1ca93fdcc11135777684369edc2bb27d287ffa05d09533c69107e88c153d96c2

Analysis

max time kernel
1172s
max time network
1184s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 00:29

Target

Wave/Wave.exe.config
Size

4KB
MD5

ae882f91fe4dc052fabd06774b2d30aa
SHA1

92cbe5c66373ea3682116fab8068534920d281d7
SHA256

50bd62b7fa97cb9564c4b418034138f30af993f84988b085e2b16d39aa74d79f
SHA512

3fe7174259817beae8101e2ab7be068b9030bccff00a1f5aee13cfab3585037fdb1f9b470feea212351f85ec96f31da63289e4574d69e4ef413fce3fda3c6c78
SSDEEP

96:wrwvxwDbDPwxOuzhrifBUXAUFUkUYUvUAc:wrw2DIxOEriJXejNGbc

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1168	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Wave\Wave.exe.config
1⤵
- Modifies registry class
PID:3960

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact