Analysis
-
max time kernel
150s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2024, 21:26
Static task
static1
Behavioral task
behavioral1
Sample
WaveBypasser.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
WaveBypasser.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
loader-o.pyc
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
loader-o.pyc
Resource
win10v2004-20241007-en
General
-
Target
loader-o.pyc
-
Size
63KB
-
MD5
8de2b2c9af7704e4c2ba5a86f94a216b
-
SHA1
ff16489804fc2708ec5091f996a3186d7caf7d74
-
SHA256
9317d8ca4325112f32d959f94de7b5a3e9df47f4ea29cda9b6546b9129e759e0
-
SHA512
cdb5119edecec96f95463b56720c1cb90f41d42ae331f81e302e3daccc457fe2476e73e6e1b8a16a80b97dd7e02c4a3c9900616439278e8ef35794455c2f1484
-
SSDEEP
768:XSRsdpf+li6q7MTvZUwxbKnV5qmd49qrwcMdmgug4FCbTfqf3:XSR0f+liaTvZZs5iIrquHCbOf3
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3236 OpenWith.exe -
Suspicious use of SetWindowsHookEx 25 IoCs
pid Process 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe 3236 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\loader-o.pyc1⤵
- Modifies registry class
PID:3524
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3236