1ca93fdcc11135777684369edc2bb27d287ffa05d09533c69107e88c153d96c2 | Triage

Analysis

max time kernel
1792s
max time network
1803s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 00:29

Sharing

Report Analysis Logs

General

Target

Wave/dist/start.cmd
Size

11B
MD5

3a6deb11e01a2191a3819f0a6364d95c
SHA1

e6ecc23bfd21a7a237c4e036741e0806659e86fc
SHA256

51e2aec7acfef86caefa3739b1d373b29809156df836793ac15d4af93d32fea6
SHA512

01fe050212b12bab96d605674a93ae98e8f498dcc17815c0ea7233e42c005483c9f5de1dcde734987012830106f0b40dccadc42e566aac49ed3cf37e986eea01

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 1952 wrote to memory of 1832 1952 cmd.exe node.exe
PID 1952 wrote to memory of 1832 1952 cmd.exe node.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Wave\dist\start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Users\Admin\AppData\Local\Temp\Wave\dist\node.exe
node server
2⤵
PID:1832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5104 --field-trial-handle=2132,i,4018525042804461719,1997165676266557055,262144 --variations-seed-version /prefetch:8
1⤵
PID:1892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4000 --field-trial-handle=2132,i,4018525042804461719,1997165676266557055,262144 --variations-seed-version /prefetch:8
1⤵
PID:564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads