Analysis
-
max time kernel
60s -
max time network
61s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2023, 11:45
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cm.naukri.com/?redirect=https://cleverwolf.in/wpss/?xa=a2hhbGlkLmFsaGFyYmlAbmVvbS5jb20=
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
60 seconds
General
-
Target
https://cm.naukri.com/?redirect=https://cleverwolf.in/wpss/?xa=a2hhbGlkLmFsaGFyYmlAbmVvbS5jb20=
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133239627634469454" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2016 chrome.exe 2016 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeCreatePagefilePrivilege 2016 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2016 wrote to memory of 1672 2016 chrome.exe 86 PID 2016 wrote to memory of 1672 2016 chrome.exe 86 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 1240 2016 chrome.exe 87 PID 2016 wrote to memory of 628 2016 chrome.exe 88 PID 2016 wrote to memory of 628 2016 chrome.exe 88 PID 2016 wrote to memory of 2820 2016 chrome.exe 89 PID 2016 wrote to memory of 2820 2016 chrome.exe 89 PID 2016 wrote to memory of 2820 2016 chrome.exe 89 PID 2016 wrote to memory of 2820 2016 chrome.exe 89 PID 2016 wrote to memory of 2820 2016 chrome.exe 89 PID 2016 wrote to memory of 2820 2016 chrome.exe 89 PID 2016 wrote to memory of 2820 2016 chrome.exe 89 PID 2016 wrote to memory of 2820 2016 chrome.exe 89 PID 2016 wrote to memory of 2820 2016 chrome.exe 89 PID 2016 wrote to memory of 2820 2016 chrome.exe 89 PID 2016 wrote to memory of 2820 2016 chrome.exe 89 PID 2016 wrote to memory of 2820 2016 chrome.exe 89 PID 2016 wrote to memory of 2820 2016 chrome.exe 89 PID 2016 wrote to memory of 2820 2016 chrome.exe 89 PID 2016 wrote to memory of 2820 2016 chrome.exe 89 PID 2016 wrote to memory of 2820 2016 chrome.exe 89 PID 2016 wrote to memory of 2820 2016 chrome.exe 89 PID 2016 wrote to memory of 2820 2016 chrome.exe 89 PID 2016 wrote to memory of 2820 2016 chrome.exe 89 PID 2016 wrote to memory of 2820 2016 chrome.exe 89 PID 2016 wrote to memory of 2820 2016 chrome.exe 89 PID 2016 wrote to memory of 2820 2016 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://cm.naukri.com/?redirect=https://cleverwolf.in/wpss/?xa=a2hhbGlkLmFsaGFyYmlAbmVvbS5jb20=1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff954289758,0x7ff954289768,0x7ff9542897782⤵PID:1672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1832,i,1518557789632290490,10578402067982120084,131072 /prefetch:22⤵PID:1240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1832,i,1518557789632290490,10578402067982120084,131072 /prefetch:82⤵PID:628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1832,i,1518557789632290490,10578402067982120084,131072 /prefetch:82⤵PID:2820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3192 --field-trial-handle=1832,i,1518557789632290490,10578402067982120084,131072 /prefetch:12⤵PID:4808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3204 --field-trial-handle=1832,i,1518557789632290490,10578402067982120084,131072 /prefetch:12⤵PID:3224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4556 --field-trial-handle=1832,i,1518557789632290490,10578402067982120084,131072 /prefetch:12⤵PID:4788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3236 --field-trial-handle=1832,i,1518557789632290490,10578402067982120084,131072 /prefetch:12⤵PID:4728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4784 --field-trial-handle=1832,i,1518557789632290490,10578402067982120084,131072 /prefetch:12⤵PID:2412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3308 --field-trial-handle=1832,i,1518557789632290490,10578402067982120084,131072 /prefetch:12⤵PID:3720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5260 --field-trial-handle=1832,i,1518557789632290490,10578402067982120084,131072 /prefetch:82⤵PID:1792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 --field-trial-handle=1832,i,1518557789632290490,10578402067982120084,131072 /prefetch:82⤵PID:3736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 --field-trial-handle=1832,i,1518557789632290490,10578402067982120084,131072 /prefetch:82⤵PID:2480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4816 --field-trial-handle=1832,i,1518557789632290490,10578402067982120084,131072 /prefetch:12⤵PID:832
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1236
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240B
MD56e7968b27ed574a739c96253d7101861
SHA1bf0889dec560b55cad5252e580e869496531ee8a
SHA25618bcf040644183fd2438e3d971bc508b7043e1119dec05531d30fb9223f6a31e
SHA512f949903e70d3956166aadbb3987a6eaedb6f87ac4ed744e071086291ce8a699abc3cc09480d85c6703335d6b65824766d07eda567e9bdd53b717be5f02087ee7
-
Filesize
538B
MD5fe9bc86fcc157bcc71a053a5754c196b
SHA13fb34c28f89f876f6284dd6c6fe5f3c4645ef85c
SHA25613c23b1616d46df7b39af93a1cfc96af4db9aa2b2f85dc04545cf14528b56bbe
SHA512a80f98a5e077a2e9480dd8d17d9f82192b32a36a769e373da3b08b24e7d8884806b48150960ea102c5820766c79223e996cff8f60806ce7e08b7ac7b950fcf9b
-
Filesize
6KB
MD58c21d8acb4d24fb0785da80f03dd8b4c
SHA1dd91c8206f1487824e5af02c62768691e5724d2e
SHA2563cb4cdd5ea4941f1ee2a86ad05a26891b57faa3a9d2b4193e598ef63d017b30d
SHA512c1a2a55918dbdf9c3ddb7797937836070d20529101bae2d81419bac9bfb852dfaa12dedaef24fa4816d1440c62fb35f7b410623b78a765747b10d12a024d5eb8
-
Filesize
15KB
MD548765ba3071e1b249ab9fe034bca3708
SHA11960fd44919923d0792c9fa8307d19f6d8929d16
SHA2561500dca11d093b919ff7e4a7884289a7d141689109b2c698a40c684af8341409
SHA512ad088075a6a9050b45d41d426942ce9bf1945ea72aa155f5c8ffbbe9152ac51da9047d82b1bbc94e325819c84fc705bef1eb0629ce49d37cd593087e03c3238e
-
Filesize
144KB
MD56aba26a80e1215c8914cf791448d7b83
SHA15df239bd87b844096299d528b4c60cfafeffb1a9
SHA256444d5ea8d017a3a9e13964fc10bf4387d5f6ed9d4181ec5029957a02a2ccea12
SHA51243a0660e2cc695fe841be85b429bd7bc85008140de31efa4219f9ed6d7e031b12eaef5b75095560ccb6c2b3b5c275770557c2ae964e6e17ae5556eb01d66e2a3
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd