Overview

overview

8

Static

static

3

WaveInstaller.exe

windows11-21h2-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    WaveInstaller.exe
  • Size 1.5MB
  • Sample240705-ebenlsthpf
  • SHA256 344700d3141170111a9b77db100f6961cc54a2988d964d34f7e1ca57aa42aa2a
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
microsoftdiscoveryphishing

Malware Config

Targets

    • Target
      WaveInstaller.exe
    • Size 1.5MB
    • SHA256 344700d3141170111a9b77db100f6961cc54a2988d964d34f7e1ca57aa42aa2a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    microsoftdiscoveryphishing

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks for any installed AV software in registry

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Detected potential entity reuse from brand microsoft.

      phishingmicrosoft

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks