hxxps://cdn[.]getwave[.]gg/WaveWindows[.]exe

Analysis

max time kernel
136s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.getwave.gg/WaveWindows.exe

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	WaveWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	WaveWindows.exe

Executes dropped EXE 9 IoCs

pid	Process
1372	WaveWindows.exe
5132	WaveWindows.exe
4564	WaveWindows.exe
6012	WaveWindows.exe
6044	WaveWindows.exe
5472	WaveWindows.exe
5704	node.exe
3208	WaveWindows.exe
5248	node.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
67	raw.githubusercontent.com
55	raw.githubusercontent.com
57	raw.githubusercontent.com
58	raw.githubusercontent.com
59	raw.githubusercontent.com
61	raw.githubusercontent.com
66	raw.githubusercontent.com
56	raw.githubusercontent.com
60	raw.githubusercontent.com
63	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
5476	1372	WerFault.exe	112
5468	5132	WerFault.exe	115
5496	4564	WerFault.exe	114
5148	6012	WerFault.exe	127
5300	6044	WerFault.exe	128

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveWindows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveWindows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveWindows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveWindows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveWindows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveWindows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveWindows.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 314718.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
1208	msedge.exe
1208	msedge.exe
1084	identity_helper.exe
1084	identity_helper.exe
4488	msedge.exe
4488	msedge.exe
5132	WaveWindows.exe
5132	WaveWindows.exe
1372	WaveWindows.exe
1372	WaveWindows.exe
4564	WaveWindows.exe
4564	WaveWindows.exe
6012	WaveWindows.exe
6012	WaveWindows.exe
6044	WaveWindows.exe
6044	WaveWindows.exe
5472	WaveWindows.exe
5472	WaveWindows.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
3208	WaveWindows.exe
3208	WaveWindows.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4564	WaveWindows.exe
Token: SeDebugPrivilege	5132	WaveWindows.exe
Token: SeDebugPrivilege	1372	WaveWindows.exe
Token: SeDebugPrivilege	6012	WaveWindows.exe
Token: SeDebugPrivilege	6044	WaveWindows.exe
Token: SeDebugPrivilege	5472	WaveWindows.exe
Token: SeDebugPrivilege	3208	WaveWindows.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
5472	WaveWindows.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5704	node.exe
5248	node.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 4204	1208	msedge.exe	84
PID 1208 wrote to memory of 4204	1208	msedge.exe	84
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 4632	1208	msedge.exe	86
PID 1208 wrote to memory of 5020	1208	msedge.exe	87
PID 1208 wrote to memory of 5020	1208	msedge.exe	87
PID 1208 wrote to memory of 3916	1208	msedge.exe	88
PID 1208 wrote to memory of 3916	1208	msedge.exe	88
PID 1208 wrote to memory of 3916	1208	msedge.exe	88
PID 1208 wrote to memory of 3916	1208	msedge.exe	88
PID 1208 wrote to memory of 3916	1208	msedge.exe	88
PID 1208 wrote to memory of 3916	1208	msedge.exe	88
PID 1208 wrote to memory of 3916	1208	msedge.exe	88
PID 1208 wrote to memory of 3916	1208	msedge.exe	88
PID 1208 wrote to memory of 3916	1208	msedge.exe	88
PID 1208 wrote to memory of 3916	1208	msedge.exe	88
PID 1208 wrote to memory of 3916	1208	msedge.exe	88
PID 1208 wrote to memory of 3916	1208	msedge.exe	88
PID 1208 wrote to memory of 3916	1208	msedge.exe	88
PID 1208 wrote to memory of 3916	1208	msedge.exe	88
PID 1208 wrote to memory of 3916	1208	msedge.exe	88
PID 1208 wrote to memory of 3916	1208	msedge.exe	88
PID 1208 wrote to memory of 3916	1208	msedge.exe	88
PID 1208 wrote to memory of 3916	1208	msedge.exe	88
PID 1208 wrote to memory of 3916	1208	msedge.exe	88
PID 1208 wrote to memory of 3916	1208	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.getwave.gg/WaveWindows.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1fdd46f8,0x7ffa1fdd4708,0x7ffa1fdd4718
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,9183578080094993952,615741003066703027,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,9183578080094993952,615741003066703027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,9183578080094993952,615741003066703027,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,9183578080094993952,615741003066703027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,9183578080094993952,615741003066703027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,9183578080094993952,615741003066703027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,9183578080094993952,615741003066703027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2204,9183578080094993952,615741003066703027,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,9183578080094993952,615741003066703027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2204,9183578080094993952,615741003066703027,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2204,9183578080094993952,615741003066703027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- C:\Users\Admin\Downloads\WaveWindows.exe
  "C:\Users\Admin\Downloads\WaveWindows.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 1400
    3⤵
    - Program crash
    PID:5476
- C:\Users\Admin\Downloads\WaveWindows.exe
  "C:\Users\Admin\Downloads\WaveWindows.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 1416
    3⤵
    - Program crash
    PID:5496
- C:\Users\Admin\Downloads\WaveWindows.exe
  "C:\Users\Admin\Downloads\WaveWindows.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 1448
    3⤵
    - Program crash
    PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,9183578080094993952,615741003066703027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,9183578080094993952,615741003066703027,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,9183578080094993952,615741003066703027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,9183578080094993952,615741003066703027,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:5772
- C:\Users\Admin\Downloads\WaveWindows.exe
  "C:\Users\Admin\Downloads\WaveWindows.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6012 -s 1420
    3⤵
    - Program crash
    PID:5148
- C:\Users\Admin\Downloads\WaveWindows.exe
  "C:\Users\Admin\Downloads\WaveWindows.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 1436
    3⤵
    - Program crash
    PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,9183578080094993952,615741003066703027,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4564 -ip 4564
1⤵
PID:5396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5132 -ip 5132
1⤵
PID:5404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1372 -ip 1372
1⤵
PID:5416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 6012 -ip 6012
1⤵
PID:6128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 6044 -ip 6044
1⤵
PID:5204

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5404

C:\Users\Admin\Downloads\WaveWindows.exe
"C:\Users\Admin\Downloads\WaveWindows.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5472
- C:\Users\Admin\AppData\Local\Luau Language Server\node.exe
  "C:\Users\Admin\AppData\Local\Luau Language Server\node.exe" server --process-id=5472
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5704

C:\Users\Admin\Downloads\WaveWindows.exe
"C:\Users\Admin\Downloads\WaveWindows.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3208
- C:\Users\Admin\AppData\Local\Luau Language Server\node.exe
  "C:\Users\Admin\AppData\Local\Luau Language Server\node.exe" server --process-id=3208
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Luau Language Server\server\index.js

Filesize
6.1MB

MD5
6b1cad741d0b6374435f7e1faa93b5e7

SHA1
7b1957e63c10f4422421245e4dc64074455fd62a

SHA256
6f17add2a8c8c2d9f592adb65d88e08558e25c15cedd82e3f013c8146b5d840f

SHA512
a662fc83536eff797b8d59e2fb4a2fb7cd903be8fc4137de8470b341312534326383bb3af58991628f15f93e3bdd57621622d9d9b634fb5e6e03d4aa06977253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WaveWindows.exe.log

Filesize
2KB

MD5
a5b3d35b3c23bea3393359fd36b98b2b

SHA1
cd65eaa4ebe27cf13c4e0a846ed55f9b17984e37

SHA256
383cda5bb12f226992414a8c35c534a5c0de61a065e8fc391b5d454182d19c9c

SHA512
1b864db981b6e427929d6bd0b157b19e8f64d1ae032a85b6e2043087f9f65571f8bcf0488f0b91157c7cfabcc98b9a84d2b7d85cbf83cdb37f969a9c7f1e54fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\371a18a8-a928-4265-9d5c-df0a2abb992d.tmp

Filesize
6KB

MD5
ddc3469941823bb5eaafe2c76c21e338

SHA1
e47c57ca7a78fd94b040da5789ff4b95599114cc

SHA256
f93271899c605ef373be985997506fef17f7bc4e68fd952be35bf67609cedf3d

SHA512
44351db1349c5cc46be716723eed3f96aa9ed12b04e7e1d242bc9ec17f6846133ef057c52957ca5e02acbecd974f6e928a0115020b409a7b0d6fc503defb6768

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
472B

MD5
6d501acb040966929d8c0d21c6503ac1

SHA1
1af5afd1c29e83bcb94d48217ee64325900761ab

SHA256
e416613bf039f2bcf841622fcbd1468057945da392e5c50778ea67a4c4feed87

SHA512
883b54b908a2874d10fb55d953f662031b5b52ca9345ddc49037eefa7eb6ed85dc1cb7e073fb75362e26e6a13a15dc69482646b1848ae6d761468b9ee0cff804

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c20d5ec44d8c1161f1327362d68c0bca

SHA1
60f7e691c92a04ca1a5da89da7b7d5f2b0bc3bc5

SHA256
c06189ae7d67112636930b8ee394c7eea7fc7f7f0774ca01bc19c67e15ea9ea6

SHA512
0890cebfa4a0bd994959082fec3d70c59822217ebb879128f19ddba02b82a14b65d10f36fe68935ff9b58ea9d050945cefcfb638aa3efa5d008896f0ea53ffae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a12dce2c68ce95094537eb7d1fa00eab

SHA1
4bf1e960c88a5992291f3492d102f14043d97809

SHA256
d98992ff77b5b17c44eef312a9871a17f86d15608844a317a53b7b37384f30bf

SHA512
ad1da1ced1d0abc1df083f5bfd1275ce48447311a08a91ee054ea0f9aadc463ec247a6f0a3c1aa4a04f6c17fa566a686d8f66b3c9fcf4bffffe89fe8181cf203

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9ad2907ff0ca63d9f36dcf02bd438819

SHA1
4b7a684714e634c912cf1e9f2f87f56597bf7c98

SHA256
76b6654a0883f5d4d11b853a6b7e781320b65c82c7aa7bf029a09fcc1375478f

SHA512
dbd0e732c6b2a2a12c2536944ee7581c33fa356839ad919c7bea468de9597f5c92c06d5e6e7a0150b6172d2ab8665bf9ee2b6b39fb48b255cf0751489e34a894

Download Submit
C:\Users\Admin\AppData\Local\Sentry\565BEE8550E2E5F1B7BAFF132ECD72B7217F6160\.installation

Filesize
36B

MD5
1f8547ba8c6bdd299a8dff40cbd54e13

SHA1
b232209d0f8a8233628ad0e51788d6f899c9a233

SHA256
3cd8eef438907eb4c50d89b1658c8d21dc0dbe619a782123d9c2c45e5e0ba0ac

SHA512
01f53ae7fa19204c75fbc4c40a6eef7aa35eacf919ef570abdbd2adf7ea9c7c85dfceacd6179e8c08d0c90976a64866538ba363803a4cc592da8097b847111ba

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 314718.crdownload

Filesize
8.0MB

MD5
b8631bbd78d3935042e47b672c19ccc3

SHA1
cd0ea137f1544a31d2a62aaed157486dce3ecebe

SHA256
9cfda541d595dc20a55df5422001dfb58debd401df3abff21b1eee8ede28451c

SHA512
0c51d6247e39f7851538a5916b24972e845abfe429f0abdc7b532f654b4afe73dc6e1936f1b062da63bfc90273d3cbc297bf6c802e615f3711d0f180c070aa26

Download Submit
memory/1372-79-0x0000000006430000-0x000000000643A000-memory.dmp

Filesize
40KB

Download
memory/1372-88-0x0000000006980000-0x0000000006996000-memory.dmp

Filesize
88KB

Download
memory/1372-81-0x00000000064D0000-0x00000000064DA000-memory.dmp

Filesize
40KB

Download
memory/1372-82-0x0000000006600000-0x0000000006632000-memory.dmp

Filesize
200KB

Download
memory/1372-74-0x0000000000770000-0x0000000000F72000-memory.dmp

Filesize
8.0MB

Download
memory/1372-84-0x00000000067C0000-0x00000000067C8000-memory.dmp

Filesize
32KB

Download
memory/1372-80-0x0000000006450000-0x00000000064C6000-memory.dmp

Filesize
472KB

Download
memory/4564-76-0x0000000005ED0000-0x0000000005F70000-memory.dmp

Filesize
640KB

Download
memory/4564-87-0x0000000006B90000-0x0000000006C06000-memory.dmp

Filesize
472KB

Download
memory/4564-78-0x0000000005CC0000-0x0000000005CC8000-memory.dmp

Filesize
32KB

Download
memory/4564-77-0x0000000005C90000-0x0000000005C98000-memory.dmp

Filesize
32KB

Download
memory/4564-75-0x0000000005E20000-0x0000000005ED2000-memory.dmp

Filesize
712KB

Download
memory/4564-83-0x0000000006AD0000-0x0000000006AF6000-memory.dmp

Filesize
152KB

Download
memory/5472-117-0x0000000009DB0000-0x0000000009DBE000-memory.dmp

Filesize
56KB

Download
memory/5472-116-0x0000000009DD0000-0x0000000009E08000-memory.dmp

Filesize
224KB

Download
memory/5472-118-0x000000000B2B0000-0x000000000B2BA000-memory.dmp

Filesize
40KB

Download
memory/5472-119-0x000000000B2E0000-0x000000000B2FE000-memory.dmp

Filesize
120KB

Download