hxxps://easybackup[.]page[.]link/XktS

Analysis

max time kernel
67s
max time network
67s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
13/03/2024, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://easybackup.page.link/XktS

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
252	msedge.exe
252	msedge.exe
1736	msedge.exe
1736	msedge.exe
1244	identity_helper.exe
1244	identity_helper.exe
3204	msedge.exe
3204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 4912	1736	msedge.exe	77
PID 1736 wrote to memory of 4912	1736	msedge.exe	77
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 3652	1736	msedge.exe	78
PID 1736 wrote to memory of 252	1736	msedge.exe	79
PID 1736 wrote to memory of 252	1736	msedge.exe	79
PID 1736 wrote to memory of 3428	1736	msedge.exe	80
PID 1736 wrote to memory of 3428	1736	msedge.exe	80
PID 1736 wrote to memory of 3428	1736	msedge.exe	80
PID 1736 wrote to memory of 3428	1736	msedge.exe	80
PID 1736 wrote to memory of 3428	1736	msedge.exe	80
PID 1736 wrote to memory of 3428	1736	msedge.exe	80
PID 1736 wrote to memory of 3428	1736	msedge.exe	80
PID 1736 wrote to memory of 3428	1736	msedge.exe	80
PID 1736 wrote to memory of 3428	1736	msedge.exe	80
PID 1736 wrote to memory of 3428	1736	msedge.exe	80
PID 1736 wrote to memory of 3428	1736	msedge.exe	80
PID 1736 wrote to memory of 3428	1736	msedge.exe	80
PID 1736 wrote to memory of 3428	1736	msedge.exe	80
PID 1736 wrote to memory of 3428	1736	msedge.exe	80
PID 1736 wrote to memory of 3428	1736	msedge.exe	80
PID 1736 wrote to memory of 3428	1736	msedge.exe	80
PID 1736 wrote to memory of 3428	1736	msedge.exe	80
PID 1736 wrote to memory of 3428	1736	msedge.exe	80
PID 1736 wrote to memory of 3428	1736	msedge.exe	80
PID 1736 wrote to memory of 3428	1736	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://easybackup.page.link/XktS
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe7fe13cb8,0x7ffe7fe13cc8,0x7ffe7fe13cd8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,11435243702294159172,14979435934126526426,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,11435243702294159172,14979435934126526426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,11435243702294159172,14979435934126526426,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11435243702294159172,14979435934126526426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11435243702294159172,14979435934126526426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11435243702294159172,14979435934126526426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,11435243702294159172,14979435934126526426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11435243702294159172,14979435934126526426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11435243702294159172,14979435934126526426,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,11435243702294159172,14979435934126526426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11435243702294159172,14979435934126526426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11435243702294159172,14979435934126526426,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:2096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ec7568123e3bee98a389e115698dffeb

SHA1
1542627dbcbaf7d93fcadb771191f18c2248238c

SHA256
5b5e61fe004e83477411dd2b6194e90591d36f2f145cc3b4faa20cf7ae266a75

SHA512
4a53fbbd7281a1a391f0040f6ff5515cedf6e1f97f2dae4ab495b4f76eb4f929dcda6b347f9bf7f66a899330f8897e1ed117314945d1de27b035cc170fa447d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
07a81762a84eec58b437a87dd2a19711

SHA1
c6cdc0afe2658ae09a6d7bc81cdacc920dad181f

SHA256
cd7b7d46fbc1e127be29a55ed222762e0a0dcf38f0c54235cc2b69d20d2fe5b4

SHA512
2ec80d0c1449bfb94d8889424aef76078afd406bab3172009c173e7b0292eb46c33b8c69727f0efca60e1855145514ac80f56cfbf6d49d98d3f0f3071f592c8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
6dbf91f848b36f4acddb520d5c681d5b

SHA1
007bc58d1be907c197f8ffc4af4e12e76ffc6d92

SHA256
fb491583c7609bde55cb7080ede8349ec7b2949fd11d7f3cf80bd6d276cdaebf

SHA512
4a64acb41f50d224cd352607aff91fe4bb6fce583e6d3c40e9d7bbee8f536456699e138a9bd2db8564e6728ca3c3b2937fb718a6057916276d47d1d56a3a4f0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7c3fcba89283329e95b523c3b36517d4

SHA1
935e15fb55e5e9c3014e455e4a7238a4bbbcd96f

SHA256
731fb31cb7b9d106269801263a06599fee2314683ad0f0343ef901768e4f4d47

SHA512
29f934cdd1df95945163018d03b4928de7f6214c8459702d9c0f03d504220ededfdffa36908a0a70326dacd47784c14f126f8dab650e032449dd2d23b606fbe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
0ba15f72ffb0a37243558588d3e78221

SHA1
814bdfffd723f7de9f8d6d6a0bc8d85a9f275cc0

SHA256
3d0223e1f8bb35870db41872cfbbe467f65bf9a1208dcb4d4ad874e250ccc10a

SHA512
02b168ef9cc226a08955092173c3745a55b28faa438b8152acb90d3bc1d9f433de7d8341def8b452db1986392a59cabc7c69689ad00825c58371ca78021183be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
856393561cc9d3d34350a82d8f7e6d1d

SHA1
c4074be1045f0284fe4816ccf3c4741178aa4bad

SHA256
cac3b2c3dc7bd8a43be4dc6ae6f76e0c0fd38d026b49c08949a3a795b9dbad9d

SHA512
dee4559cf1fdabad1dda4db379f81cf03db500ab357ceec4bb787fddd912af710f93607e474131b92a0cc7346b36537453b3ce00c253a796c13bd2cd16a53a89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
96bda7ae143346c2dbca6acce99ce6bf

SHA1
b55a273e72091b7fbc439b8133b893a9b23b54df

SHA256
7fc5632cbb146d7218157b4451124a3f4d82d8674e8b85247b7258c3b422b7a7

SHA512
383df41ad539fef5cb3f78700bbfd8f41dbebad3711ab4f3f031bd7947657539d9653874773108797fb2a922d0dd13eab1c2c5a5c3818e8f4b5ca5604e360978

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
30e1ee9ba5e4afcae8a4ac0dfe42f6aa

SHA1
29492198316c09f077622a6c5cca7975d1b50723

SHA256
d49dc0cb6df916c35c85dc81a5585040045ad1f0dc0d5fed5680276904c63fc8

SHA512
628e72460cb280b927f3efa6bf05817fe1dabd6e423dea603fd462262b1cbd7d3a8677647604d958fc7e36ad5a4da9ba79d730206827000dac271ea14d933f3c

Download Submit