hxxp://www[.]teamexequial[.]com/assets/styles/uow/

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2024 22:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.teamexequial.com/assets/styles/uow/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 436	2716	msedge.exe	35
PID 2716 wrote to memory of 436	2716	msedge.exe	35
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 4968	2716	msedge.exe	86
PID 2716 wrote to memory of 1672	2716	msedge.exe	87
PID 2716 wrote to memory of 1672	2716	msedge.exe	87
PID 2716 wrote to memory of 2300	2716	msedge.exe	88
PID 2716 wrote to memory of 2300	2716	msedge.exe	88
PID 2716 wrote to memory of 2300	2716	msedge.exe	88
PID 2716 wrote to memory of 2300	2716	msedge.exe	88
PID 2716 wrote to memory of 2300	2716	msedge.exe	88
PID 2716 wrote to memory of 2300	2716	msedge.exe	88
PID 2716 wrote to memory of 2300	2716	msedge.exe	88
PID 2716 wrote to memory of 2300	2716	msedge.exe	88
PID 2716 wrote to memory of 2300	2716	msedge.exe	88
PID 2716 wrote to memory of 2300	2716	msedge.exe	88
PID 2716 wrote to memory of 2300	2716	msedge.exe	88
PID 2716 wrote to memory of 2300	2716	msedge.exe	88
PID 2716 wrote to memory of 2300	2716	msedge.exe	88
PID 2716 wrote to memory of 2300	2716	msedge.exe	88
PID 2716 wrote to memory of 2300	2716	msedge.exe	88
PID 2716 wrote to memory of 2300	2716	msedge.exe	88
PID 2716 wrote to memory of 2300	2716	msedge.exe	88
PID 2716 wrote to memory of 2300	2716	msedge.exe	88
PID 2716 wrote to memory of 2300	2716	msedge.exe	88
PID 2716 wrote to memory of 2300	2716	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.teamexequial.com/assets/styles/uow/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fc8b46f8,0x7ff9fc8b4708,0x7ff9fc8b4718
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,866967228965923162,14456303086421771766,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,866967228965923162,14456303086421771766,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,866967228965923162,14456303086421771766,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,866967228965923162,14456303086421771766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,866967228965923162,14456303086421771766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2116 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,866967228965923162,14456303086421771766,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 /prefetch:2
  2⤵
  PID:1132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3bde7b7b0c0c9c66bdd8e3f712bd71eb

SHA1
266bd462e249f029df05311255a15c8f42719acc

SHA256
2ccd4a1b56206faa8f6482ce7841636e7bb2192f4cf5258d47e209953a77a01a

SHA512
5fab7a83d86d65e7c369848c5a7d375d9ad132246b57653242c7c7d960123a50257c9e8c4c9a8f22ee861fce357b018236ac877b96c03990a88de4ddb9822818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9cafa4c8eee7ab605ab279aafd19cc14

SHA1
e362e5d37d1a79e7b4a8642b068934e4571a55f1

SHA256
d0817f51aa2fb8c3cae18605dbfd6ec21a6ff3f953171e7ac064648ffdee1166

SHA512
eefd65ffcfb98ac8c3738eb2b3f4933d5bc5b992a1d465b8424903c8f74382ec2c95074290ddbb1001204843bfef59a32b868808a6bee4bc41ee9571515bbac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
60bfd973c3a5545875ec76064637be01

SHA1
b4fd33a4b15c1b25a7f4db13c9b800cf0abd0a03

SHA256
c5a0b649dc2b1178d071e6ec44375cdd68a5a447152709ffb2d8a2a94cc1134a

SHA512
40434a5c9adf8a0b55d40dc227962ac448f9a7176a278c6ce42e66ef261b7f00ae308af971fcba0ec3b1cc218f393686a16b6bad26fa360824edcb1214a00c1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eddce001bf15ca690a69e483f15874ba

SHA1
a1d02fb6c25be6f3cee0c5fa8f8f6c9dd326d270

SHA256
d27db44aca4975183e618cfe27adaea31cc32a920b91d77053bfb49ca7f6b040

SHA512
f2130ad53943634b939ad90372fe2e5844739ac8a21087ec0a68cf4ed9dfa4c4d6c6ef0e5c459878c44f247f68d7e96719f8b9609c200f16199233c9ba490308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0613ddea08fc85cf0a71f4fe78409fc7

SHA1
49abc03885ba7b99cba912f3eb0be1a13b892478

SHA256
759b0e9839e123c439f13e33ab17b76f06ad97aead50d315a372869c835549d3

SHA512
d9a70727c24609eccc766560d344d50a68f721dbde27aabc641a2ccde8f86e0273c4ce73f804782cae3bbadac323c4641615ab5c21956048f40831020937da94

Download Submit