Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 07:01
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.electricalvolt.com/2019/06/why-making-current-of-circuit-breaker-is-more-than-breaking-current/
Resource
win10v2004-20231023-en
General
-
Target
https://www.electricalvolt.com/2019/06/why-making-current-of-circuit-breaker-is-more-than-breaking-current/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133432957007529678" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2180 chrome.exe 2180 chrome.exe 4960 chrome.exe 4960 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeCreatePagefilePrivilege 2180 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2180 wrote to memory of 180 2180 chrome.exe 47 PID 2180 wrote to memory of 180 2180 chrome.exe 47 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1120 2180 chrome.exe 86 PID 2180 wrote to memory of 1516 2180 chrome.exe 87 PID 2180 wrote to memory of 1516 2180 chrome.exe 87 PID 2180 wrote to memory of 3108 2180 chrome.exe 88 PID 2180 wrote to memory of 3108 2180 chrome.exe 88 PID 2180 wrote to memory of 3108 2180 chrome.exe 88 PID 2180 wrote to memory of 3108 2180 chrome.exe 88 PID 2180 wrote to memory of 3108 2180 chrome.exe 88 PID 2180 wrote to memory of 3108 2180 chrome.exe 88 PID 2180 wrote to memory of 3108 2180 chrome.exe 88 PID 2180 wrote to memory of 3108 2180 chrome.exe 88 PID 2180 wrote to memory of 3108 2180 chrome.exe 88 PID 2180 wrote to memory of 3108 2180 chrome.exe 88 PID 2180 wrote to memory of 3108 2180 chrome.exe 88 PID 2180 wrote to memory of 3108 2180 chrome.exe 88 PID 2180 wrote to memory of 3108 2180 chrome.exe 88 PID 2180 wrote to memory of 3108 2180 chrome.exe 88 PID 2180 wrote to memory of 3108 2180 chrome.exe 88 PID 2180 wrote to memory of 3108 2180 chrome.exe 88 PID 2180 wrote to memory of 3108 2180 chrome.exe 88 PID 2180 wrote to memory of 3108 2180 chrome.exe 88 PID 2180 wrote to memory of 3108 2180 chrome.exe 88 PID 2180 wrote to memory of 3108 2180 chrome.exe 88 PID 2180 wrote to memory of 3108 2180 chrome.exe 88 PID 2180 wrote to memory of 3108 2180 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.electricalvolt.com/2019/06/why-making-current-of-circuit-breaker-is-more-than-breaking-current/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa13499758,0x7ffa13499768,0x7ffa134997782⤵PID:180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1876,i,3063628149595872136,16194747207294474657,131072 /prefetch:22⤵PID:1120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1876,i,3063628149595872136,16194747207294474657,131072 /prefetch:82⤵PID:1516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1876,i,3063628149595872136,16194747207294474657,131072 /prefetch:82⤵PID:3108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=1876,i,3063628149595872136,16194747207294474657,131072 /prefetch:12⤵PID:3120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3016 --field-trial-handle=1876,i,3063628149595872136,16194747207294474657,131072 /prefetch:12⤵PID:3892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=5232 --field-trial-handle=1876,i,3063628149595872136,16194747207294474657,131072 /prefetch:12⤵PID:3920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 --field-trial-handle=1876,i,3063628149595872136,16194747207294474657,131072 /prefetch:82⤵PID:4652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5436 --field-trial-handle=1876,i,3063628149595872136,16194747207294474657,131072 /prefetch:12⤵PID:4632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3972 --field-trial-handle=1876,i,3063628149595872136,16194747207294474657,131072 /prefetch:82⤵PID:3096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5644 --field-trial-handle=1876,i,3063628149595872136,16194747207294474657,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4960
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5714cad6af7e217285f4e8d0462f80485
SHA1525686d1d39f82ce659407111a34842c45eb023d
SHA256c40244cc614121be8efab9a1bcf488dccc447c5a53225a3f7e5eb814b0b1105a
SHA5127430326f1a9f2511dab3366c5293319ab3111c5375c239d62d3faf7bc58c22a556b32e5be6d271fc6f1d9ddb70d01347f79584633a314f8b17ddea1ea57f1103
-
Filesize
4KB
MD55bc5a23e07e016bd6f80617d53776a37
SHA1cd4a61b759d7d8a3214f43adf4da7fb0f6bdb899
SHA25659e00dca0afc753f5b7869880c67658d61339ff67121a8bea4b0496d084dc62b
SHA512e0add228ba4c9cedee5e6f6bca684b1e044d60a479b73f70795a7d658a786ff9b3e777b538604478e6380dc98b6721603c8451f4bf4dfb96c3a660c5de3288d9
-
Filesize
1KB
MD5d5061e52f6a123d709fa4078ed0bd689
SHA188a0438766bc8e2055df563bc0c5c434158518ea
SHA2566b26dcd342f249792db28430d6d9f1bb244f5d33b29c14d14b751caa0e01a4db
SHA51239fd2473bdac20daa5aec9215b1b0c175b40d3de0d9afbf99f5a0c10672bc445405d90cb1681ddf331125bd6a2f8630bb7087ed690ff620ffb26df70ac2a417a
-
Filesize
5KB
MD53f01957f51d3d43a96a218cb9410a0b1
SHA11035147414a893e54227db51d5c513db21227820
SHA2566017be894cc636bf92de88e3752242856c67875ab3bcc3b8f6b23478284e23cc
SHA512d1d8dba57fd91a59da50b90f607e2ffc1448e0595f456d842fe30df012172ade60304b2459acf450e21183be649d5f5d9a57b44c8e093baf054950ac9b7bd80e
-
Filesize
5KB
MD5b11860130e074c9209b3ef5393a18b0c
SHA1c8519eeefa952681e5c54a3b66699bd41b3e7d8f
SHA256543234380b17cbc2886d108df669d0e9e126638d32a8c68ef55b5905becf34b4
SHA5125acc332dcb977dd2c335acf81112da77e54239a12dc592eb5a7e2d994ea5e9ab9b72eac826e8229ceb55706f4c073e1f6f61d765ff34c77b183c6433c9c4f1a8
-
Filesize
6KB
MD577e431af73e0f308ddbf9706dbc209ab
SHA184e65301870522c03ff8cdbd1fe5fd76b94c6276
SHA256ae74985a4b873134ab515330a12241f02ed8880528f36df9cc361e5302bae63a
SHA5129f6ffcc302e5d8bd22dea384efd20f2e0b2bd843cd0888361f159a2af75aa807d06de3b0315b80fbb9457937b47b8903b2807e2911fedf591c4521b45b3765f7
-
Filesize
6KB
MD5aad97be7a9ad027fffe8bd6ecae88905
SHA18849a60554135027977e85707bdc23c67cd21d6a
SHA25671f1cc731f41fd20f9e490922f9c45a067c2dc0e6ede43ab18a7450513cbd5a5
SHA512343a81f07feedd123e3445959f4cc882f56b1f208f63874a6bf54e827c601453fe3ba617a7a86b0ae2b56f1c87a542a21f2c2fd16f9fd0614178bfa03fee9a45
-
Filesize
109KB
MD53857b57a8b18d2a3c51b23f65eaa39e1
SHA1dfb32f20adac59dc09cdf38dcbd0d6050ff41b5b
SHA256ce56197810fd62c75e29b55c66f3746a56a152decb9e6d54566492cd92ccd70c
SHA512d5800df9b4869ac68a2080c365048cf5126dd33d1aaa6816264e6a05e8f240c1d71adabfbb7fdb08d64775fe8de4ac732fc30783a4c07e741370cc9f54bf2d3e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd