rhadamanthys | hxxps://executorwave[.]ru/

Analysis

max time kernel
124s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://executorwave.ru/

Score

10^/10

rhadamanthys discovery execution stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

BitLockerToGo.exe

description	pid	Process	procid_target
PID 1800 created 2940	1800	BitLockerToGo.exe	50

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
404	powershell.exe
468	powershell.exe
404	powershell.exe
468	powershell.exe

Executes dropped EXE 1 IoCs

Processes:

driver1.exe

pid	Process
3576	driver1.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

WaveInstaller.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	WaveInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	WaveInstaller.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

Processes:

tasklist.exe

pid	Process
4828	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

driver1.exe

description	pid	Process	procid_target
PID 3576 set thread context of 1800	3576	driver1.exe	115

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
692	1800	WerFault.exe	115
3656	1800	WerFault.exe	115

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

BitLockerToGo.exeopenwith.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exefirefox.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

Processes:

wmic.exe

pid	Process
2556	wmic.exe

GoLang User-Agent 3 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description	flow	ioc
HTTP User-Agent header	148	Go-http-client/1.1
HTTP User-Agent header	149	Go-http-client/1.1
HTTP User-Agent header	150	Go-http-client/1.1

Modifies registry class 1 IoCs

Processes:

firefox.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

Processes:

firefox.exe

description	ioc	Process
File created	C:\Users\Admin\Downloads\WaveInstaller.zip:Zone.Identifier	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exe

pid	Process
3584	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

powershell.exepowershell.exeBitLockerToGo.exeopenwith.exe

pid	Process
404	powershell.exe
404	powershell.exe
468	powershell.exe
468	powershell.exe
1800	BitLockerToGo.exe
1800	BitLockerToGo.exe
2844	openwith.exe
2844	openwith.exe
2844	openwith.exe
2844	openwith.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

firefox.exeWaveInstaller.exewmic.exetasklist.exepowershell.exepowershell.exewmic.exe

description	pid	Process
Token: SeDebugPrivilege	1700	firefox.exe
Token: SeDebugPrivilege	1700	firefox.exe
Token: SeDebugPrivilege	1700	firefox.exe
Token: SeDebugPrivilege	3884	WaveInstaller.exe
Token: SeIncreaseQuotaPrivilege	2556	wmic.exe
Token: SeSecurityPrivilege	2556	wmic.exe
Token: SeTakeOwnershipPrivilege	2556	wmic.exe
Token: SeLoadDriverPrivilege	2556	wmic.exe
Token: SeSystemProfilePrivilege	2556	wmic.exe
Token: SeSystemtimePrivilege	2556	wmic.exe
Token: SeProfSingleProcessPrivilege	2556	wmic.exe
Token: SeIncBasePriorityPrivilege	2556	wmic.exe
Token: SeCreatePagefilePrivilege	2556	wmic.exe
Token: SeBackupPrivilege	2556	wmic.exe
Token: SeRestorePrivilege	2556	wmic.exe
Token: SeShutdownPrivilege	2556	wmic.exe
Token: SeDebugPrivilege	2556	wmic.exe
Token: SeSystemEnvironmentPrivilege	2556	wmic.exe
Token: SeRemoteShutdownPrivilege	2556	wmic.exe
Token: SeUndockPrivilege	2556	wmic.exe
Token: SeManageVolumePrivilege	2556	wmic.exe
Token: 33	2556	wmic.exe
Token: 34	2556	wmic.exe
Token: 35	2556	wmic.exe
Token: 36	2556	wmic.exe
Token: SeIncreaseQuotaPrivilege	2556	wmic.exe
Token: SeSecurityPrivilege	2556	wmic.exe
Token: SeTakeOwnershipPrivilege	2556	wmic.exe
Token: SeLoadDriverPrivilege	2556	wmic.exe
Token: SeSystemProfilePrivilege	2556	wmic.exe
Token: SeSystemtimePrivilege	2556	wmic.exe
Token: SeProfSingleProcessPrivilege	2556	wmic.exe
Token: SeIncBasePriorityPrivilege	2556	wmic.exe
Token: SeCreatePagefilePrivilege	2556	wmic.exe
Token: SeBackupPrivilege	2556	wmic.exe
Token: SeRestorePrivilege	2556	wmic.exe
Token: SeShutdownPrivilege	2556	wmic.exe
Token: SeDebugPrivilege	2556	wmic.exe
Token: SeSystemEnvironmentPrivilege	2556	wmic.exe
Token: SeRemoteShutdownPrivilege	2556	wmic.exe
Token: SeUndockPrivilege	2556	wmic.exe
Token: SeManageVolumePrivilege	2556	wmic.exe
Token: 33	2556	wmic.exe
Token: 34	2556	wmic.exe
Token: 35	2556	wmic.exe
Token: 36	2556	wmic.exe
Token: SeDebugPrivilege	4828	tasklist.exe
Token: SeDebugPrivilege	404	powershell.exe
Token: SeDebugPrivilege	468	powershell.exe
Token: SeIncreaseQuotaPrivilege	3916	wmic.exe
Token: SeSecurityPrivilege	3916	wmic.exe
Token: SeTakeOwnershipPrivilege	3916	wmic.exe
Token: SeLoadDriverPrivilege	3916	wmic.exe
Token: SeSystemProfilePrivilege	3916	wmic.exe
Token: SeSystemtimePrivilege	3916	wmic.exe
Token: SeProfSingleProcessPrivilege	3916	wmic.exe
Token: SeIncBasePriorityPrivilege	3916	wmic.exe
Token: SeCreatePagefilePrivilege	3916	wmic.exe
Token: SeBackupPrivilege	3916	wmic.exe
Token: SeRestorePrivilege	3916	wmic.exe
Token: SeShutdownPrivilege	3916	wmic.exe
Token: SeDebugPrivilege	3916	wmic.exe
Token: SeSystemEnvironmentPrivilege	3916	wmic.exe
Token: SeRemoteShutdownPrivilege	3916	wmic.exe

Suspicious use of FindShellTrayWindow 21 IoCs

Processes:

firefox.exe

pid	Process
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

firefox.exe

pid	Process
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

firefox.exe

pid	Process
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	Process	procid_target
PID 2520 wrote to memory of 1700	2520	firefox.exe	83
PID 2520 wrote to memory of 1700	2520	firefox.exe	83
PID 2520 wrote to memory of 1700	2520	firefox.exe	83
PID 2520 wrote to memory of 1700	2520	firefox.exe	83
PID 2520 wrote to memory of 1700	2520	firefox.exe	83
PID 2520 wrote to memory of 1700	2520	firefox.exe	83
PID 2520 wrote to memory of 1700	2520	firefox.exe	83
PID 2520 wrote to memory of 1700	2520	firefox.exe	83
PID 2520 wrote to memory of 1700	2520	firefox.exe	83
PID 2520 wrote to memory of 1700	2520	firefox.exe	83
PID 2520 wrote to memory of 1700	2520	firefox.exe	83
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 4256	1700	firefox.exe	85
PID 1700 wrote to memory of 5112	1700	firefox.exe	86
PID 1700 wrote to memory of 5112	1700	firefox.exe	86
PID 1700 wrote to memory of 5112	1700	firefox.exe	86
PID 1700 wrote to memory of 5112	1700	firefox.exe	86
PID 1700 wrote to memory of 5112	1700	firefox.exe	86
PID 1700 wrote to memory of 5112	1700	firefox.exe	86
PID 1700 wrote to memory of 5112	1700	firefox.exe	86
PID 1700 wrote to memory of 5112	1700	firefox.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2940
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2844

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://executorwave.ru/"
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://executorwave.ru/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2020 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1892 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8931d21-0961-4886-b9ee-ce96ef57d06b} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" gpu
    3⤵
    PID:4256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2460 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5596a059-8b3c-4ebb-83b0-7384becd792a} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" socket
    3⤵
    - Checks processor information in registry
    PID:5112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2972 -childID 1 -isForBrowser -prefsHandle 2988 -prefMapHandle 2984 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e410540e-6c58-4859-9423-a782f8128984} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" tab
    3⤵
    PID:2888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3884 -childID 2 -isForBrowser -prefsHandle 3876 -prefMapHandle 3872 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9fb53bdc-c470-49eb-9487-26d918a38521} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" tab
    3⤵
    PID:2324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4656 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4664 -prefMapHandle 4600 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f924e9f8-e76a-48d2-bf92-3b77c71b9f26} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" utility
    3⤵
    - Checks processor information in registry
    PID:4552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5188 -childID 3 -isForBrowser -prefsHandle 5388 -prefMapHandle 5208 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f868c053-09e5-4f29-9130-f06b844e2f4b} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" tab
    3⤵
    PID:1328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5500 -childID 4 -isForBrowser -prefsHandle 5188 -prefMapHandle 5536 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cdd44174-e485-47f0-9e99-5891ffd583ad} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" tab
    3⤵
    PID:3640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5704 -childID 5 -isForBrowser -prefsHandle 5760 -prefMapHandle 5768 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d05d493-8fed-49c4-ad72-6210b95ac394} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" tab
    3⤵
    PID:3984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5812 -childID 6 -isForBrowser -prefsHandle 5820 -prefMapHandle 5764 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1208 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a3049dc-39d9-49d5-82b1-4d6a87e4a31f} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" tab
    3⤵
    PID:4128

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4952

C:\Users\Admin\Desktop\WaveInstaller.exe
"C:\Users\Admin\Desktop\WaveInstaller.exe"
1⤵
- Maps connected drives based on registry
- Suspicious use of AdjustPrivilegeToken
PID:3884
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  - Suspicious use of AdjustPrivilegeToken
  PID:2556
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\";" powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Desktop\WaveInstaller.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users\Admin\Desktop\WaveInstaller.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:468
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3916
- C:\ProgramData\driver1.exe
  C:\ProgramData\driver1.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3576
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1800
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 476
      4⤵
      Program crash
      PID:692
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 472
      4⤵
      Program crash
      PID:3656
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WinDriver /tr C:\ProgramData\Microsoft\WinDriver.exe /sc onstart /ru SYSTEM
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3584

C:\Users\Admin\Desktop\WaveInstaller.exe
"C:\Users\Admin\Desktop\WaveInstaller.exe"
1⤵
PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1800 -ip 1800
1⤵
PID:3452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1800 -ip 1800
1⤵
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\driver1.exe

Filesize
7.3MB

MD5
69c08e5d078bd287b3cb43b7c35bc831

SHA1
307b8de9da4d24d474e44beaf4f32c15b258b0f6

SHA256
ce3b888419f9e46029d630e56e15e64eb28b9f92652a1acf477a87a5aebe3f48

SHA512
1bf71b7fc5e991dda21f6ed1c62895d5ba161b01677cba0901568df0a4bf3d6419cc3c04e83007566ee21de2cd66230af37de40b5ff61701ac4ad820a7b73152

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\activity-stream.discovery_stream.json.tmp

Filesize
18KB

MD5
2fde0706cadeb92dd502f1dacd64016f

SHA1
3c418cca9fb4f1bdef28b0e992e97066d0774101

SHA256
cdbb8f486f078f621cd25c0020e4eea093908266e6452de46d2fe1b19df8705d

SHA512
4540505157b60532980d30d73fd7c529ded3f35afb95211be3b274f8e30f8a432b333ff0b0821e5a0c33552cac592c82a6e733fd18f2bd1bee9ef326d3a9aa44

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kgnpm32s.o2y.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

Filesize
7KB

MD5
2d2893a4cac241afaa3564a355ed8ffc

SHA1
63cfda69d9d5bfb4adf9c33f211bff5568329bac

SHA256
eafef4c8da1e0dc0277e8e0c7d835852fe87fbd73ec4f8933094b0f7677c2da0

SHA512
c1ccfac2da19477a118ecf96b10c4be59f9f5a2c4da6bdfe45cead845a2f3f018f3d06e1c7e53def7cd5a7a89c54f37ab08ae3412b5202a2165e24ca5d4e2437

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

Filesize
10KB

MD5
d57be7eeee2da51b5c42983d6be590bd

SHA1
55ee6e2166c09647141a7e86e139431fa7a0dbb7

SHA256
4b0844ca52e77f4d07e5fc144a38e8bd0a99a76e089e0025b991212195f8e441

SHA512
921c5dfd77340e814adcd5918fc3d7eebaa3f44434f9d43e8216f0cce424e0482b3bd82d1ee4fe99cfef4dad90ebb3f43a6c9716832e375d683ccbf87ced233a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
965abec5e0ebe3ddc0a96286e84dc469

SHA1
1f294aee1add183a26c6533dc1683dcd04a06485

SHA256
c97296aeec71b556f3721f5ea8971035606ab2ae587ae47aed1949074a275bee

SHA512
b62c4afc038400817062203845bd508492aa906b143b6a6a3fc607e141ea880542f44d0a61531e1386771119a8402ef5b8f5815982638015b0bf566985caa23d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
79bd09657eca60e5c6debf5a20926025

SHA1
537e443438e377d996bb63c1be874be10f8da32d

SHA256
487f0336c7ff6d5f95641f42a69ef9ac9e4198f99bc6703dc9b02aea2ea71855

SHA512
5b7522f26dbaa1b10c8f44626ea392e3521ad0c4d5669ce2bc2ec3ab7407d29288d821420ddb2b3c730ae702f5755bb051b742d82519b626a030bc85eb4182f8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
02073ca76f19b34a443bb63482c69f45

SHA1
13b58f73266430199218bce713e11757bb03a588

SHA256
6350d85b7dd9ee00dec82243a0a0d8b4d69b9c337a0f8297a9b0c52b0fce74b3

SHA512
12a38d0e90e6d915fbb4da933cc7ca643ded9071e1dfb8d84f3f45677329928258dca09ee248359ceb06a6c9c5a5b99ab50fe7710826e0e4f2144855128eccea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
34KB

MD5
2f0fe81678e6b1dc33e5b7b38291856a

SHA1
488ae2610e230c9cceca7700e76b4ace18854db8

SHA256
f8c83485dae4dfaf07c7006674bbc8d35c999542ad6af840e2851119318abc72

SHA512
d9e1bef0ddc6b1665c8565f8e5d87fb8f7929c4c6289445e299ed98c94d48ed4b81306b4a72c19bde01695f0cee647230b1afe47a07df97bc87fc9531483e3e3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
762ae839bca970bf25e3466c4be6049e

SHA1
7b1c5987defcd12aa96af528b8b145025e18b714

SHA256
4c0ca76acb0b9a6de60d159cab6996e9692c8ea6c4960fd9964b56a76e092cd0

SHA512
a7c3042bbc1c61654d8b096189d107835c1750f56d4db9e46a0a9d9a656c8dc9950e39ce5093a13e71316b024c006540b858d261d0adeaddf350286f3ff62201

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\00a250ab-196f-451d-b5fe-eac7d8233c02

Filesize
982B

MD5
9ae9686b0a55c75eb0f5a0161f7fe664

SHA1
b7986076b431dba0030160b85b224fb08ce2aabc

SHA256
937816d5a23ad76918d63cd758fd2679643af8935dc2f604c51cc95949555af0

SHA512
cff7a8d41684acebf14529d3370db3adcfa69b502b60ed038cad00ebeab9c41a3ed447beed2ed712536857b1b5426ba122531ca6f3d2a2ebba0d90e9bd3275b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\4cef7fb4-3bbe-445c-b0da-b42d1bed259e

Filesize
654B

MD5
b39fbfc3b146e9e031bac7227c004d06

SHA1
800296b3de71eac30c09db2d13af8bdc1449412f

SHA256
1c8422b88c20be2ad43f89a59ae9ec645544d4b02e451da8976c32ff845fd8be

SHA512
e34aa6b5627758d83b5217d1d63e62255c5cfeb4b1ccae0da11c9356233eec4af0479f2291a20c02cda85f5852ff412911709cca84f052233ea587fc66cf912e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\aeece4b4-b919-46e9-a989-ec754fc5a8c8

Filesize
26KB

MD5
33fffa4e5c9c55334e28be6f25a39f1d

SHA1
2662def60984f1984be9bd37eea097b3553c9c47

SHA256
770629cf34fc660223f2c0fa3389d2a6f9b2d140a1c0c43fbc7aa8f013794d97

SHA512
c0f52db2050973bf6ae32fc74bcccf613f69ffd12641b6d8d8b4f4416027f02d805b580dc1941f2cdd448d3e709913d528bfa54b42d3dcd01ea8ff2a811a66c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\e4d14f52-338c-4504-a108-a0a4cb89305a

