43e6ae7e38488e95741b1cad60843e7ce49419889285433eb4e697c175a153ab

Analysis

max time kernel
33s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WaveInstaller.exe
Size

2.3MB
MD5

8ad8b6593c91d7960dad476d6d4af34f
SHA1

0a95f110c8264cde7768a3fd76db5687fda830ea
SHA256

43e6ae7e38488e95741b1cad60843e7ce49419889285433eb4e697c175a153ab
SHA512

09b522da0958f8b173e97b31b6c7141cb67de5d30db9ff71bc6e61ca9a97c09bff6b17d6eaa03c840500996aad25b3419391af64de1c59e98ff6a8eac636b686
SSDEEP

49152:6inbT3qpTDQSmanAmwJAaDMg33U2pLYiniT:6inKpTJmWAmmAMPWin

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4516	WaveInstaller.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4436	helppane.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4436	helppane.exe
4436	helppane.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 1996	4436	helppane.exe	90
PID 4436 wrote to memory of 1996	4436	helppane.exe	90
PID 1996 wrote to memory of 2164	1996	msedge.exe	91
PID 1996 wrote to memory of 2164	1996	msedge.exe	91
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 4872	1996	msedge.exe	92
PID 1996 wrote to memory of 2260	1996	msedge.exe	93
PID 1996 wrote to memory of 2260	1996	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528884
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffe38dc46f8,0x7ffe38dc4708,0x7ffe38dc4718
    3⤵
    PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,10323696054957829007,16109626265173355229,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,10323696054957829007,16109626265173355229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
    3⤵
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,10323696054957829007,16109626265173355229,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10323696054957829007,16109626265173355229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:3704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10323696054957829007,16109626265173355229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
    3⤵
    PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10323696054957829007,16109626265173355229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10323696054957829007,16109626265173355229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
    3⤵
    PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9abb787f6c5a61faf4408f694e89b50e

SHA1
914247144868a2ff909207305255ab9bbca33d7e

SHA256
ecfd876b653319de412bf6be83bd824dda753b4d9090007231a335819d29ea07

SHA512
0f8139c45a7efab6de03fd9ebfe152e183ff155f20b03d4fac4a52cbbf8a3779302fed56facc9c7678a2dcf4f1ee89a26efd5bada485214edd9bf6b5cd238a55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b6c11a2e74ef272858b9bcac8f5ebf97

SHA1
2a06945314ebaa78f3ede1ff2b79f7357c3cb36b

SHA256
f88faeb70e2a7849587be3e49e6884f5159ac76ef72b7077ac36e5fbf332d777

SHA512
d577a5b3a264829494f5520cc975f4c2044648d51438885f319c2c74a080ea5dd719b6a885ed4d3401fd7a32341f88f26da5e3f29214da9afbbbd5ee950e8ec3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2814b8089fe348a6ef677186751a09a3

SHA1
0c639480f66f23a6cc05c1e03af56587970fc209

SHA256
8fed7e847c4697e2fc2bc67fd3ab0bca906f02e817bffe4286ae1a5b7c7a1311

SHA512
975a2db270a12bbe6cb0b0994d2491f3b44f64f158ed2c76644659a714c4f7b96e13107158a470ee4e063662b922721976c4c4b2cec81d6dd5d2f526b9c9ff92

Download Submit
memory/4516-6-0x00000000054A0000-0x00000000054A8000-memory.dmp

Filesize
32KB

Download
memory/4516-5-0x0000000005490000-0x0000000005498000-memory.dmp

Filesize
32KB

Download
memory/4516-0-0x000000007533E000-0x000000007533F000-memory.dmp

Filesize
4KB

Download
memory/4516-7-0x0000000075330000-0x0000000075AE0000-memory.dmp

Filesize
7.7MB

Download
memory/4516-8-0x0000000075330000-0x0000000075AE0000-memory.dmp

Filesize
7.7MB

Download
memory/4516-9-0x0000000009B00000-0x0000000009B38000-memory.dmp

Filesize
224KB

Download
memory/4516-10-0x0000000006590000-0x000000000659E000-memory.dmp

Filesize
56KB

Download
memory/4516-4-0x0000000005500000-0x0000000005582000-memory.dmp

Filesize
520KB

Download
memory/4516-3-0x00000000053E0000-0x0000000005492000-memory.dmp

Filesize
712KB

Download
memory/4516-2-0x0000000075330000-0x0000000075AE0000-memory.dmp

Filesize
7.7MB

Download
memory/4516-1-0x00000000006E0000-0x000000000092A000-memory.dmp

Filesize
2.3MB

Download