ac398ebc96bf3990030832620f432edeedb49fbe43b239468bc0e0d2cd0399f1

Analysis

max time kernel
136s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2023, 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Install_Waves_Central.exe
Size

173.2MB
MD5

2e8ab5cd2d32cd04217aad0918debd89
SHA1

e342ce9378e3222de16ab9e2574e6c38e28188b2
SHA256

ac398ebc96bf3990030832620f432edeedb49fbe43b239468bc0e0d2cd0399f1
SHA512

494d3ac8223fbb5618e7e3a0891e7d84955562124760d576d72bc1f11208ae22c4db5b289adcc76b591126e995c520a5097b268fbbc09f7bbd0658a67b5b7b09
SSDEEP

3145728:9K8W+iUafIA1S0x6zUKTiqCO0TZcPSfRRVCRVqUM/02/6Bz:oBpgArwUKF2ZcPSZ7QVKh/e

Score

4^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
3668	Install_Waves_Central.exe
3668	Install_Waves_Central.exe
3668	Install_Waves_Central.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2284	3668	WerFault.exe	83

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Install_Waves_Central.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Install_Waves_Central.exe = "11000"	Install_Waves_Central.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3668	Install_Waves_Central.exe
3668	Install_Waves_Central.exe

C:\Users\Admin\AppData\Local\Temp\Install_Waves_Central.exe
"C:\Users\Admin\AppData\Local\Temp\Install_Waves_Central.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 1780
  2⤵
  - Program crash
  PID:2284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3668 -ip 3668
1⤵
PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsdB392.tmp\EmbedHTML.dll

Filesize
99KB

MD5
c08431578109da597240a3cbaf65fd63

SHA1
687ef12f3db594332a3c9e679b8822eb9bed89e1

SHA256
ee95b019b9c8681be56038bf4a4455f74c4f83c287fbaded6b5aa7b5dcf4a38e

SHA512
8c8814a4c11ebe48be075e228477f394077efac04f2b7ffbc39339270d9a0b699f8398a17aa4cd4a0570c8f8c9e7de757facd30c326f1dde480a799542b07e8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsdB392.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsdB392.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit