9450dafe9611c073d06b5f7dc8a11659217ba80a5566dd7c12161f87b80b265a

Resubmissions

14/11/2024, 09:53

241114-lw55maxenr7

12/11/2024, 07:29

241112-jbbdea1kdk8

Sharing

Copy URL Twitter E-mail

General

Target
Wave-Setup.exe
Size 125.7MB
Sample241114-lw55maxenr
SHA256 9450dafe9611c073d06b5f7dc8a11659217ba80a5566dd7c12161f87b80b265a
MD5 83b9582724795067e20130359bfb1c73
SHA1 b15af3e93cadfdf3c7ef1da8abe30326c614858b
SHA512 e0513ccd5a7af6af150f87401c18807066073c6cd38abcd9cc43c8d1a6e49bf09e316554436c142a2e9188c66f34d80221099b1b135b161197b003a16196477b
SSDEEP 3145728:12Jkdx1xzhntUuzeaSyAPgdg3ib33ohJH69WfKNZLZM+tpw5zRS:mkb1xFyuzdSyANib33ovaNZLI5M
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  Wave-Setup.exe
- Size 125.7MB
- SHA256 9450dafe9611c073d06b5f7dc8a11659217ba80a5566dd7c12161f87b80b265a
- MD5 83b9582724795067e20130359bfb1c73
- SHA1 b15af3e93cadfdf3c7ef1da8abe30326c614858b
- SHA512 e0513ccd5a7af6af150f87401c18807066073c6cd38abcd9cc43c8d1a6e49bf09e316554436c142a2e9188c66f34d80221099b1b135b161197b003a16196477b
- SSDEEP 3145728:12Jkdx1xzhntUuzeaSyAPgdg3ib33ohJH69WfKNZLZM+tpw5zRS:mkb1xFyuzdSyANib33ovaNZLI5M
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates processes with tasklist
  discovery
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral5
- Target
  LICENSES.chromium.html
- Size 9.0MB
- SHA256 c6737ef4ed9de369077718824f76c5e7026d0e39163e26af8606783e41c93e18
- MD5 ae174699b663bd90d8d06c68c6952477
- SHA1 8c76eda61d320779909adc541593b8e26b24815a
- SHA512 3fb72dcd790464dde34978c9d0895376827f4d839b4a199c6e9fe77ab810d62b960babc4b21f6e189dc70147b5fb4334815730f4d1cdec05489c19e0725c2158
- SSDEEP 24576:h+QQf6Ox6x5n1nZwReXe1Gmfh6k6T6W6r656+eGj/dBIp+:oAPeGLp
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral6
- Target
  resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
- Size 436B
- SHA256 9bb0e59dfd1cc00fc40bed0ccf10d88414d915d79875b9dee5c1d5009f4e89cf
- MD5 30894042a167528293c057f833e7b6f2
- SHA1 ec993fedf1f1a22c77b985c72d8b0074811ea680
- SHA512 2b544b29e44e0471a9da5474209bc15cb81a44a38448a74a7a67f4ed3ca7d1926cef4b2b13d3269fb785a468d00f1cfc042d2a7d6b4d563725da65028e2df15f
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral7
- Target
  resources/app.asar.unpacked/node_modules/nodemon/bin/windows-kill.exe
- Size 78KB
- SHA256 d35c0d3af8f66984b1ead5cb56744049c1d71ef0791383250ad1086c0e21f865
- MD5 de5ecb14c8a2212beb309284b5a62aae
- SHA1 cf89d1cbd52f3183590b33bd6be591f95a6f5291
- SHA512 fea8a49538f5fd4cb8c262c1619f9f8e906edeef7d3c791bd3b85f032a0499aa5f18b4370a00e1f4dab9698e1958b042cab467103598f1bdaa583eb1fb918c07
- SSDEEP 768:AzE0/Tw0orfubmn3b7mX69Ne4xfX6irumhSA3eVqT3l8:43ZBm3b7mX6aO6Ds
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral8
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/cli/index.js
- Size 1KB
- SHA256 5c5b008f28d9aa1d6f8c30a30de037b95b50141a20ad0f029d0d79bcd75caa4d
- MD5 05d07534c94e2d589bcc02e96e1b9503
- SHA1 3c3712ecff74a1099c4d65e4eefd9cf2e38f1119
- SHA512 7c7526f2b4e685cc7e20689ebe5abf7630b738d2d15ab7b5e94765e0e6f221492e9e029f715f5b3ac156d3d11ffd907e070d2d7f968b5f5fb401aa9c7ec84ea5
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral9
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/cli/parse.js
- Size 5KB
- SHA256 93b9bbbc19e6f0456185d7c9e9ce11e994f41c01e46067959c5168bd345b0313
- MD5 63db540f7184a372ac611fc3d7f21136
