hxxps://www[.]officialkmspico[.]com/

Analysis

max time kernel
454s
max time network
458s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
04-07-2024 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.officialkmspico.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2360	msedge.exe
2360	msedge.exe
3712	msedge.exe
3712	msedge.exe
2968	identity_helper.exe
2968	identity_helper.exe
4848	msedge.exe
4848	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 388	3712	msedge.exe	79
PID 3712 wrote to memory of 388	3712	msedge.exe	79
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 4184	3712	msedge.exe	80
PID 3712 wrote to memory of 2360	3712	msedge.exe	81
PID 3712 wrote to memory of 2360	3712	msedge.exe	81
PID 3712 wrote to memory of 2552	3712	msedge.exe	82
PID 3712 wrote to memory of 2552	3712	msedge.exe	82
PID 3712 wrote to memory of 2552	3712	msedge.exe	82
PID 3712 wrote to memory of 2552	3712	msedge.exe	82
PID 3712 wrote to memory of 2552	3712	msedge.exe	82
PID 3712 wrote to memory of 2552	3712	msedge.exe	82
PID 3712 wrote to memory of 2552	3712	msedge.exe	82
PID 3712 wrote to memory of 2552	3712	msedge.exe	82
PID 3712 wrote to memory of 2552	3712	msedge.exe	82
PID 3712 wrote to memory of 2552	3712	msedge.exe	82
PID 3712 wrote to memory of 2552	3712	msedge.exe	82
PID 3712 wrote to memory of 2552	3712	msedge.exe	82
PID 3712 wrote to memory of 2552	3712	msedge.exe	82
PID 3712 wrote to memory of 2552	3712	msedge.exe	82
PID 3712 wrote to memory of 2552	3712	msedge.exe	82
PID 3712 wrote to memory of 2552	3712	msedge.exe	82
PID 3712 wrote to memory of 2552	3712	msedge.exe	82
PID 3712 wrote to memory of 2552	3712	msedge.exe	82
PID 3712 wrote to memory of 2552	3712	msedge.exe	82
PID 3712 wrote to memory of 2552	3712	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.officialkmspico.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffda2193cb8,0x7ffda2193cc8,0x7ffda2193cd8
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,6292979746074101433,10718666206531289495,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,6292979746074101433,10718666206531289495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,6292979746074101433,10718666206531289495,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,6292979746074101433,10718666206531289495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,6292979746074101433,10718666206531289495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,6292979746074101433,10718666206531289495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1948 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,6292979746074101433,10718666206531289495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1936,6292979746074101433,10718666206531289495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,6292979746074101433,10718666206531289495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,6292979746074101433,10718666206531289495,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,6292979746074101433,10718666206531289495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,6292979746074101433,10718666206531289495,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,6292979746074101433,10718666206531289495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,6292979746074101433,10718666206531289495,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:4388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
64f055a833e60505264595e7edbf62f6

SHA1
dad32ce325006c1d094b7c07550aca28a8dac890

SHA256
7172dc46924936b8dcee2d0c39535d098c2dbf510402c5bbb269399aed4d4c99

SHA512
86644776207d0904bc3293b4fec2fa724b8b3c9c3086cd0ef2696027ab3d840a8049b6bde3464c209e57ffa83cbc3df6115500fbe36a9acb222830c1aac4dc7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a74887034b3a720c50e557d5b1c790bf

SHA1
fb245478258648a65aa189b967590eef6fb167be

SHA256
f25b27187fad2b82ac76fae98dfdddc1c04f4e8370d112d45c1dd17a8908c250

SHA512
888c3fceb1a28a41c5449f5237ca27c7cbd057ce407f1542973478a31aa84ce9b77943130ca37551c31fa7cd737b9195b7374f886a969b39148a531530a91af3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
b45c5856862a53eedaec7d78e0712d92

SHA1
99dcb38f8876d1dfd82f74a8a7258d44b618e202

SHA256
a18b423f6991d5986a0bdc36139e558abc0cbfef1cc0513f40e54cde40d94612

SHA512
db894ed0a3eb5ff37056caff7bc9f9cb102b164894db278c121f5e845c5fcdc8c76a3ae7789700b9e9c2ad06af06fa8d25d38b520d7fdc539d7d9bf3604d0bb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
128a432c3e931d8c277b528629012ac4

SHA1
71f286c7083364ff9098e1c431a80d3068452706

SHA256
99925b7cf50821914fd3c02061345d8d958b00799194b9df6d1660342d92ba02

SHA512
4c8517316063b576f8198248cf61d99fbb5295efac44480fed635131b3ac161757beb51a68023b77a50218e0ac6e37a3f2b0de9d05fc7f3e589db3caf5679552

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6c9fafbb9fb53e4f16245a5a5127876d

SHA1
a01834e10d0c5165f7abf8c65693a066664666cd

SHA256
1d54dd5fcda1fd597cf3c7df5df566546963aecb011e517ef2f777a6bbcebfd2

SHA512
7d4b1d6cc35de1bfc4722f9e5452f4f7797aee48c89224b66669e58e7ff2f7c6de56fdbb035ee860e058ecb80a8fbd161a487a7195fc2a9afd0580cf7930c151

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a95a33c80d928c6b0d543827c1b2991a

SHA1
8f5b79d262cc72a0d98e5c6cee507450e45774db

SHA256
f8a9008e2e02db8f13bb02a1e06a02e53e866401407c4929bab64dd0d7e78098

SHA512
d691984dd8ef08e5a68b218926c62065f7c3eef111821a251e2baab3a82e45fc1be655286c78ff9d81143344295814514ffa08cfb95454dd174bf131e98fa43b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
63c2b509f3ea04fb4e4d947eeca3eea8

SHA1
4d3cb086bd9ead452234e20696f8afdf3e532117

SHA256
14ff05bbd0e2585c4d95146115887d5d97cbe9efd5bc3a06764396da7991770a

SHA512
cbc6bd5e5ec48e2a76e71e7d5a34e75e831c88f8391312e13e9f59595c54deb175f14b5293dfb3173cd6e47894a7f353cd44a92bd647692dcf03d5b26cc61097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e31be8eca304244820830c65048ac984

SHA1
b98c1367f1b8a1c80badac8643fa7b05e2f60172

SHA256
01e48cac231d59443162286664090be6abf379d6bf29d8390afd99bd56c6a807

SHA512
25b113a4ec2a88c3b88ba235859a2d4e78a45711daa6955faac1b024d58d79df720eedc4888da8797085529a9a08a60cd14fa095a2ad5e750b860cb2d7594b59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
dab0141f3094da4adfa1d004bcfdeb14

SHA1
fdfd3b52dfeb266247bca213a87c9f7847c06a82

SHA256
229868e4404acc4defba8fbf110b3011a4bf3c89ee47ea1321a0c69e331a380b

SHA512
94ee948769b50b463a5c805343ab566b2e596ec638d1d55bf75cb0c2e2b25e37caf191f7e3ed3e5d6937aa2c9ac6a86be958c5ecd879b229ccf6ec24b6c3d379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1d601c693f3b736907c4108bc9cdd369

SHA1
ef20e29128f3b13fe7785fc64d1626a6226a893a

SHA256
acbf0480d669cded0ca723f043c068008cf74961d1923f629d7c9a87dfe8a95b

SHA512
5c71c2e31a5bca426ce4497b8e3207090d395439483961743806c9b8d773922e5a8278a55d15aba2eda91b04270a5b4aca1d9088ba73c7c646d306620917f55b

Download Submit