Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-12-2024 17:14

General

  • Target

    https://store.steampowered.com](https://u.to/aigRIQ

Malware Config

Signatures

  • Detected potential entity reuse from brand STEAM.
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://store.steampowered.com](https://u.to/aigRIQ
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4272
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd4,0x108,0x7ffae5c6cc40,0x7ffae5c6cc4c,0x7ffae5c6cc58
      2⤵
        PID:2536
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1588,i,6714551629882581077,1728399558826832805,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1572 /prefetch:2
        2⤵
          PID:2924
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2148,i,6714551629882581077,1728399558826832805,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2116 /prefetch:3
          2⤵
            PID:4316
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,6714551629882581077,1728399558826832805,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2396 /prefetch:8
            2⤵
              PID:836
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,6714551629882581077,1728399558826832805,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3120 /prefetch:1
              2⤵
                PID:3668
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3128,i,6714551629882581077,1728399558826832805,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:1
                2⤵
                  PID:1476
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4512,i,6714551629882581077,1728399558826832805,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4532 /prefetch:1
                  2⤵
                    PID:5116
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4348,i,6714551629882581077,1728399558826832805,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4828 /prefetch:8
                    2⤵
                      PID:3460
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4436,i,6714551629882581077,1728399558826832805,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4964 /prefetch:1
                      2⤵
                        PID:4508
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3232,i,6714551629882581077,1728399558826832805,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3224 /prefetch:1
                        2⤵
                          PID:3460
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5052,i,6714551629882581077,1728399558826832805,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3352 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2680
                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                        1⤵
                          PID:2816
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                          1⤵
                            PID:2740

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                            Filesize

                            649B

                            MD5

                            3b1bb7440efcacbfa54cf9c9a551a028

                            SHA1

                            0f6386bc63290a6145d4183fb1bfd0367d437aaf

                            SHA256

                            3465aef494991ae9dd1b5f51228f8e329ed8b3fa839ec82a63b31fe16b52bbcf

                            SHA512

                            94d9001f29946218cb87189fddda6625b997ccf567ba2c35310128464e39b42aef264f7a6575486f97e6a8d71df610f93b86d6c15cbb4a234812699c43535bbd

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000079

                            Filesize

                            215KB

                            MD5

                            2be38925751dc3580e84c3af3a87f98d

                            SHA1

                            8a390d24e6588bef5da1d3db713784c11ca58921

                            SHA256

                            1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

                            SHA512

                            1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            504B

                            MD5

                            1434e6a9b4983187bddc0af88edb7066

                            SHA1

                            d491e0a3e0b3925d02d8a7152584401ee9d7bcfd

                            SHA256

                            8ee172157261e5c3b6156e54458e0315dae779e89d9d5fd82283d05d80acb871

                            SHA512

                            dab3274e6831743133bc94d7aea38239dfe137841753b0c6fe6aca370832f63715ce3378de9525aa4a32ce9e82d65a99fcb61c23e44e5442ab5da4c7170cb106

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            1KB

                            MD5

                            8bf478ef768da11d3f3054da787171dd

                            SHA1

                            0dfe42730e15ab16ec635560d7c804aca4728514

                            SHA256

                            fbe39c057a91396457f598b0f96425eba2f849a1b7c17ffd305b056e4145c8bc

                            SHA512

                            7411327d201900855dece8f75cab191e1520de3bca0a1e7ccf133fc452c81f842376e4791f2920b6dff1d09dc4b63f2220568710f5bda8d59c0628056dd3883f

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            2KB

                            MD5

                            a8fb479d788c2cdcdd0840498f3655cf

                            SHA1

                            2d17e7a6bff82833f8b527335425fbb174c36542

                            SHA256

                            7accf97ba9ebdd11b93aaa46782fc4e3498329a6f5d48823884a7f18e5c561f7

                            SHA512

                            0418d492f6078be1d11043c0237ebd7a4cfa8666dd17537110b4e75604717f07a460084a849102473688689ce723e4dd8e8069eb27c88361b5399140e5c1cf31

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                            Filesize