- SHA1 0b3a8e70600a6705297a532849b7470c34f8c19e
- SHA512 1f56bbc4856fbefd21f6de0738712157b91f1388a71a957c37444b617ee161885822b21fcf4e7efe14d5af54b9706d8181acbb286dbd7525c91a56b53dc391be
- SSDEEP 96:+6TvjlNAJQppvvTa3USVOMXWKtxr0rTARlmDk1d9PATBVXTcYbhwn4Fq:phNAkjSVOMGQ0rT9Dk1daDX1i4Fq
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral10
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/config/command.js
- Size 1KB
- SHA256 50f10478098f06b77a58b351a93bb8fe7a7572bfbfb3e6f0bf668460865da3a7
- MD5 90c1aa9f031e818373c2f2f7ed6b9dbe
- SHA1 b6476cdfa45ab967436ba9bb32aac1d65e531a9f
- SHA512 4ee766da766530bb372d8e04b058edd6b28ca5d77f603b175336e9b5e8f5c677e77e0ea4afc07a642c07c48e0c209716dbd9cef4f6ab97864a9ea51af2b49bbc
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral11
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/config/defaults.js
- Size 979B
- SHA256 2b577f3fd8e3d03d64c1ee07ef13db89df04d0a9cf7b69ebf2c17041f7251104
- MD5 2e6f9c975170db8136c9ca5c5ecf2a0c
- SHA1 404a2c64977cae3407aa138c23a2f841546f713d
- SHA512 15bfa9fad522ddc043383704cac725c8cc2b4565708b891e9e03d889237cd528ee4d347e54a983c801550856c2d1ac1269dcc127edfa6d63bf3d2aa0a19eb358
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral12
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/config/exec.js
- Size 6KB
- SHA256 fcd713c63326ff75fc44afdcbd2bf63991c3c76169a26a2646defab46ce24155
- MD5 efcab0a70d5e71fb513734cf92f2a201
- SHA1 aa55660d5d6a38e2ea632d4de0640ad2b1b7fc5a
- SHA512 260a468807d297c2fe85ce8341ae10be64a7833a8249f2932c6a93e6ade07438ca4bd26222326a1b0e3203ba0c80a6a6fb78e90015b667feda8f68538e1011ad
- SSDEEP 192:JbY5kVR4x435efvxZRuSaCqiXNkNvCAoI1huLNINowq5bu:JbYtapefpZRuSDmvCAThu8q5i
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral13
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/config/index.js
- Size 2KB
- SHA256 be155df5dbc29c88c67c936f2840d2bb3abd09981fdb6db6480d54beeb27e9fe
- MD5 ac3af2f96d2e824bc37e36e30cb35cad
- SHA1 d04e50eb9464ee715a940819ac7af1b612884bb4
- SHA512 060bc19e10d8b9cd959869866b4ac5e0739edd72ca1e61a230a5f3c735feda6fb75ae7a8ea13349013082bedbcd40e30219ca09ccfaad43571059a765bcaee8c
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral14
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/config/load.js
- Size 6KB
- SHA256 7329c732d39f8e884c0ec197e1133c536545bf4137417e6d664bbec962990e29
- MD5 3379b8830f56cd13355114f157e57857
- SHA1 cec1a9f2c8ca7f666cb4efc2f3eb99317ea59602
- SHA512 0690be21833aa598da0d7d20312ee8a2e2ecaf164981c94c3bb12036cea40a206e1b25e839209db78419d6262ae87e29a5c94f583ddd9b45e05bc5a107842d22
- SSDEEP 192:0nZm6KJjPFt3zucWXistTMUFhBi833PoajJIDHDaswh1Ou8tfZCnb:0nZmVjOcWPhBi+iY15b
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral15
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/help/index.js
- Size 733B
- SHA256 1c1678d18dc75f67bbfae8c92836543af6990bce6b1cf1ad3acfb52285dac393
- MD5 e47db45cd167c663151a07e6a3396427
- SHA1 f3002a966b346ef937a47576d754787e4bddabff
- SHA512 3f8e10d09fcb527e1c1753d50c9bcef2b8fb70586f34e600c0d60ed27a295f077f380e1df2fdadc78b0d468a54f32a5351fb5c4cb638e3012c96358094d31dea
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral16
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/index.js
- Size 38B
- SHA256 95111d84575ab36b697d760e130d722daea3d322cf56612f2ae67c7b3e8cef19
- MD5 5250f6ffce08844c0f9f139fd707243c
- SHA1 b5646886daa1c00461042d1a35c1a83675f8c8ed
- SHA512 49dc989edab7b4ce7477bbc5c678e1b1f4aca0f77e0ad6323d3c251164ed28b59f4d18d5b0280d53108b93e133eb2dab5469093ecbb2f1fe2bb32b758f59e729
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral17
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/monitor/index.js
- Size 82B
- SHA256 cc16aeb163da6cc7746bf5ced2d11f1436e458c7ee803241e9a9fa1d107450fd
- MD5 532b43e5038c9f6a6d65d40ca44375f0
- SHA1 c7fa3f4fbab77df0eee87d08d428cc06d18faf76
- SHA512 809479d0b075c9bcb3eef6670cdd652a6caf39ec7f93f1d7dde0eee8a792d518238cfa9f78a2ec1a11ebbfeb00d2a117d25b198718af668c7f356bc3f93ebc1c
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral18
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/monitor/match.js
- Size 6KB
- SHA256 d09e469209e55541c8c67fa7ab25b7d4e051ce26d36f737c6264d4ade4b26d63
- MD5 65475ff22153cb7e1cdcd5322341c398
- SHA1 c026de2f4276472496755344bea58e11e6b38748
- SHA512 8010e71be183c4b1a02ced648f083be4c8e4be9ac474e1405d91d9925887b00fed0aa07d15b994846417a48ebf768c5402f5d0b004cf9107cb44149bac3da655
- SSDEEP 192:9h4PtYBpaIahtAUyUk90Ql6YcAimNCSMomGzdiaiwzqCZOa:9hiOUwbCSHmATqWj
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral19
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/monitor/run.js
- Size 16KB
- SHA256 d93e994fddfcf6c7683976452a3d877a51e68f56ce2a49b821240c93cca86d13
- MD5 47603d83844b08ba9fc39ac940d78f50
- SHA1 4b8dfa2ec30dbd1146a9908b10c858ecbd73521a
- SHA512 52f33cfc03dda936f4641f1ef8b3f14659247053a701b8990f0713742fb90016ba5d51d1e1f44fde84dd883c92166e77e908d586c527858bd3c0a416b9c9d256
- SSDEEP 384:gR47V0H/XFVzmMgzaE40FyVUM6TNeI/r8e5bvXcuAzw6QhYJ:gR2VO1AMgH40kVUZ/VGuAc4
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral20
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/monitor/signals.js
- Size 488B
- SHA256 5c16e2e5f7101eea3f13c19da7c7a9e6fa02f7d1098b170e71f07d14f915e394
- MD5 0b71010f098a8cbf8ea47a83a699693a
- SHA1 456a713c6a78b49bbf6d613ff9cfc4bc9f01f589
- SHA512 95a382907ac465d95db0cc41055038e839ed9164d4010003c08e6ba4456c19b50158c908b8d287eea09a153e38fdcc7f9a8c0052f35eb069243628e0968750fb
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral21
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/monitor/watch.js
- Size 6KB
- SHA256 efb0a3f37d9a6279614b29fdbca3f29c1a6d47f2d26067be1c86bb56fbaefcf1
- MD5 a0bccf8a21d0c4332643a758c666f725
- SHA1 1aa6968e927afd86a3f056126f31d2eb6420573f
- SHA512 bf4dc9c5b4f3b0a01ca161feee0ed13e6f1db24b0a64bbf01b325d0a2788380516da7da7654ee983818f3e0684983302242fe790bbb384dcc126ac4c394c41b8
- SSDEEP 96:Di1cyCi5v4XwFeD55TgLU0B00qNOr2+ntgHv+RQhLnn/ErCx:Di1dNMzeU80JL+tgGRmLnn/Er+
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral22
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/nodemon.js
- Size 8KB
- SHA256 3bb0b111682da4977e265b0bc746cd57191e294e0c25bf667f129771897dace4
- MD5 392a1c2f9f7dec3e4f64bb738f21785d
- SHA1 02d0364639bbc6483d727e5e24e6c6b39c8f0ae2
- SHA512 48b0517f41013b024dd5a674b88a9e53590113f664482b0420236babb9ecbf0428c40c9f708b204bcb1f2d59789ef6383641eb8efcc7a7ac506d4345c78358d6
- SSDEEP 192:TVHUQL82n0ESxpMpU4vBwB23cv+udr/rZpec0AoStcLMb5biCAYiOEx+8A0Ce:NUQLhnVAyJSr/rvJ9Jjxe
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral23
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/rules/add.js
- Size 2KB
- SHA256 3cc60361f99b1080c66fce4d6ea0390a38c2a49e821e7f21dc43ed2fafa31277
