34e141c88f20dffe25bf118a427415ce55cbc123848a2f6d2d5ccfe390a746ec

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wave/CrackedWave/CrackedWave.exe
Size

17.7MB
MD5

5d2ef5bc98a7c487c6a6b05a9e60db9c
SHA1

ff805987e2cf3a90d09ed4a32013a6e86344768c
SHA256

ecaceebf2b28b741603a75bbc8dce0f089b0d75314b2481c06534754a0e62517
SHA512

2fdbafbb48cc3713121e5215015be2727398f10e76575ffea63624ee303c60fbc388f734213c1aa75537374db96538bbf23c9939e4aa71784262f1ae2adb19bf
SSDEEP

393216:BfkZgLfrx0Lx8uOMpfo/nXlujARdGv4kHkzMmsW0W3WWRqusbMGCNFxHWy:lr+Lx8uOafgn1uj0dGv4fAjBZMGyFd

Score

7^/10

pyinstaller

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2696	WaveCracked.sfx.exe
2148	WaveWindows.exe
2544	WaveCracked.exe
2768	WaveCracked.exe

Loads dropped DLL 10 IoCs

pid	Process
2684	CrackedWave.exe
2696	WaveCracked.sfx.exe
2604	Process not Found
2768	WaveCracked.exe
2768	WaveCracked.exe
2768	WaveCracked.exe
2768	WaveCracked.exe
2768	WaveCracked.exe
2768	WaveCracked.exe
2768	WaveCracked.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral15/files/0x0034000000015cce-28.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2148	WaveWindows.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2148	WaveWindows.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2696	2684	CrackedWave.exe	30
PID 2684 wrote to memory of 2696	2684	CrackedWave.exe	30
PID 2684 wrote to memory of 2696	2684	CrackedWave.exe	30
PID 2684 wrote to memory of 2148	2684	CrackedWave.exe	31
PID 2684 wrote to memory of 2148	2684	CrackedWave.exe	31
PID 2684 wrote to memory of 2148	2684	CrackedWave.exe	31
PID 2684 wrote to memory of 2148	2684	CrackedWave.exe	31
PID 2696 wrote to memory of 2544	2696	WaveCracked.sfx.exe	32
PID 2696 wrote to memory of 2544	2696	WaveCracked.sfx.exe	32
PID 2696 wrote to memory of 2544	2696	WaveCracked.sfx.exe	32
PID 2544 wrote to memory of 2768	2544	WaveCracked.exe	34
PID 2544 wrote to memory of 2768	2544	WaveCracked.exe	34
PID 2544 wrote to memory of 2768	2544	WaveCracked.exe	34

C:\Users\Admin\AppData\Local\Temp\Wave\CrackedWave\CrackedWave.exe
"C:\Users\Admin\AppData\Local\Temp\Wave\CrackedWave\CrackedWave.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Users\Admin\AppData\Roaming\WaveCracked.sfx.exe
  "C:\Users\Admin\AppData\Roaming\WaveCracked.sfx.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Users\Admin\AppData\Roaming\WaveCracked.exe
    "C:\Users\Admin\AppData\Roaming\WaveCracked.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\Users\Admin\AppData\Roaming\WaveCracked.exe
      "C:\Users\Admin\AppData\Roaming\WaveCracked.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2768
- C:\Users\Admin\AppData\Roaming\WaveWindows.exe
  "C:\Users\Admin\AppData\Roaming\WaveWindows.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI25442\api-ms-win-core-timezone-l1-1-0.dll

Filesize
21KB

MD5
d12403ee11359259ba2b0706e5e5111c

SHA1
03cc7827a30fd1dee38665c0cc993b4b533ac138

SHA256
f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781

SHA512
9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25442\python39.dll

Filesize
4.3MB

MD5
5cd203d356a77646856341a0c9135fc6

SHA1
a1f4ac5cc2f5ecb075b3d0129e620784814a48f7

SHA256
a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a

SHA512
390008d57fa711d7c88b77937bf16fdb230e7c1e7182faea6d7c206e9f65ced6f2e835f9da9befb941e80624abe45875602e0e7ad485d9a009d2450a2a0e0f1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25442\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
C:\Users\Admin\AppData\Roaming\WaveCracked.exe

Filesize
9.7MB

MD5
278d465a1bd6823e6b02dbb3f25baf22

SHA1
0f62cb7d75807c23776ed216413d09b245d366b8

SHA256
e8242bd7994fd06785413174d1e954423f107d6db09ded573e31cdec144bba48

SHA512
81ed3391c716874eec0b734755bfb9674b93bfd8fe7e47829eaa0936771d6162712f9c8ac12adcb00e340516e8b9e3c95f22e7fc7d7dec43fb696a5c37ab2965

Download Submit
C:\Users\Admin\AppData\Roaming\WaveWindows.exe

Filesize
8.0MB

MD5
b8631bbd78d3935042e47b672c19ccc3

SHA1
cd0ea137f1544a31d2a62aaed157486dce3ecebe

SHA256
9cfda541d595dc20a55df5422001dfb58debd401df3abff21b1eee8ede28451c

SHA512
0c51d6247e39f7851538a5916b24972e845abfe429f0abdc7b532f654b4afe73dc6e1936f1b062da63bfc90273d3cbc297bf6c802e615f3711d0f180c070aa26

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI25442\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
1c58526d681efe507deb8f1935c75487

SHA1
0e6d328faf3563f2aae029bc5f2272fb7a742672

SHA256
ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2

SHA512
8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI25442\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI25442\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
724223109e49cb01d61d63a8be926b8f

SHA1
072a4d01e01dbbab7281d9bd3add76f9a3c8b23b

SHA256
4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210

SHA512
19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI25442\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
21KB

MD5
517eb9e2cb671ae49f99173d7f7ce43f

SHA1
4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab

SHA256
57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54

SHA512
492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

Download Submit
\Users\Admin\AppData\Roaming\WaveCracked.sfx.exe

Filesize
9.9MB

MD5
e65724047425fbd5de9cc76e1668bb9e

SHA1
8e1993e0dc0d83f69ecc6ab01423903f36b19d19

SHA256
63c76bd301842683e294134744574b1ab1aadfcca63cadbb30c9a25eac0fc0ad

SHA512
fc91bba8b1ef5f3e679b0bcab34df8601c22e6fa44bfd294205551bfa3df6de4c699e5fef9abd4b941c4fbee1b3502b911e21f0204cd0ffa588b615ac1a65098

Download Submit
memory/2148-115-0x00000000054E0000-0x0000000005580000-memory.dmp

Filesize
640KB

Download
memory/2148-120-0x00000000005A0000-0x00000000005AA000-memory.dmp

Filesize
40KB

Download
memory/2148-23-0x00000000009D0000-0x00000000011D2000-memory.dmp

Filesize
8.0MB

Download
memory/2148-114-0x0000000005430000-0x00000000054E2000-memory.dmp

Filesize
712KB

Download
memory/2148-20-0x000000007406E000-0x000000007406F000-memory.dmp

Filesize
4KB

Download
memory/2148-116-0x0000000000460000-0x0000000000468000-memory.dmp

Filesize
32KB

Download
memory/2148-117-0x00000000004C0000-0x00000000004C8000-memory.dmp

Filesize
32KB

Download
memory/2148-119-0x0000000000550000-0x000000000055A000-memory.dmp

Filesize
40KB

Download
memory/2148-118-0x0000000000550000-0x000000000055A000-memory.dmp

Filesize
40KB

Download
memory/2148-100-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2148-121-0x0000000005FC0000-0x0000000006036000-memory.dmp

Filesize
472KB

Download
memory/2148-122-0x0000000000820000-0x000000000082A000-memory.dmp

Filesize
40KB

Download
memory/2148-123-0x0000000005F20000-0x0000000005F52000-memory.dmp

Filesize
200KB

Download
memory/2148-125-0x0000000002780000-0x0000000002788000-memory.dmp

Filesize
32KB

Download
memory/2148-124-0x0000000005F50000-0x0000000005F76000-memory.dmp

Filesize
152KB

Download
memory/2148-127-0x00000000055C0000-0x00000000055D6000-memory.dmp

Filesize
88KB

Download
memory/2148-128-0x0000000005680000-0x000000000568A000-memory.dmp

Filesize
40KB

Download
memory/2148-190-0x000000007406E000-0x000000007406F000-memory.dmp

Filesize
4KB

Download
memory/2148-191-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2148-192-0x0000000000550000-0x000000000055A000-memory.dmp

Filesize
40KB

Download