hxxps://kmdesign-interiors[.]com/

Analysis

max time kernel
98s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2023, 06:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://kmdesign-interiors.com/

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133374199756437708"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 3480	4916	chrome.exe	82
PID 4916 wrote to memory of 3480	4916	chrome.exe	82
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 3920	4916	chrome.exe	84
PID 4916 wrote to memory of 1452	4916	chrome.exe	85
PID 4916 wrote to memory of 1452	4916	chrome.exe	85
PID 4916 wrote to memory of 4832	4916	chrome.exe	86
PID 4916 wrote to memory of 4832	4916	chrome.exe	86
PID 4916 wrote to memory of 4832	4916	chrome.exe	86
PID 4916 wrote to memory of 4832	4916	chrome.exe	86
PID 4916 wrote to memory of 4832	4916	chrome.exe	86
PID 4916 wrote to memory of 4832	4916	chrome.exe	86
PID 4916 wrote to memory of 4832	4916	chrome.exe	86
PID 4916 wrote to memory of 4832	4916	chrome.exe	86
PID 4916 wrote to memory of 4832	4916	chrome.exe	86
PID 4916 wrote to memory of 4832	4916	chrome.exe	86
PID 4916 wrote to memory of 4832	4916	chrome.exe	86
PID 4916 wrote to memory of 4832	4916	chrome.exe	86
PID 4916 wrote to memory of 4832	4916	chrome.exe	86
PID 4916 wrote to memory of 4832	4916	chrome.exe	86
PID 4916 wrote to memory of 4832	4916	chrome.exe	86
PID 4916 wrote to memory of 4832	4916	chrome.exe	86
PID 4916 wrote to memory of 4832	4916	chrome.exe	86
PID 4916 wrote to memory of 4832	4916	chrome.exe	86
PID 4916 wrote to memory of 4832	4916	chrome.exe	86
PID 4916 wrote to memory of 4832	4916	chrome.exe	86
PID 4916 wrote to memory of 4832	4916	chrome.exe	86
PID 4916 wrote to memory of 4832	4916	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://kmdesign-interiors.com/
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaad119758,0x7ffaad119768,0x7ffaad119778
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1892,i,15420661749839511368,16093528128900691590,131072 /prefetch:2
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1892,i,15420661749839511368,16093528128900691590,131072 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1892,i,15420661749839511368,16093528128900691590,131072 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1892,i,15420661749839511368,16093528128900691590,131072 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2940 --field-trial-handle=1892,i,15420661749839511368,16093528128900691590,131072 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4580 --field-trial-handle=1892,i,15420661749839511368,16093528128900691590,131072 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4968 --field-trial-handle=1892,i,15420661749839511368,16093528128900691590,131072 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 --field-trial-handle=1892,i,15420661749839511368,16093528128900691590,131072 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 --field-trial-handle=1892,i,15420661749839511368,16093528128900691590,131072 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1892,i,15420661749839511368,16093528128900691590,131072 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3236 --field-trial-handle=1892,i,15420661749839511368,16093528128900691590,131072 /prefetch:8
  2⤵
  PID:2456

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
753d8ee54882afd8a24cea3c675fd462

SHA1
13c46f879525a664444969264ba6f9810afd1afa

SHA256
c89e21ceabc6d9d9035e34fe4aca2c53eb1adf42b13ca1abadf6e29bacaf17aa

SHA512
06d379f2ce819f8795edfa6caa296a50c36e8459d27bede19e4a526c27683c4e92e5667a25866e0cc83a91d96f8d2870b782a84a9b807b4342aaffbe636de1eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
8546dffab89d08692b9873cd9b6d3016

SHA1
ef16e2bebfd12550905358596cab9d07500fffd0

SHA256
d03b2b6684a7c8e694528532e2f5ce3532f3bad6ca877aa4602cc89c0a027953

SHA512
d8e3eb75c998f763055aee08d9a574f1a57228479aee8249e243ff8da1aee5d6d6f88e8a3a45000a4c4995252812477ded8d3bebe6c245b3d10ce097f64dfa83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
90bfa2a114bcbb9fdfc132f5356ece51

SHA1
5b76c3063e696bee6697c927f8d0a146592c3327

SHA256
9b6bb14671bfd2220cb7e281d8196ef425771a61420a48683e9941efcf5977bf

SHA512
72ce4a1bba68f317b7b64a3f17c08a2af8125b0dc46d216f22b7aea5b462be4d0932b685f54c11c9fe934531e53c5e9752e33bc4d7901ea862d8203160437ae4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
89KB

MD5
6aff5f2f792025510ce4d3894801b0dc

SHA1
2b849f868a4103c9d7763a7446c66e3954b815e0

SHA256
1839ee3106face2ad985b86496df2b3d5754f42a10668031f27e5e42a63dffb3

SHA512
dfda57c2a2f8db30cb369ad2e7c120e4e8b0bc1558caa99a8ae6e6b6e8e60048ae6a0fb2aa0a560ec208ea424b1d5f04052f4a68d0d5f5bf0f1e68d6f3e9da79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
89KB

MD5
878bc4a4977965914965c5a43a77537a

SHA1
72573f6fb7944122a3e0227cd5dd3fbcb4d89e00

SHA256
618395ab5684e862e52a029b21f2b62e3b5cbf11fba63f2108cb8a1dcca095cf

SHA512
623f318c3a745b190d30cb6439927f3c3993a435c807b7c2d5c849bbcc61379ac7a9c6f51bdec59b49e6360995d1405eb4910964f6ddbc92ca9378b54053ab36

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit