Analysis
-
max time kernel
148s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
15-05-2024 16:18
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://steamcommunnittly.com/gift/activation/feor37565hFh3dse
Resource
win10v2004-20240426-en
General
-
Target
https://steamcommunnittly.com/gift/activation/feor37565hFh3dse
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1236 msedge.exe 1236 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 2244 identity_helper.exe 2244 identity_helper.exe 5568 msedge.exe 5568 msedge.exe 5568 msedge.exe 5568 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 932 wrote to memory of 212 932 msedge.exe msedge.exe PID 932 wrote to memory of 212 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 2824 932 msedge.exe msedge.exe PID 932 wrote to memory of 1236 932 msedge.exe msedge.exe PID 932 wrote to memory of 1236 932 msedge.exe msedge.exe PID 932 wrote to memory of 2128 932 msedge.exe msedge.exe PID 932 wrote to memory of 2128 932 msedge.exe msedge.exe PID 932 wrote to memory of 2128 932 msedge.exe msedge.exe PID 932 wrote to memory of 2128 932 msedge.exe msedge.exe PID 932 wrote to memory of 2128 932 msedge.exe msedge.exe PID 932 wrote to memory of 2128 932 msedge.exe msedge.exe PID 932 wrote to memory of 2128 932 msedge.exe msedge.exe PID 932 wrote to memory of 2128 932 msedge.exe msedge.exe PID 932 wrote to memory of 2128 932 msedge.exe msedge.exe PID 932 wrote to memory of 2128 932 msedge.exe msedge.exe PID 932 wrote to memory of 2128 932 msedge.exe msedge.exe PID 932 wrote to memory of 2128 932 msedge.exe msedge.exe PID 932 wrote to memory of 2128 932 msedge.exe msedge.exe PID 932 wrote to memory of 2128 932 msedge.exe msedge.exe PID 932 wrote to memory of 2128 932 msedge.exe msedge.exe PID 932 wrote to memory of 2128 932 msedge.exe msedge.exe PID 932 wrote to memory of 2128 932 msedge.exe msedge.exe PID 932 wrote to memory of 2128 932 msedge.exe msedge.exe PID 932 wrote to memory of 2128 932 msedge.exe msedge.exe PID 932 wrote to memory of 2128 932 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunnittly.com/gift/activation/feor37565hFh3dse1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc314346f8,0x7ffc31434708,0x7ffc314347182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,2360274077243909422,3009853376077976248,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,2360274077243909422,3009853376077976248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,2360274077243909422,3009853376077976248,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2360274077243909422,3009853376077976248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2360274077243909422,3009853376077976248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,2360274077243909422,3009853376077976248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,2360274077243909422,3009853376077976248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2360274077243909422,3009853376077976248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2360274077243909422,3009853376077976248,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2360274077243909422,3009853376077976248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2360274077243909422,3009853376077976248,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2184,2360274077243909422,3009853376077976248,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5948 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,2360274077243909422,3009853376077976248,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
384B
MD5e5b8cacedc15e6b237d52aec96cb66e5
SHA179a864824016088edda7a54cbc7ef8386dfa9b5c
SHA2560cdba93774e2612bdf0aaee9536a6925155646d075137f31111087ae72cb30fc
SHA512bc1e6c5ebd112af13bb51885cdb1fc5bc17e651d454a41dd19c500c7bd0bb9b5807b49ac8f891c29759de2e5a122a53851d2bdd57e13964c567928c1eeac0292
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
545B
MD51e96a2ca0ce8bd2d967958823abb8d2e
SHA1526c068d9746ed9d8a3d6e65c2df70f4a395cfab
SHA256c633f515f288706bfde1bb8857f83890376106af475d57bf2354d38869f9ee01
SHA512eaf4aa7d09a0031b2e15041960ab73b6698e21281ae8f16b2e837a255b1f7c3f3c67debd18ff0a028729d45fb434c2f1b7496b180e25fd6964b75b8717f77a2b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5d5db69db5228ed48deea9a8c43244ff8
SHA1f0c79a88231067a7d2bef5d56c94fa790247968a
SHA2568af418c0c86d91026bd2036d400c46668ec291a4a54df55db8aa1065cbfd5852
SHA51252b3771e57b12065ab2a2099a3e30f4cfc46eb8009f53a5a791c8f838fb7e6133737e0551a87e0d6966220b5cf28f0113ed15489a9e7a153ff42473631fe078d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5cff8ee269b4df95b82beeeb7a1ffc6f8
SHA1ae94ec94bd0fc07b158f50e719594e4bdfe5cd20
SHA25635253f79ff518b97eb43ab499e78322e3271ae5d79d34f7e132cf3390e2159a1
SHA512f77dc86e9daf87e8d321b35439482949de10c5da12cfba278a93e5ffb188fd5507d65eaa7fbb51293214e0673cf203bc0ab76f642e5aca539091106c3d6317ac
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5fe63e87725733fdb2383eae5f2ec6c88
SHA1f37f658ef90be2e097c2e6dfebc7338349a2a706
SHA256c0e117cd798a3e1962b28aacd4a2775e5813e91f68e5932e3a5acb36c7f30e0e
SHA512441a1d8cb0e65fe2a289da43c6fd3286b693270419ac648268034da6a43dfb3492c93776c59a2fc34a35cb811d6c9ec25754766d86c9e763a887bdce56554bd1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5d1c266d7d5e0fa1aefddcd0debb30359
SHA1b4479c4252a2ee3886c4e077b2c2c02ba85ae107
SHA256bf8c10528f4fb3d6fcd884705bd12d6eb73b805d62dbec3c5e951c70c3e90338
SHA5129821d6558ec8e9940c29ccfce08d24958885304c11f92cd39fd76151f033f267a1340edb2dc0a2e0b5aeccd37778776af3c1ceaf7c6281a162e87b011768472c
-
\??\pipe\LOCAL\crashpad_932_YMORWVHCLWRSCHJZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e