General
-
Target
WaveInstaller (1).exe
-
Size
1.5MB
-
Sample
240822-ddjjxaydrq
-
MD5
c822ab5332b11c9185765b157d0b6e17
-
SHA1
7fe909d73a24ddd87171896079cceb8b03663ad4
-
SHA256
344700d3141170111a9b77db100f6961cc54a2988d964d34f7e1ca57aa42aa2a
-
SHA512
a8612836fb4714b939d03f7fe08391bbc635ca83ab853fc677159e5db6b00f76b9b586bdae9c19d2406d9a2713d1caf614132cb6c14e1dddc6ac45e47f7e5a5d
-
SSDEEP
24576:9viinbT3ipyqwPx4x3RyFoBkkAd04wJAAh/jV1gJcPNZI6fntX3HOt2pbs81ind2:EinbT3ipTD0anywJAaD/3U2pb7indT
Static task
static1
Behavioral task
behavioral1
Sample
WaveInstaller (1).exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
WaveInstaller (1).exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
WaveInstaller (1).exe
-
Size
1.5MB
-
MD5
c822ab5332b11c9185765b157d0b6e17
-
SHA1
7fe909d73a24ddd87171896079cceb8b03663ad4
-
SHA256
344700d3141170111a9b77db100f6961cc54a2988d964d34f7e1ca57aa42aa2a
-
SHA512
a8612836fb4714b939d03f7fe08391bbc635ca83ab853fc677159e5db6b00f76b9b586bdae9c19d2406d9a2713d1caf614132cb6c14e1dddc6ac45e47f7e5a5d
-
SSDEEP
24576:9viinbT3ipyqwPx4x3RyFoBkkAd04wJAAh/jV1gJcPNZI6fntX3HOt2pbs81ind2:EinbT3ipTD0anywJAaD/3U2pb7indT
Score8/10-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks for any installed AV software in registry
-
Legitimate hosting services abused for malware hosting/C2
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Event Triggered Execution
2Image File Execution Options Injection
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
2Image File Execution Options Injection
1Component Object Model Hijacking
1Discovery
Query Registry
3System Information Discovery
4Software Discovery
1Security Software Discovery
1Browser Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1