hxxps://stemmcommunuty[.]com/14928630915

Analysis

max time kernel
31s
max time network
13s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
28-01-2025 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://stemmcommunuty.com/14928630915

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM. 1 IoCs

phishing steam

flow	pid	Process
16	4376	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
5104	msedge.exe
5104	msedge.exe
3572	msedge.exe
3572	msedge.exe
4580	identity_helper.exe
4580	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 1612	5104	msedge.exe	77
PID 5104 wrote to memory of 1612	5104	msedge.exe	77
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 432	5104	msedge.exe	78
PID 5104 wrote to memory of 4376	5104	msedge.exe	79
PID 5104 wrote to memory of 4376	5104	msedge.exe	79
PID 5104 wrote to memory of 4740	5104	msedge.exe	80
PID 5104 wrote to memory of 4740	5104	msedge.exe	80
PID 5104 wrote to memory of 4740	5104	msedge.exe	80
PID 5104 wrote to memory of 4740	5104	msedge.exe	80
PID 5104 wrote to memory of 4740	5104	msedge.exe	80
PID 5104 wrote to memory of 4740	5104	msedge.exe	80
PID 5104 wrote to memory of 4740	5104	msedge.exe	80
PID 5104 wrote to memory of 4740	5104	msedge.exe	80
PID 5104 wrote to memory of 4740	5104	msedge.exe	80
PID 5104 wrote to memory of 4740	5104	msedge.exe	80
PID 5104 wrote to memory of 4740	5104	msedge.exe	80
PID 5104 wrote to memory of 4740	5104	msedge.exe	80
PID 5104 wrote to memory of 4740	5104	msedge.exe	80
PID 5104 wrote to memory of 4740	5104	msedge.exe	80
PID 5104 wrote to memory of 4740	5104	msedge.exe	80
PID 5104 wrote to memory of 4740	5104	msedge.exe	80
PID 5104 wrote to memory of 4740	5104	msedge.exe	80
PID 5104 wrote to memory of 4740	5104	msedge.exe	80
PID 5104 wrote to memory of 4740	5104	msedge.exe	80
PID 5104 wrote to memory of 4740	5104	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://stemmcommunuty.com/14928630915
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffacf983cb8,0x7ffacf983cc8,0x7ffacf983cd8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,17639102733548463327,2501234820467704646,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,17639102733548463327,2501234820467704646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand STEAM.
  - Suspicious behavior: EnumeratesProcesses
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,17639102733548463327,2501234820467704646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17639102733548463327,2501234820467704646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17639102733548463327,2501234820467704646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17639102733548463327,2501234820467704646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,17639102733548463327,2501234820467704646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17639102733548463327,2501234820467704646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17639102733548463327,2501234820467704646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17639102733548463327,2501234820467704646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17639102733548463327,2501234820467704646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,17639102733548463327,2501234820467704646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1544690d41d950f9c1358068301cfb5

SHA1
ae3ff81363fcbe33c419e49cabef61fb6837bffa

SHA256
53d69c9cc3c8aaf2c8b58ea6a2aa47c49c9ec11167dd9414cd9f4192f9978724

SHA512
1e4f1fe2877f4f947d33490e65898752488e48de34d61e197e4448127d6b1926888de80b62349d5a88b96140eed0a5b952ef4dd7ca318689f76e12630c9029da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9314124f4f0ad9f845a0d7906fd8dfd8

SHA1
0d4f67fb1a11453551514f230941bdd7ef95693c

SHA256
cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e

SHA512
87b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
60b66d8170eacf3556df173b7d8a1f66

SHA1
865082b3127d245b2cbbf09ffda86423efdebf6d

SHA256
fc8799094b14817645956d432cfe8c316dd73cb382b42249970bd5b0eaeaa062

SHA512
c922751cb563838898939489b7cde11d0107725b1b5b1947267fee9f721c04b963fa72374f508e98d1453ef9ed8710c8bd90b366444272e31066756f5b1f950f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ca262a76bc8bf6d124c876f4ea510a47

SHA1
99c3593b0d214e82cd6c2735a64b30c1b1cabe58

SHA256
995665004f00b0a4190083a11608a8dc5c529b67c3e6a6b2208f1fc197803e5e

SHA512
99a270b1882f083bf0594b1ede74b7efa137c93385b178de7666a76adfe2a1291c0310ad0c14325f63d12e915487b5c544a8caba6a2265c642a4a58d014aeec5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f77d26c6776eac46b9489ff046d01c2b

SHA1
51009b557674c122b2c27be03755e3e90e7d9779

SHA256
e1adda7899564d2fc275a9275452a8381d862065621ef87cb332d368568d6968

SHA512
1bce7b72fc19f4c1b6fd29a9a3918d82caebc97adf2b14facb2853e804d240374141dd2bcac4ba81ae9e878e50a0183fec271f148890e77b16b1c21b15c7485c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e7053216104a15ec44b59376b2746b96

SHA1
f8b13bb4dad384a56f3d482eb7de5251a25ed13f

SHA256
f3c1a41f37d813d2e14f9fc98fa1f37735d1650a7cf615666cda3ef9995b006e

SHA512
400bb71bbcea88eb3c4e876f501a4fe6377d829987e27770db06de1f77c689a2958af3e30bc31278b683e79c936d9db9c0c0da19c22e2d49e54666d20094554c

Download Submit