hxxps://steamunlocked[.]net/9a2048-half-life-free-2021-download/

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamunlocked.net/9a2048-half-life-free-2021-download/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2244	msedge.exe
2244	msedge.exe
744	msedge.exe
744	msedge.exe
3640	identity_helper.exe
3640	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 3436	744	msedge.exe	84
PID 744 wrote to memory of 3436	744	msedge.exe	84
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 5108	744	msedge.exe	85
PID 744 wrote to memory of 2244	744	msedge.exe	86
PID 744 wrote to memory of 2244	744	msedge.exe	86
PID 744 wrote to memory of 4968	744	msedge.exe	87
PID 744 wrote to memory of 4968	744	msedge.exe	87
PID 744 wrote to memory of 4968	744	msedge.exe	87
PID 744 wrote to memory of 4968	744	msedge.exe	87
PID 744 wrote to memory of 4968	744	msedge.exe	87
PID 744 wrote to memory of 4968	744	msedge.exe	87
PID 744 wrote to memory of 4968	744	msedge.exe	87
PID 744 wrote to memory of 4968	744	msedge.exe	87
PID 744 wrote to memory of 4968	744	msedge.exe	87
PID 744 wrote to memory of 4968	744	msedge.exe	87
PID 744 wrote to memory of 4968	744	msedge.exe	87
PID 744 wrote to memory of 4968	744	msedge.exe	87
PID 744 wrote to memory of 4968	744	msedge.exe	87
PID 744 wrote to memory of 4968	744	msedge.exe	87
PID 744 wrote to memory of 4968	744	msedge.exe	87
PID 744 wrote to memory of 4968	744	msedge.exe	87
PID 744 wrote to memory of 4968	744	msedge.exe	87
PID 744 wrote to memory of 4968	744	msedge.exe	87
PID 744 wrote to memory of 4968	744	msedge.exe	87
PID 744 wrote to memory of 4968	744	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamunlocked.net/9a2048-half-life-free-2021-download/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc179d46f8,0x7ffc179d4708,0x7ffc179d4718
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,9956297435282680491,10109023702456024501,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,9956297435282680491,10109023702456024501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,9956297435282680491,10109023702456024501,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,9956297435282680491,10109023702456024501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,9956297435282680491,10109023702456024501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,9956297435282680491,10109023702456024501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,9956297435282680491,10109023702456024501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,9956297435282680491,10109023702456024501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,9956297435282680491,10109023702456024501,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,9956297435282680491,10109023702456024501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,9956297435282680491,10109023702456024501,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,9956297435282680491,10109023702456024501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaaad45aced1889a90a8aa4c39f92659

SHA1
5c0130d9e8d1a64c97924090d9a5258b8a31b83c

SHA256
5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b

SHA512
0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3ee50fb26a9d3f096c47ff8696c24321

SHA1
a8c83e798d2a8b31fec0820560525e80dfa4fe66

SHA256
d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f

SHA512
479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
bff6e5f02ff65b25f10499277adb2641

SHA1
2ebb3f46b0d19df50c188fe657883fc1e9827838

SHA256
c5e0a22ddfb6d81d6abae723c69d590b77a70dc4559b253e92381f5633e05e82

SHA512
539b4eb641c61e9ef70b4e3d77ca943e87d5df209b440017b0fe2cecb17451a5ba0d856d7d95f3eea0593c2367de529cec1b677d2cbb7523cd365456b2215b22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
f23511cbfea1cab234a8ff1ba9b79aef

SHA1
4ba429d9f0d03dc5bed69a908bab60a6ac8ecda1

SHA256
65c5c45a04e0825ff15bb5e550195739c95799b999cd745c93810bfdb54d725d

SHA512
f66d3ef469842defc03594b5cd7bc90e70ba2620da02cb66ade359523bb812705b91457a226112ecdee4ad0b2160e49fa14bdc623fb2c5cd199f90cc002868fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
990B

MD5
169f893f465db71c51210863fd7ef913

SHA1
c5b7d5517fbcead292b1c9068afa2664768e1a2c

SHA256
0fb02e1c700931369e6e6a599a81bbbfa1e5e43c1500dad730fda02bff56a5a8

SHA512
50b8c747a1df68750b0809962dc3bb317d3abee1a9c09df3add41a0101a22887c7a45c41c38df2c855b89ee1ef53650b363c36188332cfbd1aae4d12b595c38a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fee33df529e3940f66a84ff23cd41055

SHA1
4ce3272d751e1d3ffac27458d63f56299382c3ba

SHA256
0f6364186f12074437b34aa442e27964205d8cf7fd19a6169d80819d281ae34e

SHA512
5372c2499c479cefcaa3bdd2209cf1c2fdb800eaf61533fd1e9df11b0cd9bc2238ed8d8287aaddd6713cb6ac7b4120d280daa833f5c045d7ec625fae76f5f100

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
95b46a3fa3988d406aad30cf380e20de

SHA1
769e97d2d197a0dcd843da8483249cc1fc91d5b4

SHA256
0205a0dde40f89854516244035863e7693858868858560640b8fdadb599b918f

SHA512
c9318f8058350b975dfc4ad268d07a27c1f4cc9acf032cc2d05ca9fda83e0a4cd3bfe1fe8f574bd7ab4061d7d1cb08cf6a3f98d81c74d29bacf94c608375cfe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
60ce11770b3c625148ce24a78d92ca0d

SHA1
25a18e70903723610c324ff786951258ce28f817

SHA256
8d3ceb291ca5de68e1dec4a266f0b4664299eb120a66a919c0a46b26792a56ee

SHA512
609d890cf94b3939d0703fa4e37f2b67df4819c46d75038dfe9f6b963253bd80f8872588846200e30c1b6aacc8b7dbc34e3cd37b863d2260430ee1fc801c0eab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
8628576b2a74ab647c6b7ba4677f936d

SHA1
f8e6f09fb6573470c124b8ee16282b1b870c2af0

SHA256
ac85213bb7c0849884cf7bc29637e60b2539d9976b1b9df6af0cb690edd23c7e

SHA512
62ff02e778d3db13fd116123d8d323fd0b7a5456d255c1de356be17ee66652cfbac41a7e3d2b81368f705e86f37e4f70231b7a2c05d0aa29871d2146dde213f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b9e5.TMP

Filesize
371B

MD5
1ea747bf8f71cb862844e8ca1b7a974e

SHA1
5c3f5545afc2b927230063a557343d7b36dd6f35

SHA256
d2022fab4f423db3f60349b3cbcb8310e091d77677703ad403ad0b12f80079d3

SHA512
bcffe35736f836cff675846c45f6a931d3c50a76669a74a985da3b01027fbe6f0e067136c96a75fa3c697d6367bc2b213d7026f0a4834f55b32aa33ee5f3e79c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9240a701ba36f423cb966646edf321b1

SHA1
5b0e4cfe1d278964145acaff025ef60c5bef606a

SHA256
98bdb630cb2cc7c33877c20b59a274e1bddb5a559bfad773e4ddf5729070b9e0

SHA512
53e480398813e749548c4139084dfa23f42dc66fdaa7af4a24ee78be6fe954fb222de97ee9574f9cffbd07de035c740fa28acf4bc19a711e5a3aa790f015db04

Download Submit