Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
23/07/2024, 17:13
General
-
Target
WaveWindows.exe
-
Size
33.0MB
-
MD5
b6b21c49c19c5a1bf0596feafa70489c
-
SHA1
2c7b3d37622aad66d624ad3befc6bb752385c06c
-
SHA256
c0b7b00bfcd71d9f4c9b563c13380a71e82d531fe10593d8d97a1041a4c1afe1
-
SHA512
b78e560b53a73d6aa06635ad5a7b713c9b1f2f6190883fd1b22d4d560f4b3ed78af66b9e19229881ce7d975c635df225c2d9263210270c8d097d41ce91eab6a9
-
SSDEEP
393216:XQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mgj96l+ZArYsFRlqB1:X3on1HvSzxAMNjFZArYscRiXe
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 26 IoCs
-
Suspicious use of SendNotifyMessage 25 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WaveWindows.exe"C:\Users\Admin\AppData\Local\Temp\WaveWindows.exe"1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB