f06baccfc26545ba0e9e075adaa2aa65f00e7473e21693ad4e4423b365777237 | Triage

Sharing

General

Target

Wave Browser.exe.zip
Size

905KB
Sample

240911-s3p6bayckn
MD5

92545ee02d600c7ae2aee0ba991639e9
SHA1

0be0391d73c2721ce48ca8ebc26d4d4631114ea4
SHA256

f06baccfc26545ba0e9e075adaa2aa65f00e7473e21693ad4e4423b365777237
SHA512

cbf4340a96f8600140e528e9aa7d9a6d8d3c9f92bfb96de6b30d2a5f0b2a55c31a2edacb3f0de44228312fea3c0bbec8ac9ef6f3460cf34b03800a608a0aa593
SSDEEP

24576:QpWTmaetLZkCiBixSg27SC/c6QhjxEjLLJKT+p:Qcmaut6BiEjuO3OtWxxp

Score

6^/10

discovery evasion persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  77200156d4773175d341aad11ab23bd52445065cd95060348da17d083dc27688
- Size
  
  1.2MB
- MD5
  
  c9db6b5c84be13a43ad23cc204e4bc52
- SHA1
  
  94bd6634303205715fd04f8aa10d75158390e4d9
- SHA256
  
  77200156d4773175d341aad11ab23bd52445065cd95060348da17d083dc27688
- SHA512
  
  9273493c5e5ea24b2f5ee219fdf849546e85b3f5cc24c970f1ab6fdcfe961d96ca6fd41c96f9d915892ab24ce7ff409f0f5a6569b0225e95d36afba51615f8d6
- SSDEEP
  
  24576:PW/RUV5T9w6qAps/uc+hd+VochG2f6kD4E/7J:PCRUVvjsTE9Y6kcEt
Score

6^/10

discovery evasion persistence privilege_escalation trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Component Object Model Hijacking

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Component Object Model Hijacking

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalationtrojan