hxxp://steamcomumniity[.]com/gift/activation/id=489501036

Analysis

max time kernel
52s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 10:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://steamcomumniity.com/gift/activation/id=489501036

Score

7^/10

steam discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
4856	msedge.exe
4856	msedge.exe
4444	identity_helper.exe
4444	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 780	4856	msedge.exe	86
PID 4856 wrote to memory of 780	4856	msedge.exe	86
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4860	4856	msedge.exe	87
PID 4856 wrote to memory of 4192	4856	msedge.exe	88
PID 4856 wrote to memory of 4192	4856	msedge.exe	88
PID 4856 wrote to memory of 4888	4856	msedge.exe	89
PID 4856 wrote to memory of 4888	4856	msedge.exe	89
PID 4856 wrote to memory of 4888	4856	msedge.exe	89
PID 4856 wrote to memory of 4888	4856	msedge.exe	89
PID 4856 wrote to memory of 4888	4856	msedge.exe	89
PID 4856 wrote to memory of 4888	4856	msedge.exe	89
PID 4856 wrote to memory of 4888	4856	msedge.exe	89
PID 4856 wrote to memory of 4888	4856	msedge.exe	89
PID 4856 wrote to memory of 4888	4856	msedge.exe	89
PID 4856 wrote to memory of 4888	4856	msedge.exe	89
PID 4856 wrote to memory of 4888	4856	msedge.exe	89
PID 4856 wrote to memory of 4888	4856	msedge.exe	89
PID 4856 wrote to memory of 4888	4856	msedge.exe	89
PID 4856 wrote to memory of 4888	4856	msedge.exe	89
PID 4856 wrote to memory of 4888	4856	msedge.exe	89
PID 4856 wrote to memory of 4888	4856	msedge.exe	89
PID 4856 wrote to memory of 4888	4856	msedge.exe	89
PID 4856 wrote to memory of 4888	4856	msedge.exe	89
PID 4856 wrote to memory of 4888	4856	msedge.exe	89
PID 4856 wrote to memory of 4888	4856	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://steamcomumniity.com/gift/activation/id=489501036
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e6ef46f8,0x7ff9e6ef4708,0x7ff9e6ef4718
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,5922937215710813127,12419316952759647023,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,5922937215710813127,12419316952759647023,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,5922937215710813127,12419316952759647023,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,5922937215710813127,12419316952759647023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,5922937215710813127,12419316952759647023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,5922937215710813127,12419316952759647023,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,5922937215710813127,12419316952759647023,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,5922937215710813127,12419316952759647023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,5922937215710813127,12419316952759647023,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,5922937215710813127,12419316952759647023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,5922937215710813127,12419316952759647023,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2936 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,5922937215710813127,12419316952759647023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00008a

Filesize
37KB

MD5
231913fdebabcbe65f4b0052372bde56

SHA1
553909d080e4f210b64dc73292f3a111d5a0781f

SHA256
9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad

SHA512
7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
1acf653cbd50f2204ef3a4bdad2a30ff

SHA1
f7e3768b082472b94ef15340f45008b867a5703a

SHA256
55dd7f437c44446a490e6e55117d9a5afbc4714b26d90d02dc3f4df8b8edf9f9

SHA512
07ff4b5ad1d9a54b880d3a874515e4a802e455fc2bd3610303f7817b5595f3535db3ef888a3ba00e077954d80f400d40a6c8e668719579d382858bea69991ff5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1b83a668a4391aaaa6d32f7ef7f6232a

SHA1
59e2877eb00bc2c19328c3314150fe2122b8b4ef

SHA256
b8e1970f9e1daf93ac529a5834a9464373c6f806baff470b995d1218168a702b

SHA512
d7847985053cc926ca40e62c90cf152e5ff6b1585a032c6b166b809ba1c0e83a9f358cf3a8373e9fd7199fd66646f5c9ecf66fe8d4e7bc29198ea659f4b8cf13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
facf14912468895e43c302e92c39f032

SHA1
2debc084b42e7be90ded8ab7fd6c267956cd97dc

SHA256
c31d763a3f32d597526d394b2d038bb4372da06b1d84f14d844eb1cd9350d061

SHA512
31eb3eea93561d2d934bd46a76195ee4ff33d2a144608e83a5efe3f4965488153bb06f6593ace6e0c8b1f637e0bce94374c2a8eca378cd9c72c97a66cd71ae1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7f06a82f88fa340b2b393b0018f4b5d3

SHA1
a2da612948f18c56db266a69afe27990a9cdabe3

SHA256
2d3fcae7a36aef7eb85b74ae65c9209a52afae2070422f42a92e674fdf5abe19

SHA512
facdfc60e61b85fce06f137d943fcb1609cc4bd3b4e07e8bcef42a9a611fc194ef7b6fd75c82eea766552855a90cbe19ad62ae2dfe711011f237984a1a24c20f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584c17.TMP

Filesize
876B

MD5
03237159356e8e90cfd865cacdb9713e

SHA1
96b73dd3f2e99e17155c7c5ced7ac53c48d973fc

SHA256
8fdb30d95d2b3e80c99686c478c418eb1dc44025007e608ce4b9326f45ff88cc

SHA512
fe3e9511e65355d33643e3e48111d09d65c6c29abde60afd7350e5f5c813c94a14a0481eb1e6841f52d48c8b1ccaa719ba7661ecd4326f314edc0af284fe9450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\df17780e-a992-44ca-9fa3-9d0619fbc8d6.tmp

Filesize
6KB

MD5
eb7c49e8c37e83ae243755d56086d79f

SHA1
1c8c41406747f8a06b0e179b024fa622b101138a

SHA256
5255c723c2f650dbd2ccee43947d5e07f4f69e73d3a3eb47337dc4258756e740

SHA512
696493496cb9acf34eed9494d6de71e132436f2684073dd884909d5f568a707cbda895cbded92852a5d88e133685007d99114878c57403f3b17ad0676f58dbab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
826c96e97ecc15e21f9593d249a374b3

SHA1
1f44716b3240912ef6a25a8dd81df2e67ab2004f

SHA256
509484a2c23c2db578f82dd0519acbab594b7475956d28997082bf9b156aa3d0

SHA512
858ee3725a111bbf2cfeab6fc1a51bb7f5f114426103c8aa9695a7ed181f7b54f2406bfc48d0907d5611256bd400a6e0db744b277bdb068a2b50180f8f6aff7d

Download Submit