Analysis
-
max time kernel
62s -
max time network
164s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/10/2024, 21:26
Static task
static1
Behavioral task
behavioral1
Sample
WaveBypasser.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
WaveBypasser.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
loader-o.pyc
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
loader-o.pyc
Resource
win10v2004-20241007-en
General
-
Target
WaveBypasser.exe
-
Size
53.1MB
-
MD5
adeb13ed4be55e7843db3a23ca09837a
-
SHA1
c91d0cc7184de97a4d9221d36ec0abe1ebed0ffd
-
SHA256
4270cf9684c5839b360fc33c9a8101e40f2f4c768a8ce55b4b0e0236a1bb7082
-
SHA512
298cfb6d54db45019e460f13ab52f7e2b03c44c2c2f3a5c71130d64a048fc7b74f12c3c1e990295ab7182247bd819b03cd3c09e8ab26109fa0dc37ea26649a51
-
SSDEEP
786432:fiIZWeEw7SQqMoknvNpA+vIlo0FdGgBQJbTiumfSXdZESWqEIBBwW2HK3EE:amEweQqMrlpA+Ql4pxTivfS4qrBB1UE
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 3012 WaveBypasser.exe -
resource yara_rule behavioral1/files/0x0003000000020853-838.dat upx behavioral1/memory/3012-840-0x000007FEF52E0000-0x000007FEF59A5000-memory.dmp upx -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2844 chrome.exe 2844 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe Token: SeShutdownPrivilege 2844 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe 2844 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1848 wrote to memory of 3012 1848 WaveBypasser.exe 30 PID 1848 wrote to memory of 3012 1848 WaveBypasser.exe 30 PID 1848 wrote to memory of 3012 1848 WaveBypasser.exe 30 PID 2844 wrote to memory of 1844 2844 chrome.exe 33 PID 2844 wrote to memory of 1844 2844 chrome.exe 33 PID 2844 wrote to memory of 1844 2844 chrome.exe 33 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 320 2844 chrome.exe 35 PID 2844 wrote to memory of 2920 2844 chrome.exe 36 PID 2844 wrote to memory of 2920 2844 chrome.exe 36 PID 2844 wrote to memory of 2920 2844 chrome.exe 36 PID 2844 wrote to memory of 2980 2844 chrome.exe 37 PID 2844 wrote to memory of 2980 2844 chrome.exe 37 PID 2844 wrote to memory of 2980 2844 chrome.exe 37 PID 2844 wrote to memory of 2980 2844 chrome.exe 37 PID 2844 wrote to memory of 2980 2844 chrome.exe 37 PID 2844 wrote to memory of 2980 2844 chrome.exe 37 PID 2844 wrote to memory of 2980 2844 chrome.exe 37 PID 2844 wrote to memory of 2980 2844 chrome.exe 37 PID 2844 wrote to memory of 2980 2844 chrome.exe 37 PID 2844 wrote to memory of 2980 2844 chrome.exe 37 PID 2844 wrote to memory of 2980 2844 chrome.exe 37 PID 2844 wrote to memory of 2980 2844 chrome.exe 37 PID 2844 wrote to memory of 2980 2844 chrome.exe 37 PID 2844 wrote to memory of 2980 2844 chrome.exe 37 PID 2844 wrote to memory of 2980 2844 chrome.exe 37 PID 2844 wrote to memory of 2980 2844 chrome.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\WaveBypasser.exe"C:\Users\Admin\AppData\Local\Temp\WaveBypasser.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\WaveBypasser.exe"C:\Users\Admin\AppData\Local\Temp\WaveBypasser.exe"2⤵
- Loads dropped DLL
PID:3012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef52d9758,0x7fef52d9768,0x7fef52d97782⤵PID:1844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1172 --field-trial-handle=1224,i,9720195805215138623,17317449875670891313,131072 /prefetch:22⤵PID:320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1416 --field-trial-handle=1224,i,9720195805215138623,17317449875670891313,131072 /prefetch:82⤵PID:2920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1436 --field-trial-handle=1224,i,9720195805215138623,17317449875670891313,131072 /prefetch:82⤵PID:2980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2132 --field-trial-handle=1224,i,9720195805215138623,17317449875670891313,131072 /prefetch:12⤵PID:448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2144 --field-trial-handle=1224,i,9720195805215138623,17317449875670891313,131072 /prefetch:12⤵PID:352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1376 --field-trial-handle=1224,i,9720195805215138623,17317449875670891313,131072 /prefetch:22⤵PID:2420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1368 --field-trial-handle=1224,i,9720195805215138623,17317449875670891313,131072 /prefetch:12⤵PID:1264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3460 --field-trial-handle=1224,i,9720195805215138623,17317449875670891313,131072 /prefetch:82⤵PID:2168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3464 --field-trial-handle=1224,i,9720195805215138623,17317449875670891313,131072 /prefetch:82⤵PID:660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3732 --field-trial-handle=1224,i,9720195805215138623,17317449875670891313,131072 /prefetch:82⤵PID:2592
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1756
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
5KB
MD5b54874c2d8effb3575e6426cf37f638d
SHA16fc5eba81395b251101ffadb8714502fb9e14d73
SHA256e992fd0362ef3d4fe6b9cb01dc1d09da1427ac2da4cee01764f012d5c2b4b04e
SHA512ece291b83f1455fa6664f5b492877f08b1954cc7b247803bf5928310b235d71c78fda2901adb389013db6717dfa3e357c5c25bc3bd9f5775efc0f333b6fe0c70
-
Filesize
5KB
MD5b9041b7c2239e612b441aa6a76c2a847
SHA178318aa37dac12acdf56c0a679e130d53a20d2d6
SHA256c7dd1deb29c610a7a3c4d17aaf7c77dd2bbcdb52e23b74d8fdb16bbbf7909f8d
SHA512608eb632414a96d5cb668893ebc78d7acaff05e09b0cd6c538a47b7c472824121808e372fa1a96b8d8a84780f433f91a4ece400d5f249582b53ab6610228b400
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
1.7MB
MD55750b5cbbb8628436ce9a3557efad861
SHA1fb6fda4ca5dd9415a2031a581c1e0f055fed63b5
SHA256587598b6c81f4f4dce3afd40ca6d4814d6cfdb9161458d2161c33abfdadc9e48
SHA512d23938796b4e7b6ae7601c3ab9c513eb458cccb13b597b2e20762e829ce4ace7b810039c713ec996c7e2ce8cfb12d1e7231903f06f424266f460a004bd3f6f53
-
C:\Users\Admin\AppData\Local\Temp\_MEI18482\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\INSTALLER
Filesize4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
-
C:\Users\Admin\AppData\Local\Temp\_MEI18482\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\LICENSE
Filesize1023B
MD5141643e11c48898150daa83802dbc65f
SHA10445ed0f69910eeaee036f09a39a13c6e1f37e12
SHA25686da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
SHA512ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f
-
Filesize
92B
MD543136dde7dd276932f6197bb6d676ef4
SHA16b13c105452c519ea0b65ac1a975bd5e19c50122
SHA256189eedfe4581172c1b6a02b97a8f48a14c0b5baa3239e4ca990fbd8871553714
SHA512e7712ba7d36deb083ebcc3b641ad3e7d19fb071ee64ae3a35ad6a50ee882b20cd2e60ca1319199df12584fe311a6266ec74f96a3fb67e59f90c7b5909668aee1