Analysis

  • max time kernel
    2693s
  • max time network
    2290s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    31-08-2024 10:02

General

  • Target

    https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DSvLZDmch7n5X3RwfgXs6pncT2BEToPQxv&password=c%3DDOGE%2Czap%3DURX&workers=1.5

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DSvLZDmch7n5X3RwfgXs6pncT2BEToPQxv&password=c%3DDOGE%2Czap%3DURX&workers=1.5
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2524
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7019758,0x7fef7019768,0x7fef7019778
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2016
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=1276,i,12114597246269163430,2101625279532243890,131072 /prefetch:2
      2⤵
        PID:2464
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1464 --field-trial-handle=1276,i,12114597246269163430,2101625279532243890,131072 /prefetch:8
        2⤵
          PID:2888
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1544 --field-trial-handle=1276,i,12114597246269163430,2101625279532243890,131072 /prefetch:8
          2⤵
            PID:2268
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2192 --field-trial-handle=1276,i,12114597246269163430,2101625279532243890,131072 /prefetch:1
            2⤵
              PID:2648
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2200 --field-trial-handle=1276,i,12114597246269163430,2101625279532243890,131072 /prefetch:1
              2⤵
                PID:2596
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1636 --field-trial-handle=1276,i,12114597246269163430,2101625279532243890,131072 /prefetch:2
                2⤵
                  PID:1028
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3288 --field-trial-handle=1276,i,12114597246269163430,2101625279532243890,131072 /prefetch:8
                  2⤵
                    PID:340
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3472 --field-trial-handle=1276,i,12114597246269163430,2101625279532243890,131072 /prefetch:8
                    2⤵
                      PID:1540
                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                    1⤵
                      PID:1760

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      342B

                      MD5

                      df17282a386d7a2c29c73d0dfd36ea82

                      SHA1

                      64e6b3cf4db1da06120bcef9203e7e73c2980f31

                      SHA256

                      062e6dae74e25465b7dbd393556656866cc7dda502dfe012f09e4c97bbbd62b0

                      SHA512

                      c001447e12050eb3d0979b196b77f4c86c7a8a83ee7159403b2d5f14bf54bb09ca0f57d3a513e4ee6cfb0c1b7ea53ed4d78d681a2d706c4b159d20de013398e7

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\metadata

                      Filesize

                      114B

                      MD5

                      16bad32482f7c34e2a29423ddde855be

                      SHA1

                      a0032a19467f57179d6507a073619c57228a1eee

                      SHA256

                      11ff5c757bd47b9896aeebfed49f03e535b96d8e5af53243ce7587ad8ef7fe88

                      SHA512

                      88a3afc8a8592d9609692b467b25e7fb9c95af427b372ab4bfdddb78d973a411ea2730e357025c5ef44f898272319d63ea2bf2a807fd8d3da16422ceb6e54b4f

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\ff384447-e904-4531-aaa2-0b0cf24f2ece.dmp

                      Filesize

                      964KB

                      MD5

                      b3f22a75c9cbe20b15306ef2d9c11a6a

                      SHA1

                      6c0778f3b1402aa004196d94420b7353298cce1a

                      SHA256

                      be7e11f744b40d2d757ef211c996738865d7cac37eed04e2d12147bb424d2e26

                      SHA512

                      fd5541feb3477f9b53a91a19683ecacb6344257487ada493aff846b3cd9225d42d470b67c723b62237d76a60a0655f73a25b6f33743e53833d5c9ba755379751

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                      Filesize

                      40B

                      MD5

                      f956de956cddcda63d6d9df45c0c463a

                      SHA1

                      0e4903dc7cd96445215d305e980cff550c725983

                      SHA256

                      2d78531b24f16c12409ad3a8528ce5ab18b4898cc11bf6a159edc02f11f86088

                      SHA512

                      0e4c73d55986be7d548101a336fe8596335cd43bd7121c13c272eecd7c7078a37674a5bed7ac0d72a0061a6f3d53b5ca02c2d5d06276f7b4dcf7866d9614b196

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\23716d2a-4fdc-44c6-9cc9-e6c3cc7cacda.tmp

                      Filesize

                      6KB

                      MD5

                      35aace77cb15f5ff70b7ac98f2ae5ac9

                      SHA1

                      702fdbb83a1cc2f0e32a4ddfc3a2ec8da5fe0dd6

                      SHA256

                      07ade30eef5fa84bcd5970c1148944d9886c8a837275e6e217b2752cf898728d

                      SHA512

                      2e782d5c536f381363b28f942f0416030e3bb095a6331baf96a4398e955e8166b516d42a7fa97fff113b655f5033a0d97e4c02eba3a6f62fc6f3289be461b334

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                      Filesize

                      264KB

                      MD5

                      f50f89a0a91564d0b8a211f8921aa7de

                      SHA1

                      112403a17dd69d5b9018b8cede023cb3b54eab7d

                      SHA256

                      b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                      SHA512

                      bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      5KB

                      MD5

                      8f8b673292f9a05d0200d7224b218ce0

                      SHA1

                      cbeae9534f31c533534ea1a573b164cb213f5e5b

                      SHA256

                      4f847b4d57a3e58c0e1b2f3cc774d694b0c8b863a5aa3df2e9fb9c1338a86f67

                      SHA512

                      a8059bd4a2e786c9133b0a524019c09635d68239fdd4bf20cdc9cfe3fb63254bb6d4db7f8c3847199574761ba2df9e73892e2a206f6e11a5b2eb967ecfcd479c

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      6KB

                      MD5

                      5881c49a395b73ff92ee5d17b127cfaa

                      SHA1

                      c254fe48d6c0ae1fc5c52077e98fd3dd0f0827ca

                      SHA256

                      77778eb5218b0e0d65cc02c5acfda821e870b10a1761e117ec1241ec745ecb72

                      SHA512

                      2169fbef9f70a3a072204ba46cf18379cf775840b6d3875c58ea85e5cbcdaa34c3d15bf8f9befaf4a87bc46fe3dcf7564d5ac1873f738c1db04f3354ceac9e02

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                      Filesize

                      16B

                      MD5

                      18e723571b00fb1694a3bad6c78e4054

                      SHA1

                      afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                      SHA256

                      8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                      SHA512

                      43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                    • C:\Users\Admin\AppData\Local\Temp\Cab16CD.tmp

                      Filesize

                      70KB

                      MD5

                      49aebf8cbd62d92ac215b2923fb1b9f5

                      SHA1

                      1723be06719828dda65ad804298d0431f6aff976

                      SHA256

                      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                      SHA512

                      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                    • C:\Users\Admin\AppData\Local\Temp\Tar17CA.tmp

                      Filesize

                      181KB

                      MD5

                      4ea6026cf93ec6338144661bf1202cd1

                      SHA1

                      a1dec9044f750ad887935a01430bf49322fbdcb7

                      SHA256

                      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                      SHA512

                      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b