8a2e5e073d34f4fb7cda2040d30e23d60cb675b71120e0e2c39838015c66f306

Resubmissions

23-10-2024 15:23

241023-ssksvaxbld 3

04-09-2024 13:53

240904-q65ztssflb 10

Analysis

max time kernel
1367s
max time network
1157s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2024 15:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WaveKeyGen/obj/Debug/net8.0/WaveKeyGen.pdb
Size

16KB
MD5

697cdba7cd0e0303f3649152f91c0f3d
SHA1

f0a65b54f215a31cd532fffec1d9e7c6e8084f93
SHA256

3e9a46f8fb0bb697615e6daebff54f52c2f1f723ca2bacff7bf26d9745f66fe2
SHA512

2a3860e1a265fe3c4cf2beb0bc76ff901bd88db0628d3706a6f69a3d384bf2fd5899920c4959deec40f2997a798a58591235f60c071297c2463d269772a4f5dd
SSDEEP

384:1Yi38ZrTI3FFtmfCZbd+auMDDtSHaT+LAVhkXIhvtR3YeayHVfIUXP8RHGucDe/D:14ZPI33t7wAnJvIRBWu

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

624 OpenWith.exe

pid	process
624	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\WaveKeyGen\obj\Debug\net8.0\WaveKeyGen.pdb
1⤵
- Modifies registry class
PID:1028

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads