Analysis

  • max time kernel
    1799s
  • max time network
    1799s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25/09/2024, 08:22

General

  • Target

    https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=D9hUwa6JQThAYoNsnBRq5jDnFhYqGnjuQp&password=c%3DDOGE%2Czap%3DURX&workers=1.5

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=D9hUwa6JQThAYoNsnBRq5jDnFhYqGnjuQp&password=c%3DDOGE%2Czap%3DURX&workers=1.5
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2772
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe94449758,0x7ffe94449768,0x7ffe94449778
      2⤵
        PID:2932
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1508 --field-trial-handle=1724,i,6611515122050986233,14253475797265134,131072 /prefetch:2
        2⤵
          PID:924
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1988 --field-trial-handle=1724,i,6611515122050986233,14253475797265134,131072 /prefetch:8
          2⤵
            PID:808
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2076 --field-trial-handle=1724,i,6611515122050986233,14253475797265134,131072 /prefetch:8
            2⤵
              PID:832
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2856 --field-trial-handle=1724,i,6611515122050986233,14253475797265134,131072 /prefetch:1
              2⤵
                PID:624
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1724,i,6611515122050986233,14253475797265134,131072 /prefetch:1
                2⤵
                  PID:4868
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4324 --field-trial-handle=1724,i,6611515122050986233,14253475797265134,131072 /prefetch:8
                  2⤵
                    PID:356
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4632 --field-trial-handle=1724,i,6611515122050986233,14253475797265134,131072 /prefetch:8
                    2⤵
                      PID:2220
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1452 --field-trial-handle=1724,i,6611515122050986233,14253475797265134,131072 /prefetch:2
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3752
                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                    1⤵
                      PID:2524

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                      Filesize

                      96B

                      MD5

                      0f8e40692d680fd4c4f217628f1e3671

                      SHA1

                      0842222978526e08ade45c499f0b4c0c6200d0df

                      SHA256

                      499ccdad1bf279787791d3ac17f51869af4b4c7bde3a354cee4fd52f737e3c1d

                      SHA512

                      9efe4dc8ce82b99f777c6322e395123d1ba89e6eea41663effe9244bc5251201f569b68ee845b8cb40e208ffdd8408fe6a367c343c9034199e252052a2ff175a

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      767B

                      MD5

                      f29485ca16715a972625a951d49b10db

                      SHA1

                      f140ed992db12c77abb2af1476a608e146950c99

                      SHA256

                      970d0cefbbdbad00716537fbb7f05ddf016281d60d0a14989fe35c44cbe462ee

                      SHA512

                      6bc381c9b17ec96edbd7601d9e7b8f57ed9ab674ccad8bcb9d2777f0cd84020f9c832160303922a676b79b3c866732cc8ac330a703134de04b565b0c62b1e075

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      6KB

                      MD5

                      56640b05d99976c5222664bfc1a732a9

                      SHA1

                      2871a1f2682d2cd4dc7338ea8d16a1028d2c5dcc

                      SHA256

                      cf76bc224ac96ee6007e15e6a70780fbe6cca1a425ede770dfdc750e4d279acd

                      SHA512

                      f04f609b8ce74e7b50ee352d44ea2ed5f9234bfe7bb50919af3715c05a13e9e31189acb9cc638afd1c2284417562688a6698e7a937e68e1a56f4c601d0013216

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      6KB

                      MD5

                      a21fec645cd6b87c8f9af71b7550eb8c

                      SHA1

                      a1a7179b6d4d3d495c087871625dc17f3a9a6694

                      SHA256

                      4a15252cd83a9f19ff57a4b855a11793ebd328d25a024d9101bf52a2e77dee25

                      SHA512

                      7de45d01c0d5343b92d6dd788024a4fefa9a861aeefe6ede6440511fa133aa51e3d2f3ff3adfe78c268a0572fa8050ed9d3cdbfbb7e7cf6f1713d58ff8ac1d59

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      6KB

                      MD5

                      bedfa36b648e0e8fd69f64af90bb2d85

                      SHA1

                      094ef3c11acab44b71c0e8b7afbfb42ca963badc

                      SHA256

                      452667e20c7e95dd7478eb2d182fe4ff34cbe1ff08690d9fe9c361ab45a116be

                      SHA512

                      943ae6eabede7465de40ce3f66f483d093ff8951a04e439b0ed740bb959884f9428b20ab7882fe49f9c834caf58d7021d44a84e3c39c42a77843bdf09671c61c

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      136KB

                      MD5

                      18088dbb9d4f64741e24e4639743a36f

                      SHA1

                      fff0144b8b9c1a1c1a04276df4d51b916fc6f537

                      SHA256

                      d65491d07c87ef21065d9ef634c9b81a9e580081eb28000d4a128643d2bac1b6

                      SHA512

                      5cc1b11a2e392bad8df7b2b0034516ee7a530045e2cfa73795f1e739da09fb0d78fb25b2225b0d6b259b5c9f33abdcd8d820d02910c87afc160075e3aef95909

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                      Filesize

                      2B

                      MD5

                      99914b932bd37a50b983c5e7c90ae93b

                      SHA1

                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                      SHA256

                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                      SHA512

                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd