Analysis

  • max time kernel
    90s
  • max time network
    55s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17-12-2024 17:15

General

  • Target

    https://store.steampowered.com/

Malware Config

Signatures

  • Detected potential entity reuse from brand STEAM.
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://store.steampowered.com/
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3788
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a130cc40,0x7ff8a130cc4c,0x7ff8a130cc58
      2⤵
        PID:4196
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1812,i,2669748353459259992,18112043821800763566,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1808 /prefetch:2
        2⤵
          PID:3868
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2032,i,2669748353459259992,18112043821800763566,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2104 /prefetch:3
          2⤵
            PID:4276
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2164,i,2669748353459259992,18112043821800763566,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2192 /prefetch:8
            2⤵
              PID:3772
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3044,i,2669748353459259992,18112043821800763566,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3088 /prefetch:1
              2⤵
                PID:4660
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3052,i,2669748353459259992,18112043821800763566,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3248 /prefetch:1
                2⤵
                  PID:3276
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4632,i,2669748353459259992,18112043821800763566,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4644 /prefetch:8
                  2⤵
                    PID:3140
                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                  1⤵
                    PID:3948
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                    1⤵
                      PID:4804

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                      Filesize

                      649B

                      MD5

                      be8868d3bb0d9803ff515a9e6aba9185

                      SHA1

                      ea2339ad7e1f0308ae79515f64d57d4e0389486c

                      SHA256

                      bcdf63ccf0d76e9084095791ece780779c7b43f29584b82367ae3b1ea12f3b68

                      SHA512

                      45bbfd0b2f295587160a3005854eb0fcabb01e1286e2a10baf196e2066d087f85df3ac362b4f18d6184ba0b26b933e03d3becc0ab901b2321d6e71ce03832850

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                      Filesize

                      504B

                      MD5

                      7faeb1073471f2db03cd1aec56b0a9ae

                      SHA1

                      3326962b2c5bd7e6b4f7ba3f3466f193cee4b368

                      SHA256

                      dd1649fb16fefbde139fd258d088f1098610aeadd14968e62c27d9ed2ecddd4c

                      SHA512

                      d528a2f2e5f088135db6df54f51e43dccf36e9a905219a32e104a721d5472b8c8fb65b79a5dfbd9d758f231118a6209c9ea756e4ce8be24946f5323a58a4a512

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      1KB

                      MD5

                      42428fcf7d2b4884d26d85ebcb620299

                      SHA1

                      d7939c1741c529765102129f4f635fab3297cf03

                      SHA256

                      5e071368ba6a9260cc6ca527cf3738dc644047e25bba621304d6586411c11c5f

                      SHA512

                      acadc8f5d16dd098a4b7c81cbc895ec02331adb08b0d8084a76f0c9fb697444d290d723689e75f21e1d8d608bce44b421d04a94cc68e2ac5b7f6304789805bab

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                      Filesize

                      2B

                      MD5

                      d751713988987e9331980363e24189ce

                      SHA1

                      97d170e1550eee4afc0af065b78cda302a97674c

                      SHA256

                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                      SHA512

                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      692B

                      MD5

                      00d87f840b5e76c20aa7f31e6f874ad7

                      SHA1

                      b8f9356198cc68053869a7164c62c99f7f6c604a

                      SHA256

                      5c1594af5095e3d3ae49374aea6c3fedf920541aa578da05c43dc50e9bbd3461

                      SHA512

                      d6a1c602ae11786c89600107a89e72ba9aafe0fb5331fe5ebe9f2920b557146a6f1d9ecd2d46b4c3278bda90a485fb2b56964ec2739f1ac2a6152b02b53269f9

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      df896d68b7ffd0f1baa652e618d2269f

                      SHA1

                      b0facc440a2e5fa44ed0224913094fe1f00dd404

                      SHA256

                      ac258a1ea6a2d12b242cd1bb8fc29328ff9ccb0f35db5966cef9826881edfc37

                      SHA512

                      1734e50237c81c8e2e11472ed38f8f4b293037b2d1feee26eb51f09ab1fee7068fc16cfbac66687101f07a183b7833ca7b2ca9bf198d5f68134be63e7087e659

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      0e796a79000e70e5c5e081aa2d5110fb

                      SHA1

                      494660a5b632f797cf47cd9e5e5eef8bddaab537

                      SHA256

                      b4a23a1507817df4b4fa5d986b12302713caf5d5d20b9d6db8447921699b4a08

                      SHA512

                      b3d68f7cd6715712835ab368b5b0b343362885a7e21a239a873c30e01a55db44695e967c3f3a7b87ac9802484289df0b0e62b3b30480d4c7d5ea11d9ba9adb07

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      a004b5474bc33aa7177e0e27c1fdfd5b

                      SHA1

                      4dec42b7f4f59df328d9b24d745978553a752445

                      SHA256

                      51d4cae71a5cc75d5e1b307fbcbf147ec282138f80956aab4c928c7c417550f2

                      SHA512

                      1e5954a1b20510953c0dccc5ffcbedcddb9c119c531037c8b144597e1ea2d52b416301a42dc0008c55d85acac85035010d6543a4933109bac1d1fbe256b9a766

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      519bf55be235fd56e6bb53611a926322

                      SHA1

                      2b12b42b2ea0724174f6cc6806e42366ce784593

                      SHA256

                      8d10a5359ed63a905fe5611a67f3afee18997f952e724d8845c022e335ce9065

                      SHA512

                      c1c1dca8a366506b96a9c7a7afc52ebfa02bc5dcb1990ed5f839111d412e1ebf6d502bb649f256de7497fe1c5ec2057aa3ad8b33b239792654c37ae7ec3087b6

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      903966109b066a9592522f32ec2521a4

                      SHA1

                      8ce0f1b860daaf0104004759b706fafe116c7ca8

                      SHA256

                      e07c3ffdbf48d955be72e85f5ec99beb05d3ee0322f0b4a891429307f10cc567

                      SHA512

                      08be04b2172bd62020d19c73c7a96fc981ff7dc458926ea20f38fd5034ed145948098f8d511ae15fce3ba3b84b3b8cb8c39ef80a87e206409a999c199442c4c8

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      e173fc014d91f499e2b2643607626324

                      SHA1

                      063e683a580eaedb7db0477ab9914eecbc38a155

                      SHA256

                      c031ed7d0346c77331397416165d43eda5d1b2730f1632964f3a3f50d55da0a4

                      SHA512

                      52b2ee3ac2cebd61d7fa56a1dd27d52b4f92ea5a348d3aa318d266f9ccc21b9caa833cccb30a89d75c401690c6181a86a72be824cfc933e877fb378e85220b5e

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      228KB

                      MD5

                      32248c321ae35bf06f6108a013b1ac17

                      SHA1

                      f44daedc960a405aa18fc7cbfb27b4be6bc4c8a9

                      SHA256

                      49554840195a985994d4fc3b7374f35450bda7fe857349d77d8dbcb596c3ca79

                      SHA512

                      6e9b87de893254309eb2edc114e30f8fb30394197937b1ab6b31f5e4cd71611649c188469a6c448a9363d63b032292db2770d0dee8ca494f2238fecd34880154

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      228KB

                      MD5

                      2dfdb69b762c3b79afec52e34946a844

                      SHA1

                      67c3bbc78cbd32c588a155b21ec4a136efe58363

                      SHA256

                      704ff0cf3f5507137b867fdff70ca48cf926a82150f77ed441feca8e27e8f035

                      SHA512

                      69f5fd7483637a08164cf2d74a03101e988f73269c5494d0c11305f6fd7aa9145750d93ada3c3f838bae9fa83a59894ce4f871da0c1303df7ed85b007e17ecab