Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
8Wave/CefSh...re.dll
windows7-x64
3Wave/CefSh...re.dll
windows10-2004-x64
3Wave/CefSh...ss.exe
windows7-x64
3Wave/CefSh...ss.exe
windows10-2004-x64
3Wave/CefSh...me.dll
windows7-x64
3Wave/CefSh...me.dll
windows10-2004-x64
3Wave/CefSh...re.dll
windows7-x64
1Wave/CefSh...re.dll
windows10-2004-x64
1Wave/CefSharp.Wpf.dll
windows7-x64
1Wave/CefSharp.Wpf.dll
windows10-2004-x64
1Wave/CefSharp.dll
windows7-x64
1Wave/CefSharp.dll
windows10-2004-x64
1Wave/WaveB...er.exe
windows7-x64
3Wave/WaveB...er.exe
windows10-2004-x64
3Wave/WaveI...er.exe
windows7-x64
7Wave/WaveI...er.exe
windows10-2004-x64
7Wave/bin/lz4.dll
windows7-x64
1Wave/bin/lz4.dll
windows10-2004-x64
1Wave/bin/wolfssl.dll
windows7-x64
1Wave/bin/wolfssl.dll
windows10-2004-x64
1Wave/bin/xxhash.dll
windows7-x64
1Wave/bin/xxhash.dll
windows10-2004-x64
1Wave/bin/zlib1.dll
windows7-x64
1Wave/bin/zlib1.dll
windows10-2004-x64
1Wave/bin/zstd.dll
windows7-x64
1Wave/bin/zstd.dll
windows10-2004-x64
1Wave/chrome_elf.dll
windows10-2004-x64
3Wave/d3dco...47.dll
windows10-2004-x64
3Wave/libEGL.dll
windows10-2004-x64
3Wave/libGLESv2.dll
windows10-2004-x64
3Wave/libcef.dll
windows10-2004-x64
3Wave/vk_sw...er.dll
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/08/2024, 11:36
Behavioral task
behavioral1
Sample
Wave/CefSharp.BrowserSubprocess.Core.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Wave/CefSharp.BrowserSubprocess.Core.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Wave/CefSharp.BrowserSubprocess.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
Wave/CefSharp.BrowserSubprocess.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Wave/CefSharp.Core.Runtime.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Wave/CefSharp.Core.Runtime.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Wave/CefSharp.Core.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Wave/CefSharp.Core.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Wave/CefSharp.Wpf.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
Wave/CefSharp.Wpf.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Wave/CefSharp.dll
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
Wave/CefSharp.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Wave/WaveBootstrapper.exe
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
Wave/WaveBootstrapper.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Wave/WaveInstaller.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
Wave/WaveInstaller.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Wave/bin/lz4.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
Wave/bin/lz4.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Wave/bin/wolfssl.dll
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
Wave/bin/wolfssl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Wave/bin/xxhash.dll
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
Wave/bin/xxhash.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Wave/bin/zlib1.dll
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
Wave/bin/zlib1.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Wave/bin/zstd.dll
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
Wave/bin/zstd.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Wave/chrome_elf.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral28
Sample
Wave/d3dcompiler_47.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Wave/libEGL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral30
Sample
Wave/libGLESv2.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Wave/libcef.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral32
Sample
Wave/vk_swiftshader.dll
Resource
win10v2004-20240802-en
General
-
Target
Wave/WaveInstaller.exe
-
Size
45.1MB
-
MD5
c9b6db66a2e1e58cd82520f48b2ca5b4
-
SHA1
24903d528bcebbd46b8010efd0ea7092e2bc5f19
-
SHA256
174935fd8bb035fd568130c1808c61546f03b1835265c7b0945c245988439088
-
SHA512
321c94956372421e1d952a1887a3e3ac3700b29bce67fad5ed958acfccdfb84473fd5363a910fcbd0aa85b379643a8549a2369fa75d8db38af1f66ab553d401a
-
SSDEEP
786432:F9IB7vDUdbJ+KvIe6WCESWqE9XZ6/e+vPrT/XEznot:bIB7v4dvvIe6Mqi0rTio
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2956 WaveInstaller.exe -
resource yara_rule behavioral15/files/0x0003000000020a63-821.dat upx behavioral15/memory/2956-823-0x000007FEF53C0000-0x000007FEF5A85000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2956 2112 WaveInstaller.exe 31 PID 2112 wrote to memory of 2956 2112 WaveInstaller.exe 31 PID 2112 wrote to memory of 2956 2112 WaveInstaller.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wave\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\Wave\WaveInstaller.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\Wave\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\Wave\WaveInstaller.exe"2⤵
- Loads dropped DLL
PID:2956
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5ca67f0baf3cc3b7dbb545cda57ba3d81
SHA15b4e36aef877307af8a8f78f3054d068d1a9ce89
SHA256f804ed205e82003da6021ee6d2270733ca00992816e7e89ba13617c96dd0fba3
SHA512a9f07dd02714c3efba436326425d443969018ace7ebd7cc33c39d43e3d45480a4fcd4c46c09ad132b4f273888f13e9f598de257130429fcb2519c000e4fab6f7
-
C:\Users\Admin\AppData\Local\Temp\_MEI21122\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\INSTALLER
Filesize4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
-
Filesize
1023B
MD5141643e11c48898150daa83802dbc65f
SHA10445ed0f69910eeaee036f09a39a13c6e1f37e12
SHA25686da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
SHA512ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f
-
Filesize
92B
MD543136dde7dd276932f6197bb6d676ef4
SHA16b13c105452c519ea0b65ac1a975bd5e19c50122
SHA256189eedfe4581172c1b6a02b97a8f48a14c0b5baa3239e4ca990fbd8871553714
SHA512e7712ba7d36deb083ebcc3b641ad3e7d19fb071ee64ae3a35ad6a50ee882b20cd2e60ca1319199df12584fe311a6266ec74f96a3fb67e59f90c7b5909668aee1