hxxp://staemcommunitly[.]com/gift/activation=Dor5Fhnm2w

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2025, 14:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://staemcommunitly.com/gift/activation=Dor5Fhnm2w

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM. 1 IoCs

phishing steam

flow	pid	Process
36	808	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
808	msedge.exe
808	msedge.exe
3920	msedge.exe
3920	msedge.exe
3716	identity_helper.exe
3716	identity_helper.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2760	taskmgr.exe
Token: SeSystemProfilePrivilege	2760	taskmgr.exe
Token: SeCreateGlobalPrivilege	2760	taskmgr.exe
Token: 33	2760	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2760	taskmgr.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe

Suspicious use of SendNotifyMessage 61 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 948	3920	msedge.exe	83
PID 3920 wrote to memory of 948	3920	msedge.exe	83
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 2852	3920	msedge.exe	84
PID 3920 wrote to memory of 808	3920	msedge.exe	85
PID 3920 wrote to memory of 808	3920	msedge.exe	85
PID 3920 wrote to memory of 3700	3920	msedge.exe	86
PID 3920 wrote to memory of 3700	3920	msedge.exe	86
PID 3920 wrote to memory of 3700	3920	msedge.exe	86
PID 3920 wrote to memory of 3700	3920	msedge.exe	86
PID 3920 wrote to memory of 3700	3920	msedge.exe	86
PID 3920 wrote to memory of 3700	3920	msedge.exe	86
PID 3920 wrote to memory of 3700	3920	msedge.exe	86
PID 3920 wrote to memory of 3700	3920	msedge.exe	86
PID 3920 wrote to memory of 3700	3920	msedge.exe	86
PID 3920 wrote to memory of 3700	3920	msedge.exe	86
PID 3920 wrote to memory of 3700	3920	msedge.exe	86
PID 3920 wrote to memory of 3700	3920	msedge.exe	86
PID 3920 wrote to memory of 3700	3920	msedge.exe	86
PID 3920 wrote to memory of 3700	3920	msedge.exe	86
PID 3920 wrote to memory of 3700	3920	msedge.exe	86
PID 3920 wrote to memory of 3700	3920	msedge.exe	86
PID 3920 wrote to memory of 3700	3920	msedge.exe	86
PID 3920 wrote to memory of 3700	3920	msedge.exe	86
PID 3920 wrote to memory of 3700	3920	msedge.exe	86
PID 3920 wrote to memory of 3700	3920	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://staemcommunitly.com/gift/activation=Dor5Fhnm2w
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb171446f8,0x7ffb17144708,0x7ffb17144718
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand STEAM.
  - Suspicious behavior: EnumeratesProcesses
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,13065078516393250820,10726666793503741452,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6256 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:500

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
94b89f415aa886d86ea5cace9ad8e09c

SHA1
6ba17d77e6aa6e9bd24e9434520ead409fc2f3b5

SHA256
e4ea4ccf223edeb1ee4eb998c70b605482b67996381b58dd28adb5c1c55683d5

SHA512
96b48e7694e9543bfa235e3f1ea25fe8d3f741c1689ec05f79206027ab644fba2b45ea04f145ae7b1233ed5c31cd91d443e094ea7c5ac3707761dbb36d4b2d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
796B

MD5
802f1420e1b038d91d8bb1c16645278d

SHA1
a364dbc124b76cb4af4aa54083c48843ee4ab2dc

SHA256
a7e6c7c46c5811caa59d8e46c71f50c1661f78749f88f4afd6e0ce9fc657eab1

SHA512
2aaf8a7b6d17076454bb4b366dddf2e7f00d9b0e75ee1b9d96cb1b91b057bf8395881dc11123c02741f642bd5220f8c9866c420c6308fc320b463f5d848c3e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
bbf918daf1b9cbf4c15a84db669836c9

SHA1
2e228ea049fe584e9d0f31fa33ef042acfda2e74

SHA256
303c247a026c899aa2cdf0c19ee7ef4ea36a7846095a2a21b1cd72fec3fda7be

SHA512
e047944cd12e6088a30c47b18132b6861f9563626b975a5ff09abc42aba2ce7d7e9199a7561f6ab400dd4602b7f643e0bf98838263c3c10ba7709c9becc37dca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
49a34a4495c9b51f892b02c256fabbef

SHA1
9eb47fe9a177b4786c100cde25fdd70d3f5f85ee

SHA256
151725a5f5c1dea4a9240bdb88b20d5a1bdba166e425e85d6b5b15a2189c6327

SHA512
a77ba7f314a2e7578ee373f22af2e5bd702b8fb72284af21e09c9c86dd52f9d748501e73139296822817a4f2b873ab4e32a80856167f148827864a08969e6e2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
eddc20f15bfd10467e09969020cc7753

SHA1
4202fab937456d3f6d2f427c70803a47f7e6b035

SHA256
4e22fd2e21d5afc2dc7c5e821db633d730e65f7be8663bd22e1d6a443ae4ca01

SHA512
287191492debc7a41f8918c979146861b38981b4d43ea2a02bf3d71d321b0c1bbaead308805d56a1d58e28ffa2dd54dcbe5559880a2df32d6bc6bb8145d37642

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cb3fda7a5e9167ba68b53883c5215584

SHA1
8b1904c3ccdae71915684fe4083413a28bfe0eb4

SHA256
e99a2440e124accca9a5258bf6f7444e843c487cc9c15474464e1ca6b8d0486d

SHA512
7aed2183a8cc36af6ee7dfb037c432eaa4842c8c35bb98798cbd09df0c0492cd673c67ba99be8d3ba86ebfe9b5095db4f99f62ded64e0fe8dd6ee9b0945be512

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
24534203edf80acb18ff7a3f04a3c826

SHA1
443e5d45f2812b48c87cb474daadf756740eba83

SHA256
3e1c81ee8ce80bcd5e93a25e81d35d3b3dad10aa6fbc42cddb50a7ecd213e025

SHA512
db2b1b1ac43074d927c3d056e66224f33431e89ba98b8284167e0c989185c0e083ad84af8d3824fc63e3818c458830b7c7c92790fca6160157e8ab5d4b0f0dad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
47c6f272f3db209b489bb1007e90a41a

SHA1
7d95054a948bf47af08b732b5bfac36b51552ebc

SHA256
92082b8c10e351bc1f9dfac0acceb56bf0869bb52b4bdb8e12627cf4eca3dae2

SHA512
db1a460ae98946ce36f733a6db35dd2fe32f738fe6ccfd0274c93b2e02933a17cd52fbd9c749eed10846dc2614ae9799b378a5e3020d8a981493edc2e81238d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe594174.TMP

Filesize
874B

MD5
8605480d61ffe7b31d2ab0f5a351c943

SHA1
fdb7b0e05e1fd3e6594bae3d8dfc6a31dce1bf22

SHA256
e2f44ffb0fdfea0217efa1a738e18ff148cee758c9e5791b694f138205603efe

SHA512
431c2b4c5189a0f7084f9d778948c023d59b22989b21e43ed6730bc33a8976c1db455fc9c0cd5848936ca922b84b9b1f6abce6695603dffdbbbfdc9311023fac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bdd1bdf1573703d42d20543974429ab9

SHA1
43808223e17a938f4192139032683443101d89b4

SHA256
ac4596a1e15e8d34e4bf32bce8912a6da435757f42968dac0676d8ca686cd212

SHA512
4b030aaf2be5a703f91e0157e9df529d70a19c46c736c31d959fad6dba71f5397621c0a11af1d74ea4f5ea587b0c8e64d4c09b30dc4d875ba68e0399505385b1

Download Submit
memory/2760-178-0x0000024060830000-0x0000024060831000-memory.dmp

Filesize
4KB

Download
memory/2760-175-0x0000024060830000-0x0000024060831000-memory.dmp

Filesize
4KB

Download
memory/2760-174-0x0000024060830000-0x0000024060831000-memory.dmp

Filesize
4KB

Download
memory/2760-173-0x0000024060830000-0x0000024060831000-memory.dmp

Filesize
4KB

Download
memory/2760-172-0x0000024060830000-0x0000024060831000-memory.dmp

Filesize
4KB

Download
memory/2760-176-0x0000024060830000-0x0000024060831000-memory.dmp

Filesize
4KB

Download
memory/2760-177-0x0000024060830000-0x0000024060831000-memory.dmp

Filesize
4KB

Download
memory/2760-167-0x0000024060830000-0x0000024060831000-memory.dmp

Filesize
4KB

Download
memory/2760-168-0x0000024060830000-0x0000024060831000-memory.dmp

Filesize
4KB

Download
memory/2760-166-0x0000024060830000-0x0000024060831000-memory.dmp

Filesize
4KB

Download