hxxp://rafoalfaro[.]pe/three

Analysis

max time kernel
311s
max time network
307s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://rafoalfaro.pe/three

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133485055455955239"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
892	chrome.exe
892	chrome.exe
520	chrome.exe
520	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
892	chrome.exe
892	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe
Token: SeShutdownPrivilege	892	chrome.exe
Token: SeCreatePagefilePrivilege	892	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 1028	892	chrome.exe	88
PID 892 wrote to memory of 1028	892	chrome.exe	88
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 4260	892	chrome.exe	92
PID 892 wrote to memory of 1828	892	chrome.exe	93
PID 892 wrote to memory of 1828	892	chrome.exe	93
PID 892 wrote to memory of 3064	892	chrome.exe	94
PID 892 wrote to memory of 3064	892	chrome.exe	94
PID 892 wrote to memory of 3064	892	chrome.exe	94
PID 892 wrote to memory of 3064	892	chrome.exe	94
PID 892 wrote to memory of 3064	892	chrome.exe	94
PID 892 wrote to memory of 3064	892	chrome.exe	94
PID 892 wrote to memory of 3064	892	chrome.exe	94
PID 892 wrote to memory of 3064	892	chrome.exe	94
PID 892 wrote to memory of 3064	892	chrome.exe	94
PID 892 wrote to memory of 3064	892	chrome.exe	94
PID 892 wrote to memory of 3064	892	chrome.exe	94
PID 892 wrote to memory of 3064	892	chrome.exe	94
PID 892 wrote to memory of 3064	892	chrome.exe	94
PID 892 wrote to memory of 3064	892	chrome.exe	94
PID 892 wrote to memory of 3064	892	chrome.exe	94
PID 892 wrote to memory of 3064	892	chrome.exe	94
PID 892 wrote to memory of 3064	892	chrome.exe	94
PID 892 wrote to memory of 3064	892	chrome.exe	94
PID 892 wrote to memory of 3064	892	chrome.exe	94
PID 892 wrote to memory of 3064	892	chrome.exe	94
PID 892 wrote to memory of 3064	892	chrome.exe	94
PID 892 wrote to memory of 3064	892	chrome.exe	94

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://rafoalfaro.pe/three
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff9c6ae9758,0x7ff9c6ae9768,0x7ff9c6ae9778
  2⤵
  PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1896,i,1259679114503521637,4325681932273146000,131072 /prefetch:2
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1896,i,1259679114503521637,4325681932273146000,131072 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1896,i,1259679114503521637,4325681932273146000,131072 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3104 --field-trial-handle=1896,i,1259679114503521637,4325681932273146000,131072 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3132 --field-trial-handle=1896,i,1259679114503521637,4325681932273146000,131072 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4252 --field-trial-handle=1896,i,1259679114503521637,4325681932273146000,131072 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4284 --field-trial-handle=1896,i,1259679114503521637,4325681932273146000,131072 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4264 --field-trial-handle=1896,i,1259679114503521637,4325681932273146000,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:520

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a396ce9dea0c1fc64f933aa4a525f60a

SHA1
ace2dea04ba7ce67c8b5c7a8e35379dfa94e3f75

SHA256
dd068023a1200505ecbe33c2a505680e2e97ff91d273b88a14ddf252e4d6582b

SHA512
d77b775b7906e95dab8ec8a3f58c5203f6c1abb4fe3320bb151dbe00b2f27fea9327d08cb2139e17e41bf54ba6d823119c2bf3e74d2a46baf526a0f0193808e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
69ef758255b31cf5eb02f4efe3103795

SHA1
53d46da7e7f1f931d7bb8e4ec31518726e93b550

SHA256
54f8957c4a619fb6a97295f049d0d3b1b346f77ec94c5f2af3ceb82e6584c415

SHA512
11f3dabfad5605fbff0b27214e656e6eb5a3bcc8848d4e9f5ebbbcb4c442b1faabffe7277bd15df006489819cb61f422b76d450d75fad07aae09a991ed539a86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
a2f5dc9911dce4e641adaecdf19fef3f

SHA1
e3ba0ca71406b44838e0b32516d61e2c5ff71398

SHA256
3e3cbc2516d2057b779ab0ba1d8a11aa962c17ed17eaa9659b914882f28443fb

SHA512
f3cc9f3f115febe5cbf32a17dd3cf03a8fb0879b68aa4c1b1368cab26ec0f6e93ff82d7600315456b9f5f8f124b1a74aaa891abb84235b4c493f6dcbd2dd5f02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
a86eb8b33a437031b66a5a60dde28544

SHA1
5a42a506e6c4ae05c78d7ac40009d5109f52912b

SHA256
addf271e02d895fd814f9e593b1767d1760003abb3687e0b53541b7327a0d089

SHA512
4eb8d0e1997d4354c18d376e4e2efd5d750dcf4597daf86fc09086a1202c18e7b9934ec9f8ac80cd92acb57cdc8c24d3d4f0a4666d99ab522bf43b6bf90d5e5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit