hxxp://www[.]kellerhomes[.]net/

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 15:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.kellerhomes.net/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133602622389915095"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2548	chrome.exe
2548	chrome.exe
3360	chrome.exe
3360	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 1184	2548	chrome.exe	90
PID 2548 wrote to memory of 1184	2548	chrome.exe	90
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3228	2548	chrome.exe	92
PID 2548 wrote to memory of 3260	2548	chrome.exe	93
PID 2548 wrote to memory of 3260	2548	chrome.exe	93
PID 2548 wrote to memory of 4864	2548	chrome.exe	94
PID 2548 wrote to memory of 4864	2548	chrome.exe	94
PID 2548 wrote to memory of 4864	2548	chrome.exe	94
PID 2548 wrote to memory of 4864	2548	chrome.exe	94
PID 2548 wrote to memory of 4864	2548	chrome.exe	94
PID 2548 wrote to memory of 4864	2548	chrome.exe	94
PID 2548 wrote to memory of 4864	2548	chrome.exe	94
PID 2548 wrote to memory of 4864	2548	chrome.exe	94
PID 2548 wrote to memory of 4864	2548	chrome.exe	94
PID 2548 wrote to memory of 4864	2548	chrome.exe	94
PID 2548 wrote to memory of 4864	2548	chrome.exe	94
PID 2548 wrote to memory of 4864	2548	chrome.exe	94
PID 2548 wrote to memory of 4864	2548	chrome.exe	94
PID 2548 wrote to memory of 4864	2548	chrome.exe	94
PID 2548 wrote to memory of 4864	2548	chrome.exe	94
PID 2548 wrote to memory of 4864	2548	chrome.exe	94
PID 2548 wrote to memory of 4864	2548	chrome.exe	94
PID 2548 wrote to memory of 4864	2548	chrome.exe	94
PID 2548 wrote to memory of 4864	2548	chrome.exe	94
PID 2548 wrote to memory of 4864	2548	chrome.exe	94
PID 2548 wrote to memory of 4864	2548	chrome.exe	94
PID 2548 wrote to memory of 4864	2548	chrome.exe	94

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.kellerhomes.net/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa45ee9758,0x7ffa45ee9768,0x7ffa45ee9778
  2⤵
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1880,i,4293205195586528485,7568791349446682674,131072 /prefetch:2
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1880,i,4293205195586528485,7568791349446682674,131072 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1880,i,4293205195586528485,7568791349446682674,131072 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3076 --field-trial-handle=1880,i,4293205195586528485,7568791349446682674,131072 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3096 --field-trial-handle=1880,i,4293205195586528485,7568791349446682674,131072 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3988 --field-trial-handle=1880,i,4293205195586528485,7568791349446682674,131072 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3096 --field-trial-handle=1880,i,4293205195586528485,7568791349446682674,131072 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4016 --field-trial-handle=1880,i,4293205195586528485,7568791349446682674,131072 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4064 --field-trial-handle=1880,i,4293205195586528485,7568791349446682674,131072 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4032 --field-trial-handle=1880,i,4293205195586528485,7568791349446682674,131072 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2764 --field-trial-handle=1880,i,4293205195586528485,7568791349446682674,131072 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2080 --field-trial-handle=1880,i,4293205195586528485,7568791349446682674,131072 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1880,i,4293205195586528485,7568791349446682674,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3360

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1328 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
edcb3397e5d48088a635e21536359678

SHA1
68c738a832c1c6e528d1466de3967b87d0c01969

SHA256
afb3bbc868bedfccc4a49d4a3380e2a8a96001e518f783130c950f9f22313961

SHA512
d74ad515c5098625eb83c5f98549dea3adbb651dca42ed645e7b3b774cb5fa4e3a80ef3f5971b1912b0323d3fe5b392acbf7deadd8e1a0db3031943419939419

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
a29fb6e8c210199ba71899dc3c7bb94b

SHA1
0b3a11a59370fec3966e61c2c814eae1b49cba8b

SHA256
42a6dcf963f583facf1bd7b4e9e9d8ba10c2599e70e0bcf70ba31bae1be3e81c

SHA512
49e0a1dd1c19728ae3689a2993fcd501ab562bb7687c53b2a952ff8cd2deed8059f6c4b3df40b988dc765686514479429d6fe2213b40aef77fa7fd7dc1ea1150

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
58e2445dbbc5145fb230b0ff4b47b434

SHA1
0551f565ce8b276487ec1f054b0b7b6551a5cf2c

SHA256
bbc95699ef9455a5cd51753e993be8685f3f76f8acbbb3e63cc5f9bc185466c3

SHA512
661b751c7cad11f93170766d4dc8be0e5e2ecf16c2ddb0f12d2fa6d3742ecab9dbf0c99f5d8e2db3aedfd31d112ed86ef82223e2efe48b5b9d865e4ef52c4f80

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
441f7196c6296ec41b8a5194816c5293

SHA1
3801e787a294bb76f9b2e818b5e698136fd7348b

SHA256
53016091f53c3a8bbf0ac057d73dd11fe9ecee608e85b4087bef36ade6e4f6c8

SHA512
1b35194a785e03c5b52e7eb0410389112566193b3e0f1d6a0cdc45b3752d9b7194e801bb137e6a53a86edbce037aebd1a8c45fe3c5c7231fb633f6b906d60098

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit