Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
1URLScan
urlscan
1https://webminer.pag...
windows7-x64
3https://webminer.pag...
windows10-1703-x64
3https://webminer.pag...
windows10-2004-x64
3https://webminer.pag...
windows11-21h2-x64
4https://webminer.pag...
android-10-x64
1https://webminer.pag...
android-11-x64
1https://webminer.pag...
android-13-x64
1https://webminer.pag...
android-9-x86
1https://webminer.pag...
ubuntu-18.04-amd64
3https://webminer.pag...
ubuntu-20.04-amd64
4https://webminer.pag...
ubuntu-22.04-amd64
3https://webminer.pag...
ubuntu-24.04-amd64
6Analysis
-
max time kernel
1s -
max time network
1681s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
30/09/2024, 11:01
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DG3AezgvUxfN1mwPWKwmpMzSqEGbqXsyXH&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DG3AezgvUxfN1mwPWKwmpMzSqEGbqXsyXH&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DG3AezgvUxfN1mwPWKwmpMzSqEGbqXsyXH&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DG3AezgvUxfN1mwPWKwmpMzSqEGbqXsyXH&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DG3AezgvUxfN1mwPWKwmpMzSqEGbqXsyXH&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
android-x64-20240624-en
Behavioral task
behavioral6
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DG3AezgvUxfN1mwPWKwmpMzSqEGbqXsyXH&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral7
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DG3AezgvUxfN1mwPWKwmpMzSqEGbqXsyXH&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
android-33-x64-arm64-20240624-en
Behavioral task
behavioral8
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DG3AezgvUxfN1mwPWKwmpMzSqEGbqXsyXH&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral9
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DG3AezgvUxfN1mwPWKwmpMzSqEGbqXsyXH&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral10
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DG3AezgvUxfN1mwPWKwmpMzSqEGbqXsyXH&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral11
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DG3AezgvUxfN1mwPWKwmpMzSqEGbqXsyXH&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral12
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DG3AezgvUxfN1mwPWKwmpMzSqEGbqXsyXH&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
ubuntu2404-amd64-20240729-en
General
-
Target
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DG3AezgvUxfN1mwPWKwmpMzSqEGbqXsyXH&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Malware Config
Signatures
-
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/pci/devices/0000:00:03.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/class firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/device firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor firefox File opened for reading /sys/bus/pci/devices firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/irq firefox File opened for reading /sys/bus/pci/devices firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/device firefox -
description ioc Process File opened for reading /proc/self/task/1610/stat firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/self/stat firefox File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems sed File opened for reading /proc/self/task/1584/stat firefox File opened for reading /proc/self/task/1597/stat firefox File opened for reading /proc/self/stat firefox File opened for reading /proc/self/fd dbus-send File opened for reading /proc/self/fd dbus-send File opened for reading /proc/self/stat firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems sed
Processes
-
/usr/bin/xdg-openxdg-open "https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DG3AezgvUxfN1mwPWKwmpMzSqEGbqXsyXH&password=c%3DDOGE%2Czap%3DURX&workers=1.5"1⤵PID:1480
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
- Reads runtime system information
PID:1481 -
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr3⤵PID:1482
-
-
-
/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵PID:1487
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:1486
-
-
/bin/grepgrep -i "^xfce_desktop_window"2⤵PID:1492
-
-
/usr/bin/xpropxprop -root2⤵PID:1491
-
-
/bin/grepgrep -q "^Enlightenment"2⤵PID:1494
-
-
/bin/unameuname2⤵PID:1497
-
-
/bin/grepgrep -q "^file://"2⤵PID:1500
-
-
/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1502
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1502
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1502
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1502
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1502
-
-
/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1502
-
-
/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1502
-
-
/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
PID:1505
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/https2⤵PID:1506
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
- Reads runtime system information
PID:1507 -
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr4⤵PID:1508
-
-
-
/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵PID:1513
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:1512
-
-
/bin/grepgrep -i "^xfce_desktop_window"3⤵PID:1515
-
-
/usr/bin/xpropxprop -root3⤵PID:1514
-
-
/bin/grepgrep -q "^Enlightenment"3⤵PID:1520
-
-
/bin/unameuname3⤵PID:1523
-
-
/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
PID:1527
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1532
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1531
-
-
/usr/bin/headhead -n 13⤵PID:1530
-
-
/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵PID:1529
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1537
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1536
-
-
/usr/bin/headhead -n 13⤵PID:1535
-
-
/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵PID:1534
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1542
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1541
-
-
/usr/bin/headhead -n 13⤵PID:1540
-
-
/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵PID:1539
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1547
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1546
-
-
/usr/bin/headhead -n 13⤵PID:1545
-
-
/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵PID:1544
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1552
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1551
-
-
/usr/bin/headhead -n 13⤵PID:1550
-
-
/bin/grepgrep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵PID:1549
-
-
-
/bin/sedsed "s/:/ /g"2⤵
- Reads runtime system information
PID:1555
-
-
/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:1558
-
-
/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:1561
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1569
-
-
/usr/bin/whichwhich firefox2⤵PID:1570
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1573
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1576
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1581
-
-
/usr/bin/firefox/usr/bin/firefox "https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DG3AezgvUxfN1mwPWKwmpMzSqEGbqXsyXH&password=c%3DDOGE%2Czap%3DURX&workers=1.5"2⤵PID:1582
-
/usr/bin/whichwhich /usr/bin/firefox3⤵PID:1583
-
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox "https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DG3AezgvUxfN1mwPWKwmpMzSqEGbqXsyXH&password=c%3DDOGE%2Czap%3DURX&workers=1.5"2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1582
-
-
/bin/grepgrep -q "%s"2⤵PID:1594
-
-
/usr/bin/x-www-browserx-www-browser "https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DG3AezgvUxfN1mwPWKwmpMzSqEGbqXsyXH&password=c%3DDOGE%2Czap%3DURX&workers=1.5"2⤵PID:1595
-
/usr/bin/whichwhich /usr/bin/x-www-browser3⤵PID:1596
-
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox "https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DG3AezgvUxfN1mwPWKwmpMzSqEGbqXsyXH&password=c%3DDOGE%2Czap%3DURX&workers=1.5"2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1595
-
-
/bin/grepgrep -q "%s"2⤵PID:1606
-
-
/usr/bin/firefoxfirefox "https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DG3AezgvUxfN1mwPWKwmpMzSqEGbqXsyXH&password=c%3DDOGE%2Czap%3DURX&workers=1.5"2⤵PID:1608
-
/usr/bin/whichwhich /usr/bin/firefox3⤵PID:1609
-
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox "https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DG3AezgvUxfN1mwPWKwmpMzSqEGbqXsyXH&password=c%3DDOGE%2Czap%3DURX&workers=1.5"2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1608
-
-
/bin/grepgrep -q "%s"2⤵PID:1619
-
-
/bin/grepgrep -q "%s"2⤵PID:1622
-
-
/bin/grepgrep -q "%s"2⤵PID:1624
-
-
/bin/grepgrep -q "%s"2⤵PID:1626
-
-
/bin/grepgrep -q "%s"2⤵PID:1628
-
-
/bin/grepgrep -q "%s"2⤵PID:1630
-
-
/bin/grepgrep -q "%s"2⤵PID:1632
-
-
/bin/grepgrep -q "%s"2⤵PID:1634
-
-
/bin/grepgrep -q "%s"2⤵PID:1636
-
-
/bin/grepgrep -q "%s"2⤵PID:1638
-
-
/bin/grepgrep -q "%s"2⤵PID:1640
-
-
/bin/grepgrep -q "%s"2⤵PID:1642
-
-
/bin/grepgrep -q "%s"2⤵PID:1644
-
-
/bin/grepgrep -q "%s"2⤵PID:1646
-