8bade2c3f63fdd4ac991f60a05c56d14725ad693f6e2bca0bd
SHA512c0f2d6bbbbef05ab74026325cfc759ddc521383b940d7af61b600945faa2a57fd8306655715324afa16ba9a8396bcdcedf3369887cfff2833a9986ca3855ecf2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
77KB
MD5ad6856923c0731863064dc1b1419702f
SHA126cc88917610ccb364d04a5224fef74324e99226
SHA2562bcdedf38e68a80b54b0a5280114f2132834d790c9e5b03a7d9b78a881dbe2ba
SHA512fd9e873aee468ec43733cb90f8931b13ff2cbaabd5d67e3782a9efd54d9f13b8d07176efbdc9292b99e176b886bb0117fbd2494e5e057f540b0818e49ff87157
-
\??\pipe\crashpad_4804_FZPFTTKYGOEUXBNRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e