Filesize
671B

MD5
de9c29c0679113eba3997babae543ead

SHA1
7ec3f6bf7e63363272b09e7ae452b64f5195efba

SHA256
74d9d99f1450eeeafc5d5d9f40119b02a2cdb5e4051edf75599adcc7fb57b6e0

SHA512
a739fbf61fad3f49ad0509c8a7843eaac2f980dc02b5e5eea3b7580c98b3763b04799352f2385b6e904b7a09cb1171b82ead368a785e19149bab35e5a28fed3e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

Filesize
11KB

MD5
04deeb0e60c9abbb9225e3ed10eb0b13

SHA1
cfc94c0e8cb2a051c82149b4ab671117552b8ac2

SHA256
6d94ae8457e77d90b6cd0cc4ebe6d8f48ec30714e0f26dfd804f637706cdf731

SHA512
ffd6cf8386809da29fd298b5929e591d628c33aea1d1d3ba0db643027f9b4033cf21116809adcd554d766b734de5f9c46a05123ce480abe2f208a8d0cc3431a3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs.js

Filesize
11KB

MD5
c3940a952c291731174d637eb38f0b1e

SHA1
81e6a9e625b8a37129ff3d8eb5ea6efdad39ad21

SHA256
b2275a55ec37be7e426a6371cc00b000d6c230fef7b7e36b674a66865b1582e9

SHA512
b957d195962768b6a125e9a184398e3d6aa4558ae5933ec2988b4996efe9b15c689858623a4edc140bdff15d7e6747c92abf73bb3137b45e1717b6888b9d860d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
3ab8dcad42970cae77124f4ca2afb483

SHA1
6daac91e6b778a4b72c69eab3e57be1402f5dcdf

SHA256
e436daee5c5630722ad64f0b169a3078a46aff3c47f2c3d72ea51dbc1f6c1156

SHA512
80adb210dc3d750646a1b9d486fd5058bed8d5cece7b9b77c0a2a0a1b4277ceddd6bce4a9af3ecbdae4b7ec84be1ffb9e2f2a2a01d5c58f757689a47a0ebd0b0

Download Submit
C:\Users\Admin\Downloads\WaveInstaller.et4B338V.zip.part

Filesize
25.7MB

MD5
4f5c34e4b497ab5ed1cb659b2eae332f

SHA1
6e978c22737fab395df5cdb91abbfb9e2fbb0564

SHA256
8624feb22b3a92ec567c5c192ff802e55f2cbd3388c78642bfffde6ac2a9ddc6

SHA512
7f571348f54aefad566eb6c714560cb005de6dd17bd4319d1b32a6035a92b7df196a98510f750129c1ec29fda2621be4e46a71c3d783c971acab39b0c8ece88c

Download Submit
memory/404-586-0x000002946C1D0000-0x000002946C1F2000-memory.dmp

Filesize
136KB

Download
memory/1800-620-0x00000000037B0000-0x0000000003BB0000-memory.dmp

Filesize
4.0MB

Download
memory/1800-617-0x0000000000870000-0x00000000008EE000-memory.dmp

Filesize
504KB

Download
memory/1800-619-0x0000000000870000-0x00000000008EE000-memory.dmp

Filesize
504KB

Download
memory/1800-621-0x00000000037B0000-0x0000000003BB0000-memory.dmp

Filesize
4.0MB

Download
memory/1800-622-0x00007FF8FAFD0000-0x00007FF8FB1C5000-memory.dmp

Filesize
2.0MB

Download
memory/1800-624-0x0000000076CF0000-0x0000000076F05000-memory.dmp

Filesize
2.1MB

Download
memory/2844-625-0x0000000000250000-0x0000000000259000-memory.dmp

Filesize
36KB

Download
memory/2844-627-0x0000000002120000-0x0000000002520000-memory.dmp

Filesize
4.0MB

Download
memory/2844-628-0x00007FF8FAFD0000-0x00007FF8FB1C5000-memory.dmp

Filesize
2.0MB

Download
memory/2844-630-0x0000000076CF0000-0x0000000076F05000-memory.dmp

Filesize
2.1MB

Download
memory/3576-618-0x00007FF746030000-0x00007FF7467E2000-memory.dmp

Filesize
7.7MB

Download
memory/3576-616-0x00007FF746030000-0x00007FF7467E2000-memory.dmp

Filesize
7.7MB

Download