IOC Report
https://sconnect.schaeffler.com/community/industrial-global/rd-mechanical-products-industrial/development-ball-bearings/overview

Files

File Path

Type

Category

Malicious

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 16:12:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 16:12:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 16:12:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 16:12:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 16:12:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Chrome Cache Entry: 104

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57443

dropped

Chrome Cache Entry: 105

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769

dropped

Chrome Cache Entry: 106

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 2976

downloaded

Chrome Cache Entry: 107

PNG image data, 260 x 35, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 108

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 119648

downloaded

Chrome Cache Entry: 109

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 11970

downloaded

Chrome Cache Entry: 111

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449028

dropped

Chrome Cache Entry: 112

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592

downloaded

Chrome Cache Entry: 117

PNG image data, 280 x 60, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 121

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 9285

dropped

Chrome Cache Entry: 122

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141866

downloaded

Chrome Cache Entry: 123

ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 124

ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 126

GIF image data, version 89a, 352 x 3

dropped

Chrome Cache Entry: 127

ASCII text, with very long lines (64616)

downloaded

Chrome Cache Entry: 129

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113378

downloaded

Chrome Cache Entry: 130

HTML document, ASCII text, with CRLF line terminators

downloaded

Chrome Cache Entry: 131

GIF image data, version 89a, 352 x 3

dropped

Chrome Cache Entry: 132

ASCII text, with very long lines (12701)

downloaded

Chrome Cache Entry: 138

JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=1080, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=1420], baseline, precision 8, 909x691, components 3

dropped

Chrome Cache Entry: 140

MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors

dropped

Chrome Cache Entry: 141

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x1080, components 3

downloaded

Chrome Cache Entry: 143

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

downloaded

Chrome Cache Entry: 96

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986

dropped

Chrome Cache Entry: 98

HTML document, ASCII text, with very long lines (3450), with CRLF line terminators

downloaded

There are 22 hidden files, click here to show them.

URLs

Name

IP

Malicious

https://sconnect.schaeffler.com/community/industrial-global/rd-mechanical-products-industrial/development-ball-bearings/overview

Details

Filetype:	URL
Filename:	https://sconnect.schaeffler.com/community/industrial-global/rd-mechanical-products-industrial/development-ball-bearings/overview

Signature Hits	Behavior Group	Mitre Attack
HTML body contains low number of good links	Phishing
HTML title does not match URL	Phishing
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder
Classification label	System Summary
Connects to IPs without corresponding DNS lookups	Networking
Creates files inside the user directory	System Summary	Masquerading
HTML body contains password input	Phishing
HTML page is missing a favicon	Phishing
META author tag missing	Phishing
META copyright tag missing	Phishing
Performs DNS lookups	Networking	Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection
Uses HTTPS	Networking	Encrypted Channel Application Layer Protocol
Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis
Uses secure TLS version for HTTPS connections	Compliance, Networking
Found graphical window changes (likely an installer)	System Summary

https://sconnect.schaeffler.com/___sbsstatic___/maintenance.html

https://login.microsoftonline.com/67416604-6509-4014-9859-45e709f53d3f/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=2D8E714A0D9845F96F30DB80F60E2F8B61030D9E988518F7%2D59179D3F3C5B6D0156ED7B6AE2E46408F01BF3681084E7162FC19BE09D90E829&redirect%5Furi=https%3A%2F%2Fworksite%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=091b5da1%2D9048%2Da000%2D4d3d%2D52a8fc571cf1&sso_reload=true

Details

Name:	https://login.microsoftonline.com/67416604-6509-4014-9859-45e709f53d3f/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=2D8E714A0D9845F96F30DB80F60E2F8B61030D9E988518F7%2D59179D3F3C5B6D0156ED7B6AE2E46408F01BF3681084E7162FC19BE09D90E829&redirect%5Furi=https%3A%2F%2Fworksite%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=091b5da1%2D9048%2Da000%2D4d3d%2D52a8fc571cf1&sso_reload=true
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser

Signature Hits	Behavior Group	Mitre Attack
HTML body contains low number of good links	Phishing
HTML title does not match URL	Phishing
HTML body contains password input	Phishing
HTML page is missing a favicon	Phishing
META author tag missing	Phishing
META copyright tag missing	Phishing

https://login.microsoftonline.com/67416604-6509-4014-9859-45e709f53d3f/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=2D8E714A0D9845F96F30DB80F60E2F8B61030D9E988518F7%2D59179D3F3C5B6D0156ED7B6AE2E46408F01BF3681084E7162FC19BE09D90E829&redirect%5Furi=https%3A%2F%2Fworksite%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=091b5da1%2D9048%2Da000%2D4d3d%2D52a8fc571cf1

Details

Name:	https://login.microsoftonline.com/67416604-6509-4014-9859-45e709f53d3f/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=2D8E714A0D9845F96F30DB80F60E2F8B61030D9E988518F7%2D59179D3F3C5B6D0156ED7B6AE2E46408F01BF3681084E7162FC19BE09D90E829&redirect%5Furi=https%3A%2F%2Fworksite%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=091b5da1%2D9048%2Da000%2D4d3d%2D52a8fc571cf1
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser

Signature Hits	Behavior Group	Mitre Attack
HTML body contains low number of good links	Phishing
HTML title does not match URL	Phishing
HTML page is missing a favicon	Phishing
META author tag missing	Phishing
META copyright tag missing	Phishing

https://fsp.gs.schaeffler.com/adfs/ls/?client-request-id=091b5da1-9048-a000-4d3d-52a8fc571cf1&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAnVE_aNRgHE2a69k7W3t0saCghE5tc_d9yfclXw4KXi6J1UP7B62KlCN_vjTx_iQmqa0tXQRBt85O_lmkkzioFIRuQqdzcbhJXJQOUp06OHini2Px8ePx-A2Px3uTHCzC8gT4C0noswA8DwoO7at_EI_lC8-Wz-Rmt5mnV2YWX_66cfbHDiv5aRol5VJpLYwbSZDSYuJbMY3CoJ0WnbBVqnth3EpKLvWs1WZatJJo_R3Ldlj2G8vuDNwVdWIoEFWArhKETVU2JaBrBJgyMESTaDIEvYdqqIRgSExFwCpUVF0ypSrWZB1ALBu6oskVQzSQjAAxAdRMSSYQENRzlkWzClXNAKquAoOIandgdK6ymvpin8I42KA_B3L9jPUoTNInXGZOB2s73LEqec1NyAqCsgyQIGOgCghAJKgE9xSmClA9LLmSt89lw4i2A_cLN24l7p-zLiSOb1HPa9K431Mnwx5khgFXHhrKF5hx5jxzlGGfD_Y63_t0eupD_tzFt87HN9OdgNkfLGkLVTvyK9Wb0bUoad0J5-K2KS7OI_m63tZuxYqD0f10KVxZ8IwZtQy3s-x2NrubzQ1xBYbnqvPwMMs-OsHs5v5nvc5JtjsM8zkntGOr7Qbu2ASEtksAkQSiUCAgaGPBthUiANtBkkMsQonVHUb5rNO0glYyNrnJB249DRu0zZc3-fVWUnecvrpnNVdpwpdv872Q_PLW1taDkWO5740wR6e-dh--OHz8_vvswei0NNXwHKjZK_5KAGtY0mqNJVOpKda8dxkvUs13cO0qUTYarUszrwrM5wLzGw2&cbcxt=&username=asdasdasa%40schaeffler.com&mkt=&lc=

Details

Name:	https://fsp.gs.schaeffler.com/adfs/ls/?client-request-id=091b5da1-9048-a000-4d3d-52a8fc571cf1&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAnVE_aNRgHE2a69k7W3t0saCghE5tc_d9yfclXw4KXi6J1UP7B62KlCN_vjTx_iQmqa0tXQRBt85O_lmkkzioFIRuQqdzcbhJXJQOUp06OHini2Px8ePx-A2Px3uTHCzC8gT4C0noswA8DwoO7at_EI_lC8-Wz-Rmt5mnV2YWX_66cfbHDiv5aRol5VJpLYwbSZDSYuJbMY3CoJ0WnbBVqnth3EpKLvWs1WZatJJo_R3Ldlj2G8vuDNwVdWIoEFWArhKETVU2JaBrBJgyMESTaDIEvYdqqIRgSExFwCpUVF0ypSrWZB1ALBu6oskVQzSQjAAxAdRMSSYQENRzlkWzClXNAKquAoOIandgdK6ymvpin8I42KA_B3L9jPUoTNInXGZOB2s73LEqec1NyAqCsgyQIGOgCghAJKgE9xSmClA9LLmSt89lw4i2A_cLN24l7p-zLiSOb1HPa9K431Mnwx5khgFXHhrKF5hx5jxzlGGfD_Y63_t0eupD_tzFt87HN9OdgNkfLGkLVTvyK9Wb0bUoad0J5-K2KS7OI_m63tZuxYqD0f10KVxZ8IwZtQy3s-x2NrubzQ1xBYbnqvPwMMs-OsHs5v5nvc5JtjsM8zkntGOr7Qbu2ASEtksAkQSiUCAgaGPBthUiANtBkkMsQonVHUb5rNO0glYyNrnJB249DRu0zZc3-fVWUnecvrpnNVdpwpdv872Q_PLW1taDkWO5740wR6e-dh--OHz8_vvswei0NNXwHKjZK_5KAGtY0mqNJVOpKda8dxkvUs13cO0qUTYarUszrwrM5wLzGw2&cbcxt=&username=asdasdasa%40schaeffler.com&mkt=&lc=
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser

Signature Hits	Behavior Group	Mitre Attack
META author tag missing	Phishing

Domains

Name

IP

Malicious

dual-spo-0005.spo-msedge.net

13.107.136.10

s-part-0044.t-0009.fb-t-msedge.net

13.107.253.72

sni1gl.wpc.upsiloncdn.net

152.199.21.175

s-part-0017.t-0009.fb-t-msedge.net

13.107.253.45

sni1gl.wpc.omegacdn.net

152.199.21.175

fsp.gs.schaeffler.com

159.51.234.114

www.google.com

142.250.185.100

worksite.sharepoint.com

unknown

aadcdn.msauthimages.net

unknown

sconnect.schaeffler.com

unknown

identity.nel.measure.office.net

unknown

aadcdn.msftauth.net

unknown

login.microsoftonline.com

unknown

ds-aksb-a.akamaihd.net

unknown

aadcdn.msftauthimages.net

unknown

There are 5 hidden domains, click here to show them.

IPs

IP

Domain

Country

Malicious

13.107.138.10

unknown

United States

142.250.185.78

unknown

United States

13.107.136.10

dual-spo-0005.spo-msedge.net

United States

216.58.206.78

unknown

United States

192.168.2.16

unknown

unknown

20.190.155.1

unknown

United States

142.250.185.100

www.google.com

United States

192.168.2.4

unknown

unknown

142.250.185.227

unknown

United States

159.51.234.114

fsp.gs.schaeffler.com

Germany

2.19.126.146

unknown

European Union

20.190.160.14

unknown

United States

192.168.2.23

unknown

unknown

95.101.54.113

unknown

European Union

23.215.16.94

unknown

United States

1.1.1.1

unknown

Australia

74.125.71.84

unknown

United States

13.107.253.45

s-part-0017.t-0009.fb-t-msedge.net

United States

172.217.18.3

unknown

United States

13.107.253.72

s-part-0044.t-0009.fb-t-msedge.net

United States

40.126.31.73

unknown

United States

239.255.255.250

unknown

Reserved

20.190.159.0

unknown

United States

152.199.21.175

sni1gl.wpc.upsiloncdn.net

United States

142.250.184.234

unknown

United States

There are 15 hidden IPs, click here to show them.