Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
26/05/2024, 17:04
General
- Target Wave.exe
- Size 63KB
- Sample240526-vlfxesec59
- SHA256 c3ceb18bfa4b4d0d31659159869eeb6239c0964907d25bb4b6f6ae0717e0edfb
Score
10/10
Malware Config
Extracted
Family
-
xworm
C2
-
212.132.117.91:7000
Attributes
-
Install_directory
%AppData%
-
install_file
SystemFiles.exe
Signatures
- Detect Xworm Payload 2 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Executes dropped EXE 64 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies data under HKEY_USERS 18 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 31 IoCs
- Suspicious use of SendNotifyMessage 23 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"6⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"7⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"8⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"10⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"11⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"12⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"13⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"14⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"16⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"17⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"18⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"19⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"21⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"22⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"23⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"24⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"25⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"26⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"27⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"28⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"29⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"30⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"31⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"32⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"33⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"34⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"35⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"36⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"37⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"38⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"39⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"40⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"41⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"42⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"43⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"44⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"45⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"46⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"47⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"48⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"49⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"50⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"51⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"52⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"53⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"55⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"57⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"58⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"59⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"63⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"66⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"68⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"69⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"71⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"72⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"73⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"74⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"75⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"76⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"77⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"78⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"79⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"81⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"82⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"83⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"85⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"86⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"87⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"88⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"89⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"90⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"91⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"92⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"93⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"94⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"95⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"97⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"99⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"100⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"101⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"102⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"103⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"104⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"105⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"106⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"107⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"109⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"110⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"111⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"112⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"113⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"114⤵
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"115⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"116⤵
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"116⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"116⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"115⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"114⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"113⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"113⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"112⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"112⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"111⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"111⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"110⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"110⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"109⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"109⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"108⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"108⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"107⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"107⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"106⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"106⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"105⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"105⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"104⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"104⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"103⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"103⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"102⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"101⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"100⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"100⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"99⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"99⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"98⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"98⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"97⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"97⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"96⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"96⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"95⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"95⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"94⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"94⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"93⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"93⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"92⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"92⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"91⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"91⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"90⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"90⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"89⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"89⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"88⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"88⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"87⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"87⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"86⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"86⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"85⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"85⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"84⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"84⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"83⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"83⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"82⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"82⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"81⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"81⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"80⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"80⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"79⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"79⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"78⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"78⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"77⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"77⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"76⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"76⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"75⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"75⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"74⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"74⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"73⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"73⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"72⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"72⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"71⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"71⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"70⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"70⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"69⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"69⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"68⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"68⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"67⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"67⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"66⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"66⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"65⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"65⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"64⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"64⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"63⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"63⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"62⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"62⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"61⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"61⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"60⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"60⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"59⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"59⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"58⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"58⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"57⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"57⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"56⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"56⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"55⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"55⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"54⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"54⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"53⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"53⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"52⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"52⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"51⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"51⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"50⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"50⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"49⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"49⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"48⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"48⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"47⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"47⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"46⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"46⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"45⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"45⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"44⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"44⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"43⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"43⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"42⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"37⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe'38⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RobloxWave.exe'38⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\SystemFiles.exe'38⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SystemFiles.exe'38⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SystemFiles" /tr "C:\Users\Admin\AppData\Roaming\SystemFiles.exe"38⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"C:\Users\Admin\AppData\Local\Temp\KrampUI.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWave.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Roaming\SystemFiles.exeC:\Users\Admin\AppData\Roaming\SystemFiles.exe1⤵
-
C:\Users\Admin\AppData\Roaming\SystemFiles.exeC:\Users\Admin\AppData\Roaming\SystemFiles.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
Wave.exe.log
KrampUI.exe
KrampUI.exe
KrampUI.exe
KrampUI.exe
KrampUI.exe
RobloxWave.exe
RobloxWave.exe
__PSScriptPolicyTest_0dzyc2k4.jxg.ps1
memory/728-3-0x00007FFEB3960000-0x00007FFEB4421000-memory.dmp
memory/728-140-0x00007FFEB3960000-0x00007FFEB4421000-memory.dmp
memory/728-4-0x00007FFEB3960000-0x00007FFEB4421000-memory.dmp
memory/1984-136-0x00007FFEB3963000-0x00007FFEB3965000-memory.dmp
memory/1984-1-0x00007FFEB3963000-0x00007FFEB3965000-memory.dmp
memory/1984-0-0x0000000000550000-0x0000000000568000-memory.dmp
memory/1984-139-0x00007FFEB3960000-0x00007FFEB4421000-memory.dmp
memory/1984-2-0x00007FFEB3960000-0x00007FFEB4421000-memory.dmp
memory/7692-72-0x0000000000C20000-0x0000000000C3A000-memory.dmp
memory/8580-89-0x000001E6D3EC0000-0x000001E6D3EE2000-memory.dmp
memory/16348-138-0x00007FFED1910000-0x00007FFED1B05000-memory.dmp