Analysis
-
max time kernel
907s -
max time network
907s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 08:10
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.quadient.com/de/praeferenzen?elqTrackId=382569d6e832403baaeb123d9162bbac&elq=82ab2d59100040f9ab1aa38267f16e9e&elqaid=6790&elqat=1&elqCampaignId=3759&elqcst=272&elqcsid=54
Resource
win10v2004-20240508-en
General
-
Target
https://www.quadient.com/de/praeferenzen?elqTrackId=382569d6e832403baaeb123d9162bbac&elq=82ab2d59100040f9ab1aa38267f16e9e&elqaid=6790&elqat=1&elqCampaignId=3759&elqcst=272&elqcsid=54
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 5084 msedge.exe 5084 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4192 identity_helper.exe 4192 identity_helper.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4800 wrote to memory of 4840 4800 msedge.exe 85 PID 4800 wrote to memory of 4840 4800 msedge.exe 85 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 3552 4800 msedge.exe 86 PID 4800 wrote to memory of 5084 4800 msedge.exe 87 PID 4800 wrote to memory of 5084 4800 msedge.exe 87 PID 4800 wrote to memory of 1148 4800 msedge.exe 88 PID 4800 wrote to memory of 1148 4800 msedge.exe 88 PID 4800 wrote to memory of 1148 4800 msedge.exe 88 PID 4800 wrote to memory of 1148 4800 msedge.exe 88 PID 4800 wrote to memory of 1148 4800 msedge.exe 88 PID 4800 wrote to memory of 1148 4800 msedge.exe 88 PID 4800 wrote to memory of 1148 4800 msedge.exe 88 PID 4800 wrote to memory of 1148 4800 msedge.exe 88 PID 4800 wrote to memory of 1148 4800 msedge.exe 88 PID 4800 wrote to memory of 1148 4800 msedge.exe 88 PID 4800 wrote to memory of 1148 4800 msedge.exe 88 PID 4800 wrote to memory of 1148 4800 msedge.exe 88 PID 4800 wrote to memory of 1148 4800 msedge.exe 88 PID 4800 wrote to memory of 1148 4800 msedge.exe 88 PID 4800 wrote to memory of 1148 4800 msedge.exe 88 PID 4800 wrote to memory of 1148 4800 msedge.exe 88 PID 4800 wrote to memory of 1148 4800 msedge.exe 88 PID 4800 wrote to memory of 1148 4800 msedge.exe 88 PID 4800 wrote to memory of 1148 4800 msedge.exe 88 PID 4800 wrote to memory of 1148 4800 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.quadient.com/de/praeferenzen?elqTrackId=382569d6e832403baaeb123d9162bbac&elq=82ab2d59100040f9ab1aa38267f16e9e&elqaid=6790&elqat=1&elqCampaignId=3759&elqcst=272&elqcsid=541⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffd41d446f8,0x7ffd41d44708,0x7ffd41d447182⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,515960359778872556,18040962131259490462,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:3552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,515960359778872556,18040962131259490462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,515960359778872556,18040962131259490462,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2512 /prefetch:82⤵PID:1148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,515960359778872556,18040962131259490462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:2712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,515960359778872556,18040962131259490462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:3232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,515960359778872556,18040962131259490462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:82⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,515960359778872556,18040962131259490462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,515960359778872556,18040962131259490462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:12⤵PID:2324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,515960359778872556,18040962131259490462,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2280 /prefetch:12⤵PID:2852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,515960359778872556,18040962131259490462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:1904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,515960359778872556,18040962131259490462,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:12⤵PID:5032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,515960359778872556,18040962131259490462,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2688 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1120
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4976
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
Filesize
27KB
MD5314d6364bbee6681d0b2364ee3555e2e
SHA1c5aab803abe36bf664d7b7e2a3731cd849337006
SHA2565a42c91e1ecc9b09346a1520d9a6f98074c13eebfb1cc87c4e82e5992beb685b
SHA51296e07238f144f8b88e621a21f22a10f1b496fbb75b374f4a76bfa14120e7d458bc4cf62b093d237506cd1695c266c7b0f481c8e869392b67a5e4ee87303fe6d4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD52f53cbc68f13cc6329f30b4353643f5b
SHA1ca7f02d4995500718d624758c3077b5fd4c72b15
SHA256e3651d0e1cda6db886d7cc5d3b1f15c436d446c8c808e47961ef126799ba55c6
SHA512dc4998c35fefae74a1f3ab3735664754b72ba2cddababbcb4ac90f04b922e1726b2109eb079a5cb44f19cb8206dadea0ddda3ad452438a4cea27ab6daa961d9d
-
Filesize
265B
MD550fdf4e92980826647e533f590c5477b
SHA10fc3103cf48f931c0e7e5c3438868bded14f8293
SHA2560374fbba54a39d81512c8bd68ff0fad7b7335609078674fae01b534e4ecee215
SHA5128ff0b2bb619489ba876e25e4adeb035bca02a422145233fdeef0775abf2fc7c27a0f92c9a5cd660346611def6e3bc108f13e4c22036b69277dcf9d4761e88be4
-
Filesize
5KB
MD5c3aed58b75cb3d771496b6334006c7a6
SHA18a20279ff8113073a245ef809ec1823a8d0b085f
SHA256a74c0620266ac59e9bf6839480845fa470d7825df85833833124aadc24a15fdf
SHA5128c93878d8608310c5382d5342f70e58516fe064ac9a710ffc859376818f9ed521de873082b5627aeaf0a8f83a9542d900b466454c7386a1a5dd85526dadd48ed
-
Filesize
6KB
MD5feddf1c8c762999ec2615a5ab8c99d24
SHA177d16d99f768422965269738fdd054a11eacf68e
SHA256fbbeee8e0981c6a5066d2bf58df75c1babc4010188adab1ac9e2b17936f3a355
SHA512c349559f821a3af966218e722e460da98514122876dbe253719cd9d4ee527a1a6520d4afc38032434c6c9704dcfb1f68e378d2883671636928773d3e75326d7c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD587558ed642713c76949213135e9e13c0
SHA19c48a9adf82a24a946d7ddfebabdd7dc9477f5e0
SHA256216940627e655550dafb56843ea92716e2c05059be69a1b0cde084d0f7db1d48
SHA5126c3bc86a36c99d282ee192a5a2eb97718463993e3b8458d2319e61ba3bf21815eba33053620c832702e25c3c3e06c6d9b8a76e30d5fd3097258599987ef52c53