- MD5 4739ea852e85157f1ab60544ea5ce663
- SHA1 d83c88f7f8bd7ec5d1b36f86009ac7eba9ca1bbb
- SHA512 780001095f33fe4a18fa06c3311f3505949dfa762da5f1c0c6665b5501190b6e6c45eb69633c99e02b8b59d01813abfce2baa611509f2a0e65364ccf71965bc6
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral24
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/rules/index.js
- Size 1KB
- SHA256 3e64a2a35a97e41ff8c073299f07c3754d99b0a6e7d42faef7dc02d61d67757f
- MD5 0691f1f2acabdb82da7d67e05479ca5a
- SHA1 dcff01be935756a732591d61fab8e64e530ddeee
- SHA512 85ac8207410deba52d3b58fcf30e468ee46b1073544b61376b4b015e588a52973fefa192a027bfe8019b6cfedefc3c4c1cb4fb0ee88e7c2ef88da1c7ed0f9eb0
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral25
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/rules/parse.js
- Size 804B
- SHA256 9259995d8e1ca1737ff36cf4f97c80e55d812726ec4ead43b6c0829ce9679df9
- MD5 078e15305c8688746d2e6933d291babf
- SHA1 80f0b4201c45af197cae63c9d93a88525cd5c5d3
- SHA512 83ea7a6d31845542cf03f4b27be92087e417ba5f995ec740824440ddf92932d3623576b7a1022ade20deeff2f1741d617e32dfeda52efb5fb85e9be28de27df6
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral26
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/spawn.js
- Size 1KB
- SHA256 7804d7450f305b9142af45967be5c96f52be8350dba2a403f4bf79d5e092bc60
- MD5 ad2e1e41a1aaf8c0d0b622a27bc6bf9e
- SHA1 139625411959345da513904bcb7d73d7c312b63d
- SHA512 e43ecd8af261ad4cbed89f549c18c18df9cfae6338c0719c1e5c06361c6cee4598d080ee32dfda56cc742e23fad5db56a842ef8511d9d5e2c28b7f7eb4eac091
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral27
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/utils/bus.js
- Size 946B
- SHA256 8ebae78d8d75951b714acaa3e1a3d7f15b382a92b90c8040423e9866d97f1ad9
- MD5 e469c4cef4116cf230f86394586c5775
- SHA1 8849ab04de5836797a3839989d4325906bea9dff
- SHA512 923ecfd5103fc6e266e53dbb1d35e11f4058893177fa00cc392a628524dcdbe616c90015a24e15b987f971c5eabe0e53a3b107878bc41bc73aacf1e370d660f2
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral28
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/utils/clone.js
- Size 829B
- SHA256 5062a7c87599935fec99e505f3f463c3e0872455da73f8c8054ce0788c513ba2
- MD5 9ef3c7b72b1d63f5e3a7975ff67bdfeb
- SHA1 a406bd661839b5efeff4929af9fcfa991e51be12
- SHA512 eca4c0784695d43435573725f659409ec33a3acd3a5695665935439cca28122a6d8fdc1eaeb8ac6fbdb921893ad4226467777e8c35e3b9b0b672b2196f4e12d6
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral29
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral31
- Target
  $R0/Uninstall Wave.exe
- Size 322KB
- SHA256 88518b3c203f7dd989c4feabcceaff7e19ece0cffae474cd67a4f8efa35d0aae
- MD5 8475ade8d4940813baef8652f121b4af
- SHA1 157facb068fb6877c011a6d4a3b4a301b5fa7abc
- SHA512 d21a35198e2830447f0389ee891241865d878d7aae254b635e693a94514f7763e03ed399366491d880b6f6319d87352bbf5c14b49f519ab26ffae611ae173115
- SSDEEP 6144:C740I1STunbw0/5WpmWu6btAQs2t0EyL+yaS:wYSinbT5WpdtSRKJS
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Enumerates processes with tasklist
  discovery
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks for any installed AV software in registry

Checks installed software on the system

Enumerates processes with tasklist

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Executes dropped EXE

Loads dropped DLL

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32