hxxp://steamcommunmutly[.]com/gift/activation=Dor5Fhnm10w

Analysis

max time kernel
145s
max time network
142s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
22-12-2024 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://steamcommunmutly.com/gift/activation=Dor5Fhnm10w

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
924	msedge.exe
924	msedge.exe
6084	identity_helper.exe
6084	identity_helper.exe
5176	msedge.exe
5176	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 5240	924	msedge.exe	77
PID 924 wrote to memory of 5240	924	msedge.exe	77
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 3416	924	msedge.exe	78
PID 924 wrote to memory of 4528	924	msedge.exe	79
PID 924 wrote to memory of 4528	924	msedge.exe	79
PID 924 wrote to memory of 2188	924	msedge.exe	80
PID 924 wrote to memory of 2188	924	msedge.exe	80
PID 924 wrote to memory of 2188	924	msedge.exe	80
PID 924 wrote to memory of 2188	924	msedge.exe	80
PID 924 wrote to memory of 2188	924	msedge.exe	80
PID 924 wrote to memory of 2188	924	msedge.exe	80
PID 924 wrote to memory of 2188	924	msedge.exe	80
PID 924 wrote to memory of 2188	924	msedge.exe	80
PID 924 wrote to memory of 2188	924	msedge.exe	80
PID 924 wrote to memory of 2188	924	msedge.exe	80
PID 924 wrote to memory of 2188	924	msedge.exe	80
PID 924 wrote to memory of 2188	924	msedge.exe	80
PID 924 wrote to memory of 2188	924	msedge.exe	80
PID 924 wrote to memory of 2188	924	msedge.exe	80
PID 924 wrote to memory of 2188	924	msedge.exe	80
PID 924 wrote to memory of 2188	924	msedge.exe	80
PID 924 wrote to memory of 2188	924	msedge.exe	80
PID 924 wrote to memory of 2188	924	msedge.exe	80
PID 924 wrote to memory of 2188	924	msedge.exe	80
PID 924 wrote to memory of 2188	924	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://steamcommunmutly.com/gift/activation=Dor5Fhnm10w
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff82adb3cb8,0x7ff82adb3cc8,0x7ff82adb3cd8
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1832,17106282417550056233,866688235280662875,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1832,17106282417550056233,866688235280662875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1832,17106282417550056233,866688235280662875,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,17106282417550056233,866688235280662875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,17106282417550056233,866688235280662875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,17106282417550056233,866688235280662875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,17106282417550056233,866688235280662875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,17106282417550056233,866688235280662875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,17106282417550056233,866688235280662875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,17106282417550056233,866688235280662875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1832,17106282417550056233,866688235280662875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1832,17106282417550056233,866688235280662875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1832,17106282417550056233,866688235280662875,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6140 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0a1774f8079fe496e694f35dfdcf8bc

SHA1
da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

SHA256
c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

SHA512
60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e11c77d0fa99af6b1b282a22dcb1cf4a

SHA1
2593a41a6a63143d837700d01aa27b1817d17a4d

SHA256
d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

SHA512
c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\28e34c4f-a3c0-43af-aa41-043158291785.tmp

Filesize
5KB

MD5
3ec68aa4627663d752b7651bcb1f7882

SHA1
3d7e2deedb7f25c1efd00c74ecebb278a4ce4cd0

SHA256
cbb858ea84eac3f108d9b6c9d99c1b2a4af8d5b2af49f02722891c64f4bb9930

SHA512
f8f73f1bfb61931d15cf886977f14b6e1008710c6dd0640e99128fcbcd1d3716bcc3bb511e265ea587e3f001f6981269784c7ffd098f84da19c585c99736325b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
016149e0f339da4acf10c3293cf26333

SHA1
8c7a4f4ea8fa2ba06366af0c5182386bdef196a4

SHA256
6d13d8d121f384b3b668f68b9e2536b8cf77201b243f04f8dfc2a7cba0cde48a

SHA512
59440467e6316511bbbfe26d5e74bd510aa6d398e18643d17e14c6f88534ff3e13bd5b7c907fbcd93b5043268763c0a4323670b896c7d661c0ad71477d0a1d43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
418B

MD5
c32a44cf7f16757b7554d51fa88054af

SHA1
dd40f6979117aed1885ff64e9b48e2efcc18b96f

SHA256
cc0e7cc4e8b3cc198543e262f430635c41107701cbdca29e7a8c3b4ed53d3fab

SHA512
61bf70f5b470bed4e32fd6d3d51232ace4ba934bc8af6ed2560d508c177fac6e0b8ac7bb8a0fbae02e2b7246107b6b971e20d69a6d107c3ab76f6dcc5f6eb87b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ddcbf7b47d5df34e106be1071fbcad39

SHA1
86af7451e78594f127907d05506cd2f2e447a327

SHA256
da019e6eec76a2a540f9ed9a6f6d4786fb3a36d407f90c88bd2cd45a26d473d6

SHA512
fd78414020fbdc99a2039d14bb8972bb0536a89a8cfafa1226b5da4c72096b85dfd1c0b506881896771ef1f2c5535ef28a1e5a252f95d6d541edb8f35e29f1e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d9a9ca862d4336c86e0810c93529b23

SHA1
779b938c302e14e5a8dda550348774e15ed63cd1

SHA256
53f91973b019a8d3b41fc4e650d67e770c2217d3634ab38e748c37c282a1361b

SHA512
b2079cf4d0870f64635ee38480c9ce18a15cffd464ef722946df5f8ea71b23921c9dde968e0f66ac54c9defdd922bf61f57b3c33ffefee31ef8e778ac43baaf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
15829780984b9452f08c4cfa2e46beec

SHA1
a96a46642607fa21e04dc12f56e9014224c0d44f

SHA256
b5f85f8d5d96d10113144e3d790039257bd94540158027b10d623c2b8f233103

SHA512
2281272222be515c999b47939776076e09e58efa37ca7400001a986b795ad3c91ff0f96c108b23c56976d8357e21f37e9047a17872c78e2b63346c3462739747

Download Submit