                            2B

                            MD5

                            d751713988987e9331980363e24189ce

                            SHA1

                            97d170e1550eee4afc0af065b78cda302a97674c

                            SHA256

                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                            SHA512

                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            692B

                            MD5

                            b5967d94f05b7beb6262c797691cc6d1

                            SHA1

                            2eda6c6c7ed99ebf1559d871c05a176b0d6e945e

                            SHA256

                            b1b3ac7a52e5691be212e610a679c28e425f2d1ce7c41b4b973a620d22fbf50a

                            SHA512

                            1d495312fc465b3ef42a7aaa27e7d837640295593da7ae48927f65674632e9abcf9e27d31b8725eacff11abe046054ff6d36ee6b5bb4062f086a875d23d5205e

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            356B

                            MD5

                            578a9844948d928a5df26a374538877a

                            SHA1

                            2dd498ab30397279efcabbcac914f00cf1c2fe4e

                            SHA256

                            c461ea2da8ba84a70bcc28701782cd333bceeaac8dda424bc7d4f02d210d5586

                            SHA512

                            61f11e8363c62888aeb42ba344b7f2407d24faad372d32c0d916bdcb3c8981680b538677289aa692f3723fdf2d322c7123a073264c3bbcb4e36e87133b63ac70

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            692B

                            MD5

                            dc849d0bf12059958867bfac2cba4fcc

                            SHA1

                            5a3aad5b0c6c8b733eb228357f6fda0fcdae5645

                            SHA256

                            6258116fab660707862588964b975ffec87d3d1aa8c91323bbbf43c211f9256d

                            SHA512

                            5a2fcd671416ac2c6bf51bfca81a487ce1002075c23e293e091f18028281f518b0633c50ce42fd2c1dd75435119a959ae297d7a82944447592ef0c6f32819530

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            1b2f5e4b0497cc5cd84feb14df9060a0

                            SHA1

                            054e942bf6d1660ef7325c68b63a07c8d60686bc

                            SHA256

                            bc6b85853d0b3e68e7461478866d83ce1240102adc9ccd1a399dbe35bb83d640

                            SHA512

                            43c25f305bc6a10092c027716db03abf9782a05e6f9b5d9e1ad72edd3a623be1a3afdf262ac1828140c4e64f0bb2659717e75d598019e9193175c65b3fb85ee7

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            10KB

                            MD5

                            edcdec879e3301de664947252fdf2d4e

                            SHA1

                            808ae959f27e047160db603aeefc3740018ec2e3

                            SHA256

                            00c87cb8306b12765648deb1e84075e8c33c9c7d4d1705d13fc31e06202c1457

                            SHA512

                            c04bc3fabd94aabd05c7d93b9a18c5dcd263281533ba85d7ac4e79409365d994225b3cbf59753c2f64ab47d44703806186193ab2489fff63551b601e4c9f6ae3

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            5cd5faf9a52e594b756e25489276bf2a

                            SHA1

                            c4e0a5d3cb7b90814e86bf3cfa32da0d12c2b10f

                            SHA256

                            5b5fc9de1d8d3a5efebb33c27705f32e47ed2bbe8d4344ae0272c3645488b323

                            SHA512

                            e954307af963c05f8b502b175456db1df31b09f3bf1a898520928eee4b9d3f47f98408b22c3f90ebcf9ef84753dcd78372d0edf0c378faac14dfc3f6d17faa6a

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            87fce34ef029c38d28bd5f5e28df5e05

                            SHA1

                            ac39a4ad4db56eec8b066a916b263ab718bd1049

                            SHA256

                            b23b3d0a51a215c071140c89ef9047c7cc1f6b9a1b526384b450e9b8063434a8

                            SHA512

                            0b860ffa6d4312a50476aa4150068c3b281ddcf3b7d99abefe02d83d048f9b55d8a087bb1d95536e2161c650fd58c2beb56e4ecd15c134412532cad42b88d342

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            5c485351592933ae0a0f527be7f55ab0

                            SHA1

                            2f047c43f113833931f53f50075506ddd17673ac

                            SHA256

                            f9591d8eb075206dd8e100e4ed7b1d8d09396edbb1aedc7d327c7907d6566a9c

                            SHA512

                            27c73f5db1f2d122876276ecf7117ced2eeb7e74425a5da70a205e6289b0bdcc01250ccf6702a1ad37cd8d580fdf4deee01203a0501f13a59afb88a7dd4e77d8

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            6608cddd0dfad9cfe7941de4469b6f0d

                            SHA1

                            d0ffabb30e12aca9840dadb70440043f602eff77

                            SHA256

                            6e3341e6b0096176cfbee5958cdc0bf80563fe4ac315501a23df0f80a13b8d57

                            SHA512

                            a8987b8c759fba380b3d644b7216df35f0f1ba96f761824fffe6de9ac529093a90f84e1b4697bc5a676a739adf3c0209a8151bb05dd1363ffe4bb0ef03cf3dae

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            930c9bdb584632cfb7fe914ce4777a91

                            SHA1

                            533129104e351f8c76b8a7685ddea3a37c9f177f

                            SHA256

                            075f3a154276e7a3f67710fc62f2e68f4a57602d5752f041fd48e9560c760a16

                            SHA512

                            7bf128c9da4cac6ec40d3e6458d84725be54e27608cdfdf6e7baea8b51cae949272e702f78737234d17506062e9d7e8e13418f59602a3552516110bab898e8ea

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            55b6327a5ee08446f8404c6722f4a157

                            SHA1

                            e10ae333a5ed444f0b37b8ffacc0d4d5258dbde5

                            SHA256

                            921563df354c55559b56e470d3cbbc5fa1ec067c1b9e4d190e835e9f51ffcc53

                            SHA512

                            b39db0fa32c180d3e3e5e64f4f555b189765de5e6d570e208af663470a1a6c18a3b42b408a5a7d6e5c33c149bdfb14f9e223ddff336f62fab1fdc5468bbea279

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            9cd5cb71e329d048fadcf650ea2a493e

                            SHA1

                            9ff3eca518e0e9eeb9bf1373dfebf17286a14c2c

                            SHA256

                            191debe3d6b87064dad4f0e2ed69ce3d17107366514817b172ff358d07fd0cb2

                            SHA512

                            91375ce60ace3e90fc3f0b741eee797c064ebced09a047abecbdebd79b33e333413c5cba752e3637285444e53a404b53c15bb09d105b6bb6ed3637cf77c31fa2

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            10KB

                            MD5

                            02f7bc4483a459bbd3e5a34ce66f3fd8

                            SHA1

                            4b2d9719a35642a659a183403705330131a1e5bd

                            SHA256

                            d9305d96d49fd500729c985c80c5c6b9420a7cf332b38b7c79e6c68e357db20c

                            SHA512

                            f8eecc2e237e821e5155d216779dd8c501b81d02f05fd7d0568cae050515ff95d3c5246bbc01dfb37554efb6de4d0072e00a1d898c894df2f8ba7e730244c5e9

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            116KB

                            MD5

                            22b7a6db0e21f2c7f026f7fb92977427

                            SHA1

                            673fabee143796ad623f6de71b2aaba043b08e8c

                            SHA256

                            926c1989ae388856625976ca1c6aa2fac373590325f8f2697211908ac413dc3d

                            SHA512

                            07f1741b79563219a38f97f76139d16959b68a957049202580fc8534c87d8e9b5186288031c493f8faa015641722f0e11f57adc53a0fa0efb955fc6c9afa8603

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            116KB

                            MD5

                            0a00fece3d304431c36b7001bbaca252

                            SHA1

                            43dfce3dc1de842ab84f5a0db1ba597d7ddd0ee7

                            SHA256

                            5366a298c0946030eda90dd34387b672d4b5e7c09f558840a64be88def5fb027

                            SHA512

                            4c7088b32484ee834fdadac48095c4b3a76d7f02e3bc40e3f4e58a3300bbfa6efb6f4c6dd28bd804d8d624794839052435e37325fc3a220149dc3a4751a3f290