Overview

overview

7

Static

static

7

Wave.rar

windows7-x64

3

Wave.rar

windows10-2004-x64

7

Analysis

  • max time kernel
    1817s
  • max time network
    1804s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/04/2024, 00:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Wave.rar
  • Size 157.0MB
  • Sample240409-atl37agd82
  • SHA256 1ca93fdcc11135777684369edc2bb27d287ffa05d09533c69107e88c153d96c2
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Wave.rar
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3576
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Wave.rar"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:5408
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2264 --field-trial-handle=1900,i,5392164901437861943,17555992231003326322,131072 /prefetch:8
    1⤵
      PID:5020
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=3192 --field-trial-handle=1900,i,5392164901437861943,17555992231003326322,131072 /prefetch:1
      1⤵
        PID:1772
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=3224 --field-trial-handle=1900,i,5392164901437861943,17555992231003326322,131072 /prefetch:1
        1⤵
          PID:1524
        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
          1⤵
            PID:4544
          • C:\Windows\system32\taskmgr.exe
            "C:\Windows\system32\taskmgr.exe" /4
            1⤵
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:4776
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --mojo-platform-channel-handle=4484 --field-trial-handle=1900,i,5392164901437861943,17555992231003326322,131072 /prefetch:1
            1⤵
              PID:4604
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4636 --field-trial-handle=1900,i,5392164901437861943,17555992231003326322,131072 /prefetch:8
              1⤵
                PID:2812
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4780 --field-trial-handle=1900,i,5392164901437861943,17555992231003326322,131072 /prefetch:8
                1⤵
                  PID:2504
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4932 --field-trial-handle=1900,i,5392164901437861943,17555992231003326322,131072 /prefetch:8
                  1⤵
                    PID:5096
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5080 --field-trial-handle=1900,i,5392164901437861943,17555992231003326322,131072 /prefetch:8
                    1⤵
                      PID:2296
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 --field-trial-handle=1900,i,5392164901437861943,17555992231003326322,131072 /prefetch:8
                      1⤵
                        PID:3092
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4044 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
                        1⤵
                          PID:3980
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1900,i,5392164901437861943,17555992231003326322,131072 /prefetch:8
                          1⤵
                            PID:5156
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4932 --field-trial-handle=1900,i,5392164901437861943,17555992231003326322,131072 /prefetch:2
                            1⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:6092
                          • C:\Windows\System32\rundll32.exe
                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                            1⤵
                              PID:1864
                            • C:\Users\Admin\Desktop\Wave\Wave.exe
                              "C:\Users\Admin\Desktop\Wave\Wave.exe"
                              1⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3536
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2364 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
                              1⤵
                                PID:380

                              Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    index-daab.js
                                    • Path C:\Users\Admin\AppData\Local\Temp\7zE025A41F9\Wave\dist\client\assets\index-daab.js
                                    • Size 3.4MB
                                    • SHA256 66909b895c0b86eb1edaf95c0d728939a4986f01bf5112023bf52a6afc021155
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    CefSharp.Core.Runtime.dll
                                    • Path C:\Users\Admin\Desktop\Wave\CefSharp.Core.Runtime.dll
                                    • Size 1.7MB
                                    • SHA256 6fd2685e02ef7c92ba5080faadb44f22fee528713f5101e2841c1230cba691e6
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    CefSharp.Core.dll
                                    • Path C:\Users\Admin\Desktop\Wave\CefSharp.Core.dll
                                    • Size 897KB
                                    • SHA256 636f8f865f23f2d47b73f3c16622e10b46437bbf7c89b0a2f70bae6129ab046a
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    CefSharp.Wpf.dll
                                    • Path C:\Users\Admin\Desktop\Wave\CefSharp.Wpf.dll
                                    • Size 114KB
                                    • SHA256 8507a4662220eca49d7d511183be801cd394f13dc0e9898c55361020fe9a4720
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Wave.exe
                                    • Path C:\Users\Admin\Desktop\Wave\Wave.exe
                                    • Size 7.0MB
                                    • SHA256 2c51f67e236cf95e2d51df4178699da09869ab077924cff0b3df1c512878ef2f
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Wave.exe.config
                                    • Path C:\Users\Admin\Desktop\Wave\Wave.exe.config
                                    • Size 4KB
                                    • SHA256 50bd62b7fa97cb9564c4b418034138f30af993f84988b085e2b16d39aa74d79f
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrome_elf.dll
                                    • Path C:\Users\Admin\Desktop\Wave\chrome_elf.dll
                                    • Size 1.3MB
                                    • SHA256 9f455612e32e5da431c7636773e34bd08dae79403cc8cf5b782b0ea4f1955799
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    libcef.dll
                                    • Path C:\Users\Admin\Desktop\Wave\libcef.dll
                                    • Size 204.4MB
                                    • SHA256 e2f3d912e2fa54b2d29330202bfb98394a3086aaff800417e382f772a6b07922
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    memory/3536-660-0x0000020B94960000-0x0000020B94970000-memory.dmp
                                    Download

                                    memory/3536-675-0x00007FFCE4180000-0x00007FFCE4C41000-memory.dmp
                                    Download

                                    memory/3536-668-0x0000020BAD600000-0x0000020BAD7C1000-memory.dmp
                                    Download

                                    memory/3536-664-0x0000020BAD510000-0x0000020BAD5F6000-memory.dmp
                                    Download

                                    memory/3536-662-0x0000020B948B0000-0x0000020B948D4000-memory.dmp
                                    Download

                                    memory/3536-658-0x0000020B925B0000-0x0000020B92CB8000-memory.dmp
                                    Download

                                    memory/3536-659-0x00007FFCE4180000-0x00007FFCE4C41000-memory.dmp
                                    Download

                                    memory/4776-16-0x000001B6F79A0000-0x000001B6F79A1000-memory.dmp
                                    Download

                                    memory/4776-15-0x000001B6F79A0000-0x000001B6F79A1000-memory.dmp
                                    Download

                                    memory/4776-0-0x000001B6F79A0000-0x000001B6F79A1000-memory.dmp
                                    Download

                                    memory/4776-1-0x000001B6F79A0000-0x000001B6F79A1000-memory.dmp
                                    Download

                                    memory/4776-14-0x000001B6F79A0000-0x000001B6F79A1000-memory.dmp
                                    Download

                                    memory/4776-2-0x000001B6F79A0000-0x000001B6F79A1000-memory.dmp
                                    Download

                                    memory/4776-17-0x000001B6F79A0000-0x000001B6F79A1000-memory.dmp
                                    Download

                                    memory/4776-20-0x000001B6F79A0000-0x000001B6F79A1000-memory.dmp
                                    Download

                                    memory/4776-19-0x000001B6F79A0000-0x000001B6F79A1000-memory.dmp
                                    Download

                                    memory/4776-18-0x000001B6F79A0000-0x000001B6F79A1000-memory.dmp
                                    Download