Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
102s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 01:33
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/steam-account-creator/Steam-Account-Generator/releases/download/v1.1.3.2/Release-windows-1.1.3.2.zip
Resource
win10v2004-20240226-en
General
-
Target
https://github.com/steam-account-creator/Steam-Account-Generator/releases/download/v1.1.3.2/Release-windows-1.1.3.2.zip
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SteamAccCreator.exe -
Executes dropped EXE 2 IoCs
pid Process 4416 SteamAccCreator.exe 2516 SteamAccCreator.exe -
Loads dropped DLL 18 IoCs
pid Process 4416 SteamAccCreator.exe 4416 SteamAccCreator.exe 4416 SteamAccCreator.exe 4416 SteamAccCreator.exe 4416 SteamAccCreator.exe 4416 SteamAccCreator.exe 4416 SteamAccCreator.exe 4416 SteamAccCreator.exe 4416 SteamAccCreator.exe 4416 SteamAccCreator.exe 4416 SteamAccCreator.exe 4416 SteamAccCreator.exe 2516 SteamAccCreator.exe 2516 SteamAccCreator.exe 2516 SteamAccCreator.exe 2516 SteamAccCreator.exe 4416 SteamAccCreator.exe 4416 SteamAccCreator.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier SteamAccCreator.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SteamAccCreator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz SteamAccCreator.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeRestorePrivilege 4932 7zG.exe Token: 35 4932 7zG.exe Token: SeSecurityPrivilege 4932 7zG.exe Token: SeSecurityPrivilege 4932 7zG.exe Token: SeDebugPrivilege 4416 SteamAccCreator.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4932 7zG.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/steam-account-creator/Steam-Account-Generator/releases/download/v1.1.3.2/Release-windows-1.1.3.2.zip1⤵PID:1932
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=5548 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:11⤵PID:2296
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5340 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:11⤵PID:5092
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4928 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵PID:3128
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5284 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:11⤵PID:3724
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\57ae86058bf349c898255632a9a44eee /t 2308 /p 30121⤵PID:5044
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=5268 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵PID:4436
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=6164 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:11⤵PID:4696
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=6480 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:11⤵PID:1744
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --mojo-platform-channel-handle=6100 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:11⤵PID:2128
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5972 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵PID:4908
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --mojo-platform-channel-handle=5540 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵PID:2280
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4bc 0x3c81⤵PID:376
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6740 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵PID:1032
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=7120 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵PID:3684
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1204
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=7096 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵PID:3724
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Release-windows-1.1.3.2\" -ad -an -ai#7zMap26952:108:7zEvent60301⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4932
-
C:\Users\Admin\Downloads\Release-windows-1.1.3.2\SteamAccCreator.exe"C:\Users\Admin\Downloads\Release-windows-1.1.3.2\SteamAccCreator.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
C:\Users\Admin\Downloads\Release-windows-1.1.3.2\SteamAccCreator.exe"C:\Users\Admin\Downloads\Release-windows-1.1.3.2\SteamAccCreator.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5b92a3fd584108784c41b412204d07665
SHA12b782d81e8c0656e7637aafd416353719126589e
SHA25683c22afb53e4149058dbfdbfae2876b142c0f08e234d98bb18de2de03f22a616
SHA512fd62a9c7b120588e456ca16720518256f0da7d294c2aeebacf9099c1dd020647214e882f3963d4b5140cd7c6601dfcd241857a45a3fcd3090b112b269f42f41d
-
Filesize
126KB
MD562e8fd2067e8c839887bc936e2082525
SHA141a35ace8a8127b10751b85b8254de89563dc2d7
SHA25608a28a270309ae2d79766391993d6f6f07653530b30130dff83a2f69a2b57f44
SHA5123f8246254bb0e0cb27c176dd93cd98b87e644ba17bf4449c9a4ce5e8557d007641c369cdf603ee545ae6a91a392ae71ae3e8e069ce21eac4fdf9acec70acaf1e
-
Filesize
1.2MB
MD5e120085659784858e06b711f67557e94
SHA138086b9b6a2f149a8e1b083b21ff28943c4c7603
SHA256586331667aa697c83a31a14cc417fe853f91a9a5d8fb1dc1ad8a5ffcbd4daa06
SHA512e660bd9839a7c5c4e06b92669fe5f6137793a988cac793ae131fd505b38642ce437f1c2b4e0609940670885d4027a03f5b4fa86c9da1a02144dc3b2b81f757d6
-
Filesize
16.4MB
MD5845d5d4b83fe5615c63483c95b94b751
SHA12a960f814e6662a42a9ed222f62efe75fafbe824
SHA256b08149b2ea8b8a1e99083299df95fbad7ab8f6e1b6d1652a6b07fc8d87893f47
SHA51294cff516add475d3e8f29b02f758a28dc29404ddc6b2ce1f411c79066e51a4340b7a732cd3052569f0d6b544bbe81eaaa4a27c14b63fa302ef437ce44d033b4d
-
Filesize
1.7MB
MD5ef45963c0e3273a09b23d8c0252b81a1
SHA1c19c5a72c7ebe9f6a165ffc176d702228f65fa98
SHA25652205a10d7de719272f9cff6575ae1deb46d8d5914fd77ee31f5ee7ec2556b8f
SHA512cc25461ec09dc59132848e7a69c8a93b42a885dcf7e0eea05fa85fb8c0d409982eb6589f54273bdaeac262912381c34efab8b957dfa56d7c9d8fa5865d55cadd
-
Filesize
157KB
MD53db1b5e66758c11ab44cd8b4cbdabd45
SHA1abd0773d86d1ff69c39f09b262bba47beb9c4bf1
SHA25607e1e38f7cb400e145d5a67d4924627f1bd156808cb68a1b5886a4c201ab6257
SHA5122d49d942ab6059cb1056d2e99fad638205e85c862f474433f9f8486de250f8d039c93af85f58ae5747a93e7f6975f345fc8ff58ec7ccc3c6291cceaa03b60ff3
-
Filesize
888B
MD582bb2e5d86056d238cbcbd754664b03f
SHA11d9fdbfc2aa3b815156cf02bcbce56f9d44e199f
SHA256261d9addb083ed1bb5930e8052505079e6f85d8a4022b396aa32113723f56b18
SHA512b7543eb338fca8780e7c8e820d75f86b955b5cf826dd2565731a66cd7863d136bc689ed7404f34d197a073eacbe3bb63a750baa39a20b426f455595b780d5b58
-
Filesize
687KB
MD56ab6175dacb43dd826baf8da387d4397
SHA1eb1a3b98080da2185ca05b2a581b7ce31acea241
SHA256e196c0b84fa16ca895565c0ab611715f0721425f5e73340ea183ffa049f7d79b
SHA51213271ed15df59d1fc2b9a4fd1996909e38bcca4af281f9a676220e6d5401a869c7a12457e30014120d3d858fda8c939d4027509d981f3f6483a521bdfaa333b2
-
Filesize
659KB
MD5d827dd8a8c4b2a2cfa23c7f90f3cce95
SHA126c78dad612aff904f216f19f49089f84cc77eb8
SHA256b66749b81e1489fcd8d754b2ad39ebe0db681344e392a3f49dc9235643bdbd06
SHA5129ce24c4497fe614b78b3f2f985cafb817d52f21d090aa23fd87f1a3478135abe95e0abe3557dd3f12a5b3f4c9a09e8337169988314c12c51b4951317e0569787
-
Filesize
177KB
MD55a498300ad5fca565ff423d220a4c051
SHA10439fe74ed57983e450079eef9ba9ad403700493
SHA256d917f63fbe3c67683e50734a48d63c1884c7664cbe321f44261b70df209f4c91
SHA512fe06193f46f2c114d31076c6fab563f46e10c7a961b3c61b311dcced18c91a282ef30fedd50993e25e7532457336001f93a94604a54e3a55f77845e7146ed012
-
Filesize
704KB
MD5e3522a14abdc6e143cf7d1137c28c9b9
SHA163e7560aa7a4653acb555140baedaf202b38a7c1
SHA256cee1c42ecd0bded02a8e8558e4fc72e71cfda2aa18c505cdad969b39c376e779
SHA512169a20fb28211ea60508aa26ccaa255cf5ed0f37942cd42313be44c5a0dc3dc98642766ab22c694f6d1093e69095d17468025a1c79a18ea71bfb2447553dd17f
-
Filesize
4KB
MD5b856c26bfc43cc1e2c4d23acad7dd9cc
SHA1bbc5d9a140cff45ca8d5ae5a622e7a64fc7689b3
SHA256e4545f958516644574d0a39fe2d9faba65ff7a8b0f87afe61f71b29910194939
SHA5123cbe9e0921c3ea8d00179eb9bf4881997bbf14d12b63487c5c26530cc75eef84c0d94935096bb18c31e73fbafed4d861d46fbea491c16cc83941128401e263b7
-
Filesize
900B
MD579e50c0c8c3a0285c43ba75645a96d84
SHA15adb08bf41dc9ce5809c7ec625c627995d5129f1
SHA256ca068401cdd0eeea329a5badb8abef98d7d669e038859f35dd1227e4736210fc
SHA5126747d2af9ee091c7072265497ed2630f74d81238cbe64ce9543fa594266745c0a762ee93ca94fc6080c8fbf5db5c586730a557efbdf5ff4d557d2d30244a9884
-
Filesize
1KB
MD5af89ad186cf6aeba853368586a6030c3
SHA1b5606e150cfb70132d8988b294fea0155addf783
SHA25636596dd812a77d0186b88ed7d316d3a62e6ed69ce4bc3652f32d4e221af1e194
SHA512cb60712bcfe522ba311cc23439b885200650873373f9d2a0856f6773cfc46666ab1a621a3337d40448764cf223e9330b21f4b1b003e08ba9d137a18e3e717a10
-
Filesize
4KB
MD5b80e353490f160aa0fe1982d7e041677
SHA1dc158aa2ff7cad12e58a0fa2ae0a0e90b87d2618
SHA256dc6869790f7ebf34ae84d5aa46edba9511eabdad29d2ce86de88eb2f9beffb48
SHA5127349cdc6dac54bb1f34b33dfe18ec8b90c6fef859f64100e0df4c1e2b33dfce3ec42a85b056351c8d77ce8ee8fdaa08661d1ca86f717dbb0a769519acfd43a05