hxxps://store[.]steampowered[.]com/app/3184660/GunZ_The_Duel/

Analysis

max time kernel
25s
max time network
21s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
30-12-2024 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://store.steampowered.com/app/3184660/GunZ_The_Duel/

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
1012	msedge.exe
1012	msedge.exe
2088	msedge.exe
2088	msedge.exe
3552	identity_helper.exe
3552	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 1072	1012	msedge.exe	78
PID 1012 wrote to memory of 1072	1012	msedge.exe	78
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3364	1012	msedge.exe	79
PID 1012 wrote to memory of 3408	1012	msedge.exe	80
PID 1012 wrote to memory of 3408	1012	msedge.exe	80
PID 1012 wrote to memory of 2664	1012	msedge.exe	81
PID 1012 wrote to memory of 2664	1012	msedge.exe	81
PID 1012 wrote to memory of 2664	1012	msedge.exe	81
PID 1012 wrote to memory of 2664	1012	msedge.exe	81
PID 1012 wrote to memory of 2664	1012	msedge.exe	81
PID 1012 wrote to memory of 2664	1012	msedge.exe	81
PID 1012 wrote to memory of 2664	1012	msedge.exe	81
PID 1012 wrote to memory of 2664	1012	msedge.exe	81
PID 1012 wrote to memory of 2664	1012	msedge.exe	81
PID 1012 wrote to memory of 2664	1012	msedge.exe	81
PID 1012 wrote to memory of 2664	1012	msedge.exe	81
PID 1012 wrote to memory of 2664	1012	msedge.exe	81
PID 1012 wrote to memory of 2664	1012	msedge.exe	81
PID 1012 wrote to memory of 2664	1012	msedge.exe	81
PID 1012 wrote to memory of 2664	1012	msedge.exe	81
PID 1012 wrote to memory of 2664	1012	msedge.exe	81
PID 1012 wrote to memory of 2664	1012	msedge.exe	81
PID 1012 wrote to memory of 2664	1012	msedge.exe	81
PID 1012 wrote to memory of 2664	1012	msedge.exe	81
PID 1012 wrote to memory of 2664	1012	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://store.steampowered.com/app/3184660/GunZ_The_Duel/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdb49a3cb8,0x7ffdb49a3cc8,0x7ffdb49a3cd8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,7073652984572889040,4655459390836264709,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,7073652984572889040,4655459390836264709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,7073652984572889040,4655459390836264709,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7073652984572889040,4655459390836264709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7073652984572889040,4655459390836264709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7073652984572889040,4655459390836264709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7073652984572889040,4655459390836264709,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7073652984572889040,4655459390836264709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7073652984572889040,4655459390836264709,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,7073652984572889040,4655459390836264709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,7073652984572889040,4655459390836264709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:32

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1544690d41d950f9c1358068301cfb5

SHA1
ae3ff81363fcbe33c419e49cabef61fb6837bffa

SHA256
53d69c9cc3c8aaf2c8b58ea6a2aa47c49c9ec11167dd9414cd9f4192f9978724

SHA512
1e4f1fe2877f4f947d33490e65898752488e48de34d61e197e4448127d6b1926888de80b62349d5a88b96140eed0a5b952ef4dd7ca318689f76e12630c9029da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9314124f4f0ad9f845a0d7906fd8dfd8

SHA1
0d4f67fb1a11453551514f230941bdd7ef95693c

SHA256
cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e

SHA512
87b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
936B

MD5
8241ede9a296900236be7a785794373d

SHA1
ff4bef0f955665f1b458af09fc0aba7d13ca7a44

SHA256
e9699c15c3ca523a9cb8eee74d6a9ffeb431cc173b9681a817c0c77c10b13aa6

SHA512
a871ba1c621f9e7986a8005406ae5722557ee5266079cd5fd5d0a58f35fd7f9aeb21b1f8126e16eede58fe5f107fc4041cc5dfac03ad8abefbba45213a2968fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0e6ed69fe11d44251e27019352cef851

SHA1
d58757e9c1c7409ed0d0c4af1cd81385373f6c8f

SHA256
d25652e7e64efaca3505fcdf2bce40c981026d869e2c057fabee6041ba0a6f9b

SHA512
b4f03e7016e02b12bb8ccc04ab0aff4432b0b37f07acb54ac0546ccdfa2e7919b0cc02ced3c1a8b3fda4eebeebab5975537988da5d8663bf65414dd1c6c6b335

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a41e554fd4601d9a6fec463028ea9c4b

SHA1
2f77508db60ca28a238ab0b5084a99838f5789f4

SHA256
4daae166c66199eed09128c1e59491fdf7c6385b1c31e4444947df65ac2e2e5a

SHA512
472b408294c747a0e43dcab702461c5770b9e40ab3f1e3209cc33e816f7ae2d208fa09fb2ae9abc43188eacce53a74939ac57506944409071418987e82ce6fb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b9afd577b812b0c2f8a441b55180bdee

SHA1
4b47df62af4499207115db65ac8f061d36e6a7c7

SHA256
15ae80a086ee1b1c158bfb5d5bac02a4a2dd3c00385fd9e0e3ed6b0def1589f7

SHA512
f88d907f20085baecbc7a6dad0eb3b4bd8465f13d8c904d2791c8361ae44a3e7cd53b318d91cee1a3c0be43b80d4aaa073b3b107a78c335bcd8665c2851c5ff8

Download Submit