General
- Target Wave-Setup.exe
- Size 125.7MB
- Sample241112-jbbdea1kdk
- SHA256 9450dafe9611c073d06b5f7dc8a11659217ba80a5566dd7c12161f87b80b265a
Malware Config
Targets
-
- Target Wave-Setup.exe
- Size 125.7MB
- SHA256 9450dafe9611c073d06b5f7dc8a11659217ba80a5566dd7c12161f87b80b265a
Score8/10-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks for any installed AV software in registry
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Enumerates processes with tasklist
-
- Target $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
Score3/10 -
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score3/10 -
- Target LICENSES.chromium.html
- Size 9.0MB
- SHA256 c6737ef4ed9de369077718824f76c5e7026d0e39163e26af8606783e41c93e18
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
- Size 436B
- SHA256 9bb0e59dfd1cc00fc40bed0ccf10d88414d915d79875b9dee5c1d5009f4e89cf
Score4/10 -
- Target resources/app.asar.unpacked/node_modules/nodemon/bin/windows-kill.exe
- Size 78KB
- SHA256 d35c0d3af8f66984b1ead5cb56744049c1d71ef0791383250ad1086c0e21f865
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/nodemon/lib/cli/index.js
- Size 1KB
- SHA256 5c5b008f28d9aa1d6f8c30a30de037b95b50141a20ad0f029d0d79bcd75caa4d
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/nodemon/lib/cli/parse.js
- Size 5KB
- SHA256 93b9bbbc19e6f0456185d7c9e9ce11e994f41c01e46067959c5168bd345b0313
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/nodemon/lib/config/command.js
- Size 1KB
- SHA256 50f10478098f06b77a58b351a93bb8fe7a7572bfbfb3e6f0bf668460865da3a7
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/nodemon/lib/config/defaults.js
- Size 979B
- SHA256 2b577f3fd8e3d03d64c1ee07ef13db89df04d0a9cf7b69ebf2c17041f7251104
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/nodemon/lib/config/exec.js
- Size 6KB
- SHA256 fcd713c63326ff75fc44afdcbd2bf63991c3c76169a26a2646defab46ce24155
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/nodemon/lib/config/index.js
- Size 2KB
- SHA256 be155df5dbc29c88c67c936f2840d2bb3abd09981fdb6db6480d54beeb27e9fe
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/nodemon/lib/config/load.js
- Size 6KB
- SHA256 7329c732d39f8e884c0ec197e1133c536545bf4137417e6d664bbec962990e29
Score3/10
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
1Virtualization/Sandbox Evasion
1System Checks
1Discovery
Browser Information Discovery
1Process Discovery
1Query Registry
4Software Discovery
1Security Software Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
1System Checks
1