Overview

overview

8

Static

static

3

Wave-Setup.exe

windows10-2004-x64

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

LICENSES.c...m.html

windows10-2004-x64

3

resources/...mon.js

windows10-2004-x64

3

resources/...ll.exe

windows10-2004-x64

1

resources/...dex.js

windows10-2004-x64

3

resources/...rse.js

windows10-2004-x64

3

resources/...and.js

windows10-2004-x64

3

resources/...lts.js

windows10-2004-x64

3

resources/...xec.js

windows10-2004-x64

3

resources/...dex.js

windows10-2004-x64

3

resources/...oad.js

windows10-2004-x64

3

resources/...dex.js

windows10-2004-x64

3

resources/...dex.js

windows10-2004-x64

3

resources/...dex.js

windows10-2004-x64

3

resources/...tch.js

windows10-2004-x64

3

resources/...run.js

windows10-2004-x64

3

resources/...als.js

windows10-2004-x64

3

resources/...tch.js

windows10-2004-x64

3

resources/...mon.js

windows10-2004-x64

3

resources/...add.js

windows10-2004-x64

3

resources/...dex.js

windows10-2004-x64

3

resources/...rse.js

windows10-2004-x64

3

resources/...awn.js

windows10-2004-x64

3

resources/...bus.js

windows10-2004-x64

3

resources/...one.js

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...7z.dll

windows10-2004-x64

3

$R0/Uninst...ve.exe

windows10-2004-x64

7

Resubmissions

27/10/2024, 23:24

241027-3d31zsvele7

27/10/2024, 22:52

241027-2txcpsvfkk8

27/10/2024, 22:45

241027-2pv9vavamh8

Sharing

Copy URL Twitter E-mail

General

  • Target
    Wave-Setup.exe
  • Size 125.7MB
  • Sample241027-2txcpsvfkk
  • SHA256 141d262be2dcdc37113baad3a6282e6efa33d2d259006bb5094d8803fb45701b
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoveryevasionexecutionpersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target
      Wave-Setup.exe
    • Size 125.7MB
    • SHA256 141d262be2dcdc37113baad3a6282e6efa33d2d259006bb5094d8803fb45701b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    discoveryevasionpersistenceprivilege_escalationtrojan

    • Downloads MZ/PE file

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks for any installed AV software in registry

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Enumerates processes with tasklist

      discovery

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1
    • Target
      $PLUGINSDIR/SpiderBanner.dll
    • Size 9KB
    • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral2
    • Target
      $PLUGINSDIR/StdUtils.dll
    • Size 100KB
    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral3
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral4
    • Target
      $PLUGINSDIR/WinShell.dll
    • Size 3KB
    • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
    • MD5 SHA1 SHA512
    Score
    3/10
    discovery
    behavioral5
    • Target
      LICENSES.chromium.html
    • Size 9.0MB
    • SHA256 c6737ef4ed9de369077718824f76c5e7026d0e39163e26af8606783e41c93e18
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral6
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
    • Size 436B
    • SHA256 9bb0e59dfd1cc00fc40bed0ccf10d88414d915d79875b9dee5c1d5009f4e89cf
    • MD5 SHA1 SHA512
    Score
    3/10
    execution
    behavioral7
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/bin/windows-kill.exe
    • Size 78KB
    • SHA256 d35c0d3af8f66984b1ead5cb56744049c1d71ef0791383250ad1086c0e21f865
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral8
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/lib/cli/index.js
    • Size 1KB
    • SHA256 5c5b008f28d9aa1d6f8c30a30de037b95b50141a20ad0f029d0d79bcd75caa4d
    • MD5 SHA1 SHA512
    Score
    3/10
    execution
    behavioral9
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/lib/cli/parse.js
    • Size 5KB
    • SHA256 93b9bbbc19e6f0456185d7c9e9ce11e994f41c01e46067959c5168bd345b0313
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    execution
    behavioral10
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/lib/config/command.js
    • Size 1KB
    • SHA256 50f10478098f06b77a58b351a93bb8fe7a7572bfbfb3e6f0bf668460865da3a7
    • MD5 SHA1 SHA512
    Score
    3/10
    execution
    behavioral11
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/lib/config/defaults.js
    • Size 979B
    • SHA256 2b577f3fd8e3d03d64c1ee07ef13db89df04d0a9cf7b69ebf2c17041f7251104
    • MD5 SHA1 SHA512
    Score
    3/10
    execution
    behavioral12
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/lib/config/exec.js
    • Size 6KB
    • SHA256 fcd713c63326ff75fc44afdcbd2bf63991c3c76169a26a2646defab46ce24155
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    execution
    behavioral13
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/lib/config/index.js
    • Size 2KB
    • SHA256 be155df5dbc29c88c67c936f2840d2bb3abd09981fdb6db6480d54beeb27e9fe
    • MD5 SHA1 SHA512
    Score
    3/10
    execution
    behavioral14
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/lib/config/load.js
    • Size 6KB
    • SHA256 7329c732d39f8e884c0ec197e1133c536545bf4137417e6d664bbec962990e29
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    execution
    behavioral15
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/lib/help/index.js
    • Size 733B
    • SHA256 1c1678d18dc75f67bbfae8c92836543af6990bce6b1cf1ad3acfb52285dac393
    • MD5 SHA1 SHA512
    Score
    3/10
    execution
    behavioral16
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/lib/index.js
    • Size 38B
    • SHA256 95111d84575ab36b697d760e130d722daea3d322cf56612f2ae67c7b3e8cef19
    • MD5 SHA1 SHA512
    Score
    3/10
    execution
    behavioral17
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/lib/monitor/index.js
    • Size 82B
    • SHA256 cc16aeb163da6cc7746bf5ced2d11f1436e458c7ee803241e9a9fa1d107450fd
    • MD5 SHA1 SHA512
    Score
    3/10
    execution
    behavioral18
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/lib/monitor/match.js
    • Size 6KB
    • SHA256 d09e469209e55541c8c67fa7ab25b7d4e051ce26d36f737c6264d4ade4b26d63
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    execution
    behavioral19
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/lib/monitor/run.js
    • Size 16KB
    • SHA256 d93e994fddfcf6c7683976452a3d877a51e68f56ce2a49b821240c93cca86d13
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    execution
    behavioral20
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/lib/monitor/signals.js
    • Size 488B
    • SHA256 5c16e2e5f7101eea3f13c19da7c7a9e6fa02f7d1098b170e71f07d14f915e394
    • MD5 SHA1 SHA512
    Score
    3/10
    execution
    behavioral21
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/lib/monitor/watch.js
    • Size 6KB
    • SHA256 efb0a3f37d9a6279614b29fdbca3f29c1a6d47f2d26067be1c86bb56fbaefcf1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    execution
    behavioral22
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/lib/nodemon.js
    • Size 8KB
    • SHA256 3bb0b111682da4977e265b0bc746cd57191e294e0c25bf667f129771897dace4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    execution
    behavioral23
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/lib/rules/add.js
    • Size 2KB
    • SHA256 3cc60361f99b1080c66fce4d6ea0390a38c2a49e821e7f21dc43ed2fafa31277
    • MD5 SHA1 SHA512
    Score
    3/10
    execution
    behavioral24
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/lib/rules/index.js
    • Size 1KB
    • SHA256 3e64a2a35a97e41ff8c073299f07c3754d99b0a6e7d42faef7dc02d61d67757f
    • MD5 SHA1 SHA512
    Score
    3/10
    execution
    behavioral25
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/lib/rules/parse.js
    • Size 804B
    • SHA256 9259995d8e1ca1737ff36cf4f97c80e55d812726ec4ead43b6c0829ce9679df9
    • MD5 SHA1 SHA512
    Score
    3/10
    execution
    behavioral26
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/lib/spawn.js
    • Size 1KB
    • SHA256 7804d7450f305b9142af45967be5c96f52be8350dba2a403f4bf79d5e092bc60
    • MD5 SHA1 SHA512
    Score
    3/10
    execution
    behavioral27
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/lib/utils/bus.js
    • Size 946B
    • SHA256 8ebae78d8d75951b714acaa3e1a3d7f15b382a92b90c8040423e9866d97f1ad9
    • MD5 SHA1 SHA512
    Score
    3/10
    execution
    behavioral28
    • Target
      resources/app.asar.unpacked/node_modules/nodemon/lib/utils/clone.js
    • Size 829B
    • SHA256 5062a7c87599935fec99e505f3f463c3e0872455da73f8c8054ce0788c513ba2
    • MD5 SHA1 SHA512
    Score
    3/10
    execution
    behavioral29
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 6KB
    • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral30
    • Target
      $PLUGINSDIR/nsis7z.dll
    • Size 424KB
    • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral31
    • Target
      $R0/Uninstall Wave.exe
    • Size 322KB
    • SHA256 d56148d8188f1f59b8a58aa08830223a29c436ff6e4b701ff835c10951edc85c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

      discovery
    behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

JavaScript

1
T1059.007

Persistence

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Browser Information Discovery

1
T1217

Process Discovery

1
T1057

Query Registry

4
T1012

Software Discovery

1
T1518

Security Software Discovery

1
T1518.001

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

discoveryevasionpersistenceprivilege_escalationtrojan
Score
8/10

behavioral2

discovery
Score
3/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

execution
Score
3/10

behavioral8

Score
1/10

behavioral9

execution
Score
3/10

behavioral10

execution
Score
3/10

behavioral11

execution
Score
3/10

behavioral12

execution
Score
3/10

behavioral13

execution
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

execution
Score
3/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

execution
Score
3/10

behavioral25

execution
Score
3/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

execution
Score
3/10

behavioral29

execution
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
7/10