Analysis

  • max time kernel
    1800s
  • max time network
    1801s
  • platform
    windows10-1703_x64
  • resource
    win10-20240611-en
  • resource tags

    arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01/09/2024, 10:08

General

  • Target

    https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DSvLZDmch7n5X3RwfgXs6pncT2BEToPQxv&password=c%3DDOGE%2Czap%3DURX&workers=1.5

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DSvLZDmch7n5X3RwfgXs6pncT2BEToPQxv&password=c%3DDOGE%2Czap%3DURX&workers=1.5
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4316
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff9cbef9758,0x7ff9cbef9768,0x7ff9cbef9778
      2⤵
        PID:4420
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1868,i,6309706094296783210,6081586079397225159,131072 /prefetch:2
        2⤵
          PID:3844
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=1868,i,6309706094296783210,6081586079397225159,131072 /prefetch:8
          2⤵
            PID:2788
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2084 --field-trial-handle=1868,i,6309706094296783210,6081586079397225159,131072 /prefetch:8
            2⤵
              PID:2748
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1868,i,6309706094296783210,6081586079397225159,131072 /prefetch:1
              2⤵
                PID:764
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1868,i,6309706094296783210,6081586079397225159,131072 /prefetch:1
                2⤵
                  PID:2252
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 --field-trial-handle=1868,i,6309706094296783210,6081586079397225159,131072 /prefetch:8
                  2⤵
                    PID:2204
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 --field-trial-handle=1868,i,6309706094296783210,6081586079397225159,131072 /prefetch:8
                    2⤵
                      PID:3492
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4584 --field-trial-handle=1868,i,6309706094296783210,6081586079397225159,131072 /prefetch:8
                      2⤵
                        PID:3984
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4344 --field-trial-handle=1868,i,6309706094296783210,6081586079397225159,131072 /prefetch:8
                        2⤵
                          PID:4956
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5020 --field-trial-handle=1868,i,6309706094296783210,6081586079397225159,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3964
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:3904

                        Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                96B

                                MD5

                                05a138d1b0ad48c1374c4f63463d0276

                                SHA1

                                4103bb9023756bcf659b4260a39a1812abf3eea7

                                SHA256

                                a9db1d576052b682a8a52524db44d6d21830e7b49c12b371b5ef31c0c3dbb553

                                SHA512

                                b2f75d1fb4c378f67750ee8a7fab23b6d1d065a77739154f8e1325d6e36aab4feba56a6b558e73558d819c0ade7aaaef62887a1888f608368192f438d6f79e3d

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                1KB

                                MD5

                                98396dd0eefc8cf87b7274f6c23411d2

                                SHA1

                                c757e5d2145ce5aa58faa0b07cbbf2c1902cf544

                                SHA256

                                deca7f3e1d36607fa8a95773132af78be37cbd38542cf5923fe129c22703d4bb

                                SHA512

                                2cee06e9c0f9137247a32acd84bc330a833fcc0597d322c29b26725c7da7624f4d9baf304185e605b12e70f80d78fa155e87282c91651582f669be9c09a27a32

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                873B

                                MD5

                                22845a4258d3d2b1a98b3c1be1ff2975

                                SHA1

                                75957287c032e3f60317231a6ecbdf709c70d5b3

                                SHA256

                                1f67f36a9994b27dad3871655623bf73d316f2d564029472628701318dfd65c9

                                SHA512

                                2992f0835061c5853dc8810d075aed650c678674abdd8dbbf2da66b6630015c556db3f1d4bd697fa7dcc5db2f5c8a33631b6bfdc1bbd164ecdb7ea7024e87907

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                483d6d1ec9f2a3403958571fdf95be52

                                SHA1

                                ff2177f0af199b04dcc40dd239da7a1c87a8f72b

                                SHA256

                                fd16faa3b0ca1cb442d3315f745a19e4e0bf2e44129c6a9624c37061d3b04c05

                                SHA512

                                f34be88cc89c276d6eb36902256301d1a97ded98e4dcd2f119d44eb6a1331698321c65be229a546e73da7d8f54dc92900f5db9c8475b5cf2dc4867881131b752

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                9353395e6d54b4cb3bee6447432918e0

                                SHA1

                                221e5fc2b745c630bc9d7193034980076fd0368a

                                SHA256

                                abc59b4078581880d9f49c80c37d40b06e01e9d69f14d8ce78ee2d20e5411a3a

                                SHA512

                                3504a57769000538fa9a16505cec8b11a95fc6afedf08f55d899fc2b3587f13f085b1bb765e5ca926201cc9f3c82f84c263045424e364782fa134d231e6c9863

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                4d481b6b90c9bdc132f5d602ddde12fa

                                SHA1

                                7d62ae7c8beb1541049ed29b4dbd3df8afdde5e0

                                SHA256

                                820c886487ae900d1155411c6433ebf78fa4b5ccba7fa1fb41a70c2ec2a298bc

                                SHA512

                                83f6e7ab2bd8918a0a3f27f287ce23da633f662035d543f8656856f01b408cd1e9d6848f2d418e15587461ebca743cc1e69864837623dfcdf5cd1caf7e3115ff

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                150KB

                                MD5

                                9f0dca109209b3f11236fb36d9230f2b

                                SHA1

                                23dc194877f604dfadb5ee27e68c9a70cf559c8f

                                SHA256

                                c248c43a03eab45f4de0a103f067e0cc0021e4cf3ef06599fb25e06ac90b254b

                                SHA512

                                66d79d0525486e313e70984bed60c7d86aef9343bc785dfb0958e105d74b47bd4cd7791eb82a2a57f214dda0fae3fca159b1772a9642ebc84dd4e0de7cf771f6

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                150KB

                                MD5

                                b5b1b6af5a536a84c84d1413b54be446

                                SHA1

                                98891b8560adf272bcf0df26c7247099dbbcf992

                                SHA256

                                25d38a3c00891e7728102dc195a0eb6e1d3140e0499121b5a55e07e0657042d4

                                SHA512

                                dfcdc4404f40d039a1bf01019825375156136b9f1a6b1a9eb84773cbda1b337d406bbe95050cfbf6c4c69e0c23fcf1cebe18da4f40c25532374f41209a7b3e1f

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                150KB

                                MD5

                                330c3151fa661a65d6225bd950354784

                                SHA1

                                a47a977acf38546ee365b09fe59c52e52b5e7e9f

                                SHA256

                                84117f621e440f52741678461be85e84a9c4936a1d9fa5a0e75a0b06057ff575

                                SHA512

                                3ffe69cd6d47e1a5dbf1a872b91ca68fb54ec104e76ad1989bee17a8b63f7f6b098e8ddebaa7b87d85c8292341bea99ea864a38364fa866544ab2e69805bd98f

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                167KB

                                MD5

                                99e99c8eab3cc6cc8ae5991623f594a9

                                SHA1

                                57aa138f91acc4f3b81d1f04fe9b82b942779f31

                                SHA256

                                fa0817ef7a165cfa9be4e775b694ff2d6f5a5b18fb652ce2b603180ab1ad897a

                                SHA512

                                097db6122ebb15be7b3a688e45c71d0add6250e18c87e59205f42d34aef481984cb91aab97504197f8c55a779cf1f4e0674e253bd500dfbd3445446b7d4f8d16

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                Filesize

                                2B

                                MD5

                                99914b932bd37a50b983c5e7c90ae93b

                                SHA1

                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                SHA256

                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                SHA512

                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd