hxxps://steanmconmnunity[.]com/gift/activation/id=9567873697

Analysis

max time kernel
1782s
max time network
1689s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 07:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steanmconmnunity.com/gift/activation/id=9567873697

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid process

4116 msedge.exe
4116 msedge.exe
2580 msedge.exe
2580 msedge.exe
4584 identity_helper.exe
4584 identity_helper.exe
4276 msedge.exe
4276 msedge.exe
4276 msedge.exe
4276 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2580 msedge.exe
2580 msedge.exe
2580 msedge.exe
2580 msedge.exe
2580 msedge.exe
2580 msedge.exe

pid	process
4116	msedge.exe
4116	msedge.exe
2580	msedge.exe
2580	msedge.exe
4584	identity_helper.exe
4584	identity_helper.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2580 wrote to memory of 4532	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4532	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 3604	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4116	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4116	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4792	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4792	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4792	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4792	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4792	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4792	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4792	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4792	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4792	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4792	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4792	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4792	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4792	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4792	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4792	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4792	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4792	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4792	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4792	2580	msedge.exe	msedge.exe
PID 2580 wrote to memory of 4792	2580	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steanmconmnunity.com/gift/activation/id=9567873697
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff96ea946f8,0x7ff96ea94708,0x7ff96ea94718
2⤵
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18119477386741323523,11456235104423220775,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
2⤵
PID:3604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,18119477386741323523,11456235104423220775,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,18119477386741323523,11456235104423220775,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
2⤵
PID:4792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18119477386741323523,11456235104423220775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
2⤵
PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18119477386741323523,11456235104423220775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
2⤵
PID:1460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18119477386741323523,11456235104423220775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
2⤵
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18119477386741323523,11456235104423220775,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
2⤵
PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18119477386741323523,11456235104423220775,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
2⤵
PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18119477386741323523,11456235104423220775,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18119477386741323523,11456235104423220775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
2⤵
PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18119477386741323523,11456235104423220775,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
2⤵
PID:4140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18119477386741323523,11456235104423220775,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5116

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
480B

MD5
4ae4d7d0ae38cc3b389d0cc0c2780333

SHA1
a9c68b6373a93b4c47ddcf1ed2dd373cfecdd395

SHA256
695635aa50373dd6256f696933c23a94a460a1dbb4a674f53d8f78f69b189017

SHA512
2cea5ce900cb9cd9b80d9d3618b6a3878bbf5b7f1047b1368bb77f6911bd799b1656576598151e5ce0a1e8da8b48eefeb46c3c36bcec66d0a22319a5d3a50c9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
983B

MD5
63b587c11c7578628e60bc935070cb33

SHA1
a731a4d0c9d4db09742163c807eb3e7ce9e1949c

SHA256
912af5f83c445ddfe2cbb4b4cb3b7ef4a51ad4f4b0bfbd973f305a8e9ab75584

SHA512
b587147d3129437a637a0091ba672b9e14353af6c7d2b1198de4696bca3954966a6e986937b7747541d5f74188f6978e61b67cf9409b52e4310fb481664706f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
983B

MD5
4cc746cba2d248d6e65a5600d1be8507

SHA1
01a3f7bb0fe4da9c34b87dc7fc6ecfddbb052870

SHA256
89869f4610a46eb122ad059eca8f01856cae2de88786f2ff7f3f4e2b884b2dd9

SHA512
af323dab1c3f07345112ac84eb5535baf1d323e06c3ed8d6526000c0a31206e3169d7792e6b5a60f7d6b710d385952493d71a111d4e1fa4e404705d202db8eb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
2c457b95b7f2f620060c6e2848456919

SHA1
c1f1e37dac2c02f5cf0b0370bb8b9da663c190a5

SHA256
1bb1e7203f2b33a44431655c806bbdcd5123922c9109118a5df86c6528fa5fe3

SHA512
0f119529baf9bd9d9443f7846e22bb6efa4196ae7e7fa97766e27214e23450fd6f4a9308968db78c55dbfcf7e0ae9005b8147635142022572d1a829076bdf651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
f1c54d34c0827fc13c887da527b13e48

SHA1
45a1f6634296d1d11f77f77886843651d85a7733

SHA256
96cfff5a094ebd9ec70a2f9202c26697de35381b01311c8052d267beec6a6f54

SHA512
ecc36f748a8028c7cde47efc27d1837398b2f649fe4fcfb783e05b83640d192cc75a4ecba3bdf05ab3042d8071c9ca1e48ef78f89775506208a754a050f2437f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
d353c162b9b4d800f5a267bac825b7af

SHA1
24ed60a201dbcda0622f5a81f90e73e41f82774a

SHA256
c21ec61e7b01025de4d288344730d54535ba1b86026d31f615ff5312db98a594

SHA512
de72a22aa825a43b46f7a44ffc05d58a0993e7763316b8f197adfa4d435590440eddd4a5e733683b8f3469f53f7127db3a2e03f567b3c3921b3cd9df27366f0d

Download Submit
\??\pipe\LOCAL\crashpad_2580_CYBFLVZQGDKXSTCK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit