hxxps://www[.]mediafire[.]com/file/lqlncwwnvq7n1rq/WaveTrial[.]rar/file

Resubmissions

16/08/2024, 16:47

240816-vaxqssygmk 3

09/04/2024, 17:33

240409-v4zr9ade89 7

Analysis

max time kernel
173s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/lqlncwwnvq7n1rq/WaveTrial.rar/file

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3456	Wave.exe

Loads dropped DLL 6 IoCs

pid	Process
3456	Wave.exe
3456	Wave.exe
3456	Wave.exe
3456	Wave.exe
3456	Wave.exe
3456	Wave.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3180	msedge.exe
3180	msedge.exe
2532	msedge.exe
2532	msedge.exe
4972	identity_helper.exe
4972	identity_helper.exe
4940	msedge.exe
4940	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
3456	Wave.exe
3456	Wave.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	4992	7zG.exe
Token: 35	4992	7zG.exe
Token: SeSecurityPrivilege	4992	7zG.exe
Token: SeSecurityPrivilege	4992	7zG.exe
Token: SeDebugPrivilege	3456	Wave.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 3620	2532	msedge.exe	85
PID 2532 wrote to memory of 3620	2532	msedge.exe	85
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 2208	2532	msedge.exe	86
PID 2532 wrote to memory of 3180	2532	msedge.exe	87
PID 2532 wrote to memory of 3180	2532	msedge.exe	87
PID 2532 wrote to memory of 4908	2532	msedge.exe	88
PID 2532 wrote to memory of 4908	2532	msedge.exe	88
PID 2532 wrote to memory of 4908	2532	msedge.exe	88
PID 2532 wrote to memory of 4908	2532	msedge.exe	88
PID 2532 wrote to memory of 4908	2532	msedge.exe	88
PID 2532 wrote to memory of 4908	2532	msedge.exe	88
PID 2532 wrote to memory of 4908	2532	msedge.exe	88
PID 2532 wrote to memory of 4908	2532	msedge.exe	88
PID 2532 wrote to memory of 4908	2532	msedge.exe	88
PID 2532 wrote to memory of 4908	2532	msedge.exe	88
PID 2532 wrote to memory of 4908	2532	msedge.exe	88
PID 2532 wrote to memory of 4908	2532	msedge.exe	88
PID 2532 wrote to memory of 4908	2532	msedge.exe	88
PID 2532 wrote to memory of 4908	2532	msedge.exe	88
PID 2532 wrote to memory of 4908	2532	msedge.exe	88
PID 2532 wrote to memory of 4908	2532	msedge.exe	88
PID 2532 wrote to memory of 4908	2532	msedge.exe	88
PID 2532 wrote to memory of 4908	2532	msedge.exe	88
PID 2532 wrote to memory of 4908	2532	msedge.exe	88
PID 2532 wrote to memory of 4908	2532	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/lqlncwwnvq7n1rq/WaveTrial.rar/file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb305d46f8,0x7ffb305d4708,0x7ffb305d4718
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7252 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7640 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,11148125320547050501,8212206480989463559,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=8216 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:380

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4316

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\WaveTrial\" -spe -an -ai#7zMap25757:80:7zEvent2297
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4992

C:\Users\Admin\Downloads\WaveTrial\Wave.exe
"C:\Users\Admin\Downloads\WaveTrial\Wave.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e1a833a778984885866f5dde5e67a75e

SHA1
a566cae00278d09f7ec2c79fc25d602de0bccd5c

SHA256
d0feadfb3220be49928f46841015b5cd63983324e90ae357106a125b529293ab

SHA512
f82229e1ff0a017c67c3e5ef97623f56bf9d6b52a258a8f13738e4a27330fcfee986e206c6fd27908fccaea555fea407595b099034a51f10e2871543c00b469a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
134f4841e52c320ca18e8edd5c5dea39

SHA1
8b8ca125721eefda84a1fbb1e9e9a49b2d3fba48

SHA256
b67842234548ba4b17da96bed876ad3801a6b5c82d0dcad881034125bedf8e6f

SHA512
b9ce26d1ef0d9a790dcc2b5a0c5cac8cb18b0a16bb19e5763539ab66dbf30b48074045d90775af61a2c6d8e58176562c763a56837cbc01616099d725103772bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
65a53f79a91d5d2316dbcb52c905c6c7

SHA1
f254564b19ef18b591ab4e0456ad232986cc41f9

SHA256
d5c52da2be80ad41cfc708dc78d07a1c9c0ec1874e802bb023060c9970fde3be

SHA512
c1101c6ee1f136194583e0100ef92b530bc2c61a12ecc4f84388760b5952dbbecfdde14fc263d795c7fc28c150d01ada776a6d2aa417e60338869382354cb621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
4c4bf764b56c0c8c99995b2b6bdcd61a

SHA1
f17a892ce3f65a2c7a5bd1a206cfab758c9a4fa9

SHA256
e6fb1a819a6027c1b96d521b83cb69d65cd2f33506e17fb314f7a92439b3a6d9

SHA512
26d02b154b77b009f2f76f3138cd7990ae401479141bb9c0cfe019ec21814df89ff2a46fb09c2767b8bdc4ebc5b840b0e2773f61c6dc25b7c1bee768fc9ef9b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
24573ef9232a71984c8af9bd074689b7

SHA1
2154181b241eb527a03cfd26c09f1e8e7133e7bb

SHA256
65fe45e34010c9293a723b4ce27b45977b7c40b85abd73f89e0678dbcf8492cb

SHA512
e8ceed218d2d7c6bca46eba90e697b75b46ddecf7bc1782eda4b52808b020e5efd7e59a135dc25277dd0a7032c402b39c841446f2504fe02149bd6c5f8a94579

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b4c9.TMP

Filesize
2KB

MD5
a445bb837fd28b76eb9f5aecb0e2c549

SHA1
3dd254b0df7e0bd40eac9be45e10bc95a66a2250

SHA256
e23d1c84d99f2baadb87fac48f04066104da43e1626ae381f26307103dbeecfa

SHA512
ed1a958f1869f7a502cd7e851e7c1535615130a7f0f6b8f1083493a0195229d0946e883c15dc4f73df1c89fef2154837218153c52cc982a66a2e1639434cffec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c020c2e66256e570f34f7aeb950a1f4f

SHA1
6d7d1ae0fb8ef12445ee9b093d5abd0bc77e8c9f

SHA256
f7712e9ed1bae1ebda43b367ca84796233e6dc0ee1f93a98b465d4be20697565

SHA512
ef4f450f755fa71a4a100753ad4882d96b7440f3ea22a17c2882679731646ac8b481d93722c6fe986a3253ef33b8c9742008a50885bd86b2cc7fad7fba33da28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7e4220b4259e2410050d59734440df67

SHA1
6ec964969217ef65680105f925abac00881098ea

SHA256
4d56c7aba1d6a9c5b9add972fc2642c2f5875de92cc886c2de43678641e7f34e

SHA512
823eca5aaba7a30e0154b3c2ce3d44ee885525ae0151982c344d23fc39cc9b3ed8d005a6b80f96082f8bdc781d39dba25822f100226e07edc6af9313b74b1be0

Download Submit
C:\Users\Admin\Downloads\WaveTrial.rar

Filesize
156.4MB

MD5
0159c8632597db4afc30105f24cdd3ea

SHA1
5e80272c6ff0d820cdb0a4f98f7fbf0d558f5957

SHA256
0ff0224edb6a27b5c23adc7fb759864bb3c645f2cf2f38d0a0290c1fa691fdd2

SHA512
587e4dc7ae21036f3aaec3e99955670ef0c457fab23db79b71f0963acc79a1f2eca61b2233b6770672a139b0f8a9ae98ad65bed2431aac476fe7d4e293e666fe

Download Submit
C:\Users\Admin\Downloads\WaveTrial\CefSharp.Core.Runtime.dll

Filesize
1.7MB

MD5
21719cf581f5cc98b21c748498f1cbfe

SHA1
aaada7a02fadcbd25b836c924e936ce7d7ee0c2a

SHA256
6fd2685e02ef7c92ba5080faadb44f22fee528713f5101e2841c1230cba691e6

SHA512
6394ddabc7ad03895ecddb9943371935e0a2320e933b380a563eaf03d1a039c7180aee763834170c85485416b1af38b55c1dafff7311b25513369b01dce22598

Download Submit
C:\Users\Admin\Downloads\WaveTrial\CefSharp.Core.dll

Filesize
897KB

MD5
16f8a4945f5bdd5c1c6c73541e1ebec3

SHA1
4342762c43f54c4caafaae40f933599a9bb93cb5

SHA256
636f8f865f23f2d47b73f3c16622e10b46437bbf7c89b0a2f70bae6129ab046a

SHA512
04115c425c3015ee4355cde2a6e5e28ec24745ea77761a40c0986b54dc14bc67cb142986988d79df87e75ea54d21ded9384842e01cf0714b84f7378e6a13400d

Download Submit
C:\Users\Admin\Downloads\WaveTrial\CefSharp.Wpf.dll

Filesize
114KB

MD5
36946182df277e84a313c3811adac855

SHA1
bcd21305861e22878271e37604b7b033ec347eb3

SHA256
8507a4662220eca49d7d511183be801cd394f13dc0e9898c55361020fe9a4720

SHA512
80b1e947b1940dccfe5be8a1ba1e8c1d9eacb122d73724a21233164f5b318fa57c249256f621f0f9c1e6a9e4c902eec58827bb899e20f2990f4ade1d685f1abd

Download Submit
C:\Users\Admin\Downloads\WaveTrial\Wave.exe

Filesize
7.0MB

MD5
a8bd4a6b2f1d00928e61870a5688c13d

SHA1
e17646d5279534f2e3eb0e0cfc8b6c536bc0c095

SHA256
2c51f67e236cf95e2d51df4178699da09869ab077924cff0b3df1c512878ef2f

SHA512
6b5175beea4071668c87b16af3177bbb2cbaff6b28909dc1e09ad5b16b449c62d6adc372a0094de627fe9835f0c474d16708c3f698355ba1664bf321fa19f5fb

Download Submit
C:\Users\Admin\Downloads\WaveTrial\Wave.exe.config

Filesize
4KB

MD5
ae882f91fe4dc052fabd06774b2d30aa

SHA1
92cbe5c66373ea3682116fab8068534920d281d7

SHA256
50bd62b7fa97cb9564c4b418034138f30af993f84988b085e2b16d39aa74d79f

SHA512
3fe7174259817beae8101e2ab7be068b9030bccff00a1f5aee13cfab3585037fdb1f9b470feea212351f85ec96f31da63289e4574d69e4ef413fce3fda3c6c78

Download Submit
C:\Users\Admin\Downloads\WaveTrial\chrome_elf.dll

Filesize
1.3MB

MD5
5b3802f150c42ad6d24674ae78f9d3e8

SHA1
428139f0a862128e55e5231798f7c8e2df34a92a

SHA256
9f455612e32e5da431c7636773e34bd08dae79403cc8cf5b782b0ea4f1955799

SHA512
07afbd49e17d67957c65929ca7bdfe03b33b299c66c48aa738262da480ed945712d891be83d35bd42833d5465ef60e09c7a5956df0a369ec92d3bc2d25a09007

Download Submit
C:\Users\Admin\Downloads\WaveTrial\dist\client\assets\index-daab.js

Filesize
3.4MB

MD5
a19bf5e804004e0397a4547f9a8568fe

SHA1
daad35851be0986f1a99f5563976309c2f7fc800

SHA256
66909b895c0b86eb1edaf95c0d728939a4986f01bf5112023bf52a6afc021155

SHA512
2e98dedf48e2f16543ef28cdfad832f77a6250f6e71cadd2245e58aa4872a91934f390ad8552a1c59b035ead123904b95c31a1fb3d7ba3dbf49968b018755c5a

Download Submit
C:\Users\Admin\Downloads\WaveTrial\libcef.dll

Filesize
147.9MB

MD5
e5165de8779b46d1ca31765f890a5ec1

SHA1
5828ba08ace364a3e80a4ed33aeaa4cad57f4c2b

SHA256
3b9573f2d3bdc5c30e87f9f087cecb02d7b967ba9c3f2a1a709ad67d413ed132

SHA512
67a8dbaf6e96539188d30105b12d032ca4ac51fc08bd45723e58cdc2ed9e2d1ef909251d97e85f23ed66cbbc056686cbc14937fd714d3d7524491b1f1511e722

Download Submit
C:\Users\Admin\Downloads\WaveTrial\libcef.dll

Filesize
165.9MB

MD5
57f2699c43499a10f7944cd6292638a4

SHA1
47551ce3757c34d94f63e3276cfe00caf39cac7f

SHA256
2c47b2e9d917dc8780b79f0966e0ff78a7895d0bb80a0a509994ac19928075c1

SHA512
249a7382fd5b6977795d7b505c5d52c931ca448d7958e091a412eb6060d639f6c5e4a067fd7111e1eb856229b79fb05ef448e9925f22372b5a48d8bdfbd82d51

Download Submit
C:\Users\Admin\Downloads\WaveTrial\libcef.dll

Filesize
173.8MB

MD5
01f47076f63002c4af2b2feb0176621a

SHA1
6c2b8737bd762a1232f8b175fe39ee4b0e1ed087

SHA256
892e631f651f17d174c399146b20bc54f593f277149cc352cbd848f9ac5ddc5d

SHA512
c816e5f0c58248a60676185765c8a8d6eec9352e9d5af442d16273ba1f6ee0401f0d8b4b2dde3e2914fc98b09608d357630fb34cae653a22c2c89dd087a56f0c

Download Submit
memory/3456-1011-0x00000182CF500000-0x00000182CF510000-memory.dmp

Filesize
64KB

Download
memory/3456-1019-0x00000182E9A10000-0x00000182E9BD1000-memory.dmp

Filesize
1.8MB

Download
memory/3456-1015-0x00000182E9920000-0x00000182E9A06000-memory.dmp

Filesize
920KB

Download
memory/3456-1013-0x00000182CF540000-0x00000182CF564000-memory.dmp

Filesize
144KB

Download
memory/3456-1010-0x00007FFB1D800000-0x00007FFB1E2C1000-memory.dmp

Filesize
10.8MB

Download
memory/3456-1009-0x00000182CE9D0000-0x00000182CF0D8000-memory.dmp

Filesize
7.0MB

Download
memory/3456-1036-0x00000182E9BE0000-0x00000182EABE0000-memory.dmp

Filesize
16.0MB

Download
memory/3456-1037-0x00007FFB1D800000-0x00007FFB1E2C1000-memory.dmp

Filesize
10.8MB

Download