hxxps://www[.]mantis-ulv[.]com/en/crop-protection/mafex-potato-fruit/product-configurator#produkttypen

Analysis

max time kernel
962s
max time network
969s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2023, 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mantis-ulv.com/en/crop-protection/mafex-potato-fruit/product-configurator#produkttypen

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3848	msedge.exe
3848	msedge.exe
4956	msedge.exe
4956	msedge.exe
4376	identity_helper.exe
4376	identity_helper.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 1664	4956	msedge.exe	42
PID 4956 wrote to memory of 1664	4956	msedge.exe	42
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 5068	4956	msedge.exe	88
PID 4956 wrote to memory of 3848	4956	msedge.exe	87
PID 4956 wrote to memory of 3848	4956	msedge.exe	87
PID 4956 wrote to memory of 3376	4956	msedge.exe	89
PID 4956 wrote to memory of 3376	4956	msedge.exe	89
PID 4956 wrote to memory of 3376	4956	msedge.exe	89
PID 4956 wrote to memory of 3376	4956	msedge.exe	89
PID 4956 wrote to memory of 3376	4956	msedge.exe	89
PID 4956 wrote to memory of 3376	4956	msedge.exe	89
PID 4956 wrote to memory of 3376	4956	msedge.exe	89
PID 4956 wrote to memory of 3376	4956	msedge.exe	89
PID 4956 wrote to memory of 3376	4956	msedge.exe	89
PID 4956 wrote to memory of 3376	4956	msedge.exe	89
PID 4956 wrote to memory of 3376	4956	msedge.exe	89
PID 4956 wrote to memory of 3376	4956	msedge.exe	89
PID 4956 wrote to memory of 3376	4956	msedge.exe	89
PID 4956 wrote to memory of 3376	4956	msedge.exe	89
PID 4956 wrote to memory of 3376	4956	msedge.exe	89
PID 4956 wrote to memory of 3376	4956	msedge.exe	89
PID 4956 wrote to memory of 3376	4956	msedge.exe	89
PID 4956 wrote to memory of 3376	4956	msedge.exe	89
PID 4956 wrote to memory of 3376	4956	msedge.exe	89
PID 4956 wrote to memory of 3376	4956	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mantis-ulv.com/en/crop-protection/mafex-potato-fruit/product-configurator#produkttypen
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce03b46f8,0x7ffce03b4708,0x7ffce03b4718
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,18325617449736697961,9505763183422514530,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,18325617449736697961,9505763183422514530,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,18325617449736697961,9505763183422514530,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3032 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,18325617449736697961,9505763183422514530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,18325617449736697961,9505763183422514530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,18325617449736697961,9505763183422514530,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,18325617449736697961,9505763183422514530,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,18325617449736697961,9505763183422514530,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,18325617449736697961,9505763183422514530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,18325617449736697961,9505763183422514530,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,18325617449736697961,9505763183422514530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,18325617449736697961,9505763183422514530,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5620 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
16c2a9f4b2e1386aab0e353614a63f0d

SHA1
6edd3be593b653857e579cbd3db7aa7e1df3e30f

SHA256
0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81

SHA512
aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
e870ee9340a05cd673932302a5a4e121

SHA1
3ca24a82c63983258fa4ed425a4a3180a8579a39

SHA256
8f33e223a1d08b869d2301e5fdfd10bb7214c3306feff342681a8cdef7254783

SHA512
e001504d3a1dcf0cbe99eb2dbc2f7502133041ff04b6371f436bd1175128e57682fcd4e3a914e7ab6c64f042292443a92bf4d0bf07bfbb3e6de187e8ba6dc0cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
659B

MD5
af4274737b570b10f3fe659dc37fd1da

SHA1
ef8725c47e1f6a08b35877e441e2aed2a7095144

SHA256
0a95f5fd05daa629bd2508ed7f4ed47ebe46d1569587a7564900832b38e6cb9f

SHA512
163986457e096b17f29bb1c6184c1a13b6c598c58406300d796e25df1c1de268f629b770813ad2175b6b0d2bd000af26bf71b2e96fbd98e38e940e840f0b021d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0afe76070bcb67b99c42205bb22e1c29

SHA1
818e7b375a35fa1b4d46dee6b0ca543048f9621e

SHA256
db09e84ec313a09bfe82d65cd28530bfcb249f771cac1584ff51a4b3d5f57247

SHA512
3adc5839f61035097f283bb4f0032b24562e406e53deab99397adbbed5116fc2f32598cba805735475e84274e290c42addff7a608823f23f636b03ec048c2ae0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
23e5328b96ea14b3a872c3244bcbffb8

SHA1
549b61fb3f8d18e9eb247ae0a32923b7c6a199c1

SHA256
f27f42f214c8e319a99942bcf76cc909fa0be8127dc7b0ce064c95f0f102fc15

SHA512
3216cdd3e847595461147374494a251894a1ff02e3c373446abcf5857bf38fac79ba4c896cd6a21074f2ac25b7d378354f0b54eee685ba50dd4f941a124bb1d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
699e3636ed7444d9b47772e4446ccfc1

SHA1
db0459ca6ceeea2e87e0023a6b7ee06aeed6fded

SHA256
9205233792628ecf0d174de470b2986abf3adfed702330dc54c4a76c9477949a

SHA512
d5d4c08b6aec0f3e3506e725decc1bdf0b2e2fb50703c36d568c1ea3c3ab70720f5aec9d49ad824505731eb64db399768037c9f1be655779ed77331a7bab1d51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e4e44d0823db4532b42f7a9031925af0

SHA1
7456fd47bea4ac06a1e3a4e20207161d5e8ff1b5

SHA256
098d452abd5d9b6846aed12f90beb7caf1bf98f996ea681d17aa8f41d797b92e

SHA512
b717ed9ad69e97073993f1223873cca647de730763bb3da761a2544ec26e1c87f02d3f3164bae58c64c0d7e0fa83571d144dd7ac56fab4bd290cee6de5e9e496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a17f77e061ca72396e31d059c86b42a3

SHA1
f9f24967d8f14b47ff30465d3908c852ba5d6fab

SHA256
7d6b0a2a56f0238fbd96bf2070932975ff5594930fb9470a64834435c9692faf

SHA512
e96ced46f5008e415f74a3dc59c3355ede951b244022c90dbce252c6985d785a22d6b579b713d645c5174da10dd6c2fea91cf9927fc7c3604942f5fc850d4b28

Download Submit