hxxps://kmspico[.]io/

Resubmissions

03/05/2024, 04:59

240503-fmvdwafg2v 1

03/05/2024, 04:52

240503-fhf1pahf62 8

Analysis

max time kernel
44s
max time network
48s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
03/05/2024, 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://kmspico.io/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
3404	msedge.exe
3404	msedge.exe
3752	msedge.exe
3752	msedge.exe
756	identity_helper.exe
756	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 5052	3404	msedge.exe	79
PID 3404 wrote to memory of 5052	3404	msedge.exe	79
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4888	3404	msedge.exe	80
PID 3404 wrote to memory of 4548	3404	msedge.exe	81
PID 3404 wrote to memory of 4548	3404	msedge.exe	81
PID 3404 wrote to memory of 2120	3404	msedge.exe	82
PID 3404 wrote to memory of 2120	3404	msedge.exe	82
PID 3404 wrote to memory of 2120	3404	msedge.exe	82
PID 3404 wrote to memory of 2120	3404	msedge.exe	82
PID 3404 wrote to memory of 2120	3404	msedge.exe	82
PID 3404 wrote to memory of 2120	3404	msedge.exe	82
PID 3404 wrote to memory of 2120	3404	msedge.exe	82
PID 3404 wrote to memory of 2120	3404	msedge.exe	82
PID 3404 wrote to memory of 2120	3404	msedge.exe	82
PID 3404 wrote to memory of 2120	3404	msedge.exe	82
PID 3404 wrote to memory of 2120	3404	msedge.exe	82
PID 3404 wrote to memory of 2120	3404	msedge.exe	82
PID 3404 wrote to memory of 2120	3404	msedge.exe	82
PID 3404 wrote to memory of 2120	3404	msedge.exe	82
PID 3404 wrote to memory of 2120	3404	msedge.exe	82
PID 3404 wrote to memory of 2120	3404	msedge.exe	82
PID 3404 wrote to memory of 2120	3404	msedge.exe	82
PID 3404 wrote to memory of 2120	3404	msedge.exe	82
PID 3404 wrote to memory of 2120	3404	msedge.exe	82
PID 3404 wrote to memory of 2120	3404	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://kmspico.io/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffaa0563cb8,0x7ffaa0563cc8,0x7ffaa0563cd8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,10105568964812725402,9217161581635292300,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,10105568964812725402,9217161581635292300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2676 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,10105568964812725402,9217161581635292300,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10105568964812725402,9217161581635292300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10105568964812725402,9217161581635292300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,10105568964812725402,9217161581635292300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10105568964812725402,9217161581635292300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10105568964812725402,9217161581635292300,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,10105568964812725402,9217161581635292300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10105568964812725402,9217161581635292300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10105568964812725402,9217161581635292300,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:1572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6e498afe43878690d3c18fab2dd375a5

SHA1
b53f3ccbfe03a300e6b76a7c453bacb8ca9e13bd

SHA256
beb39e9a246495e9dd2971224d23c511b565a72a6f02315c9f9bf1dcfae7df78

SHA512
3bf8a2dd797e7f41377267ad26bde717b5b3839b835fe7b196e748fec775ffd39346dba154bb5d8bda4e6568133daaa7fefa3a0d2a05e035c7210bb3c60041a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8b53ef336be1e3589ad68ef93bbe3a7

SHA1
dec5c310225cab7d871fe036a6ed0e7fc323cf56

SHA256
fe5c2fb328310d7621d8f5af5af142c9ce10c80f127c4ab63171738ad34749e1

SHA512
a9081a5a909d9608adfc2177d304950b700b654e397cf648ed90ecac8ac44b860b2cf55a6d65e4dfa84ef79811543abf7cb7f6368fd3914e138dfdd7a9c09537

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
120B

MD5
c6e6b0edd6615dd7799d697d5e66ffd4

SHA1
fc1b563d0fc493c8ee8988bd98bf822e53018ed1

SHA256
b9f55625b57438dae10cc14c358969a4ecd478f10fd2247e2fd43ea28c4871c0

SHA512
7ba52c1dcb6b12fd37ed28b6a90d3c17d97d6c78f0233f94db23f806621f6baa74584835189509ee76e7248f765b7dff69af54f831e0569c1b6701b22d52fa68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
183895b66c2c68de67092cf4e36c4cd8

SHA1
abe2e326d9bf370bd7feae54a45cb30b3115304f

SHA256
fd96304f81ce481e012c1e799ce948bf03329d1e33253647bfeb6b238f1d087d

SHA512
e0276f6cfdc567482d8ae6336bc44f41828497c63798d64bab886e879a8f7594fc114218f68fd5c1adbdb2737a68a9949e653511dfd1d383c002b76ba0c8c246

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c73f42451558533e3f087a9c5e0465f

SHA1
234a9900c4cdcf86501d8bcea49b8e00cd23d3e7

SHA256
e33c2ba093f60c8907259805553b31ae238fdaa54c8d27fd580e5a88cc48a7a7

SHA512
94c587fa2e82303f78c0b3f63b345123172dacb4864d7cb2824438cfb2c9c7bfc09e66452597a6f4f8561aff31f17b79be0762c9f145c22587d40bc6d467f64f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
95e1df5f12101a5ef2fb1728f3290fd7

SHA1
5f17e6c34e013e82bc11ab996001906710fa253c

SHA256
f651175307e4811a4ae9709c6db29bac29ac149f240e7541af3f2cc2d4a55960

SHA512
8e2c146721128d3125983f6a8669cb4731dd371255bf048e89d7566ec51ad43230f6fda6f07c1abf5149260451f167b6025e00561926e2d3089b4067ff5c566e

Download Submit