hxxps://store[.]steampowered[.]com/

Analysis

max time kernel
150s
max time network
160s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
28/07/2024, 08:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://store.steampowered.com/
Sample240728-kbf5bs1brd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
3692	msedge.exe
3692	msedge.exe
1060	msedge.exe
1060	msedge.exe
1392	identity_helper.exe
1392	identity_helper.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 1372	3692	msedge.exe	81
PID 3692 wrote to memory of 1372	3692	msedge.exe	81
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 2476	3692	msedge.exe	83
PID 3692 wrote to memory of 1660	3692	msedge.exe	84
PID 3692 wrote to memory of 1660	3692	msedge.exe	84
PID 3692 wrote to memory of 4148	3692	msedge.exe	85
PID 3692 wrote to memory of 4148	3692	msedge.exe	85
PID 3692 wrote to memory of 4148	3692	msedge.exe	85
PID 3692 wrote to memory of 4148	3692	msedge.exe	85
PID 3692 wrote to memory of 4148	3692	msedge.exe	85
PID 3692 wrote to memory of 4148	3692	msedge.exe	85
PID 3692 wrote to memory of 4148	3692	msedge.exe	85
PID 3692 wrote to memory of 4148	3692	msedge.exe	85
PID 3692 wrote to memory of 4148	3692	msedge.exe	85
PID 3692 wrote to memory of 4148	3692	msedge.exe	85
PID 3692 wrote to memory of 4148	3692	msedge.exe	85
PID 3692 wrote to memory of 4148	3692	msedge.exe	85
PID 3692 wrote to memory of 4148	3692	msedge.exe	85
PID 3692 wrote to memory of 4148	3692	msedge.exe	85
PID 3692 wrote to memory of 4148	3692	msedge.exe	85
PID 3692 wrote to memory of 4148	3692	msedge.exe	85
PID 3692 wrote to memory of 4148	3692	msedge.exe	85
PID 3692 wrote to memory of 4148	3692	msedge.exe	85
PID 3692 wrote to memory of 4148	3692	msedge.exe	85
PID 3692 wrote to memory of 4148	3692	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc9e9b3cb8,0x7ffc9e9b3cc8,0x7ffc9e9b3cd8
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1740,14529668495264302256,1192720183227763256,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1740,14529668495264302256,1192720183227763256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1740,14529668495264302256,1192720183227763256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,14529668495264302256,1192720183227763256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,14529668495264302256,1192720183227763256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,14529668495264302256,1192720183227763256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,14529668495264302256,1192720183227763256,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,14529668495264302256,1192720183227763256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,14529668495264302256,1192720183227763256,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1740,14529668495264302256,1192720183227763256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1740,14529668495264302256,1192720183227763256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1740,14529668495264302256,1192720183227763256,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3088 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 22d8c228cdcfd3e05431d7377748014035a3488ad3a0d4aecc334e724245a1f9
MD5 f1d33f465a73554cd1c183cbcd0a28a2
SHA1 f5c16fc4edff600cb307f762d950500aa29a1e8b
SHA512 7cc94f77f3943143ee86eabbfddcb110ce52c6ff0975842e3a3d06072f51f2c48914ee61f24484a539888ad19a7e6a1becfb029485cd5984bc736434a63cee95
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9da0e657652daa1ef86af7c3db62b0af9cce372a5f765c98c68479922ccf1923
MD5 575466f58c7d9d3224035d23f102d140
SHA1 2fce4082fa83534b3ddc91e42fb242baee4afa1c
SHA512 06503e718fe967076dd8a061b57debdc663b9616b005f8567099a84fc7184880633079335d622c243918efc3356b40e683708fb0583084abeed7db6168a212ab
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 f5f0ea9d4d0c8c686cad40af32ee8ec9a30271d62fde7a96b3496f5e3ac5473e
MD5 03c09579b911641cac7c0cf76910d150
SHA1 6c9c752f975f0047d0330cb97330cfd61e306ab6
SHA512 ea22f5eaba8687dd24c674c360241811a9509bddc6ca73fd294bc783c95ccfa92681727ae4129594873088673f76442f2702507138b6df3c8869f478138dc43e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 275B
SHA256 cabc6088e7e9abed44c889789eff6bfe7091ad8b67fa69c207f777ad46ebaac7
MD5 e03fa1f420eff5f9c1c71d2cc33edc30
SHA1 31b0be49243eda6a446c302f6f9fa4b9fd51771e
SHA512 f1492c8a80a10e814cf53c8c88e7e3f3e76f45888b388408dfea074cfed874f88595b142637ff5d085d67f34b705ced126928a34475e2000d12d839901f05965
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 5e18971e14d51a2e1f6d80929a9b73348fb5f3f4c83861eb00a0821663598899
MD5 487d86a9592329eb9054eae979964d49
SHA1 303deb03c7653d94b54c6e4ef01e3c93a48b55e9
SHA512 135e184508bb26679fe72f75a56c2b7763950beba80fa4649fd1cf04a6f57a392610c9ae751e9ddb31f2b598154e6e3200304d53a89adbc383fe272802316bae
SSDEEP 96:nNk3XakKkf6eTwSv0MoiVmdHIUJY0WQyV+VpziX3wI3:nNk3qJkZTv0MAIyYLx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 babe2d16d53b41a05cd4bdea36de8025a6ed76f3bfb6b27c41b6742dfaee4cb9
MD5 458c23fa8b5d5679affb57e3e785d2a6
SHA1 8b62c12a8f175ff0c51c82b5f447ab0af21d2623
SHA512 0160a80905cf2dcf8ef6352591612e6c8c75ea804990c936636663ce9feb0cbc5558b344987e49d2390266643343747a540c2c0d905f393366d074b345302c66
SSDEEP 96:nNk3YakKkp6eTwSv0MoiVmdcMu6uu1jIMJY0WQyV+VpAiX3wI3:nNk3ZJkHTv0MbsuuhIaYLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 12ec3df4a0245fd3847d9b8574d7fd58f3000933f154ed90f0b4d67892e60c40
MD5 0a293feb1867398a94de491c8c0416cb
SHA1 9577d3ae4ed82f0288bd21161d8a904fe9a08c34
SHA512 1a2f77a080d51a9d8abcb3dc6b0f0548d1149adb7fdf376ad00c444f7215e6a41a0d3381ccfb4b9b86dee51bd624c733ee770fb63836fece5d67d4d66471acfa
SSDEEP 96:nNk38akKkp6eTwSv0MoiVmdcMuhbzU8IHJY0WQyV+VpAiX3wI3:nNk3FJkHTv0Mb3bz3IpYLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d52fe93a67079ca764430783ef00224853836da7060f698522f25425292b19d8
MD5 a1534ce65ccf313423991ba00eb47b7f
SHA1 d753f9407c57fc459517ed26a2a0aa7a45f9e72b
SHA512 5b67043e032daedfad0a6442605f5e2c60275f0f0c7e64b15e4dfdcd7cdb985c653e1a747d4bb259077f6a48bfb3b06a072865a968781b87e555cab2e6fce30d
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG3C+je2RU90RPRDI2f3d5fx1B:M9iIxuERzA83h09RZxASGjz4uRDI2Th7
MD5 SHA1 SHA512 SSDEEP

Submit Download