Analysis

  • max time kernel
    840s
  • max time network
    844s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03-01-2025 16:19

General

  • Target

    https://github.com/hugodq/Wave-executor/releases/tag/Download

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 41 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/hugodq/Wave-executor/releases/tag/Download
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3700
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe4,0x10c,0x7ffda74f3cb8,0x7ffda74f3cc8,0x7ffda74f3cd8
      2⤵
        PID:4812
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,8033466278426814620,4673606103577428667,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
        2⤵
          PID:4984
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,8033466278426814620,4673606103577428667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3148
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,8033466278426814620,4673606103577428667,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
          2⤵
            PID:3328
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8033466278426814620,4673606103577428667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
            2⤵
              PID:4620
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8033466278426814620,4673606103577428667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
              2⤵
                PID:3380
              • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,8033466278426814620,4673606103577428667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:4256
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,8033466278426814620,4673606103577428667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3996
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8033466278426814620,4673606103577428667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
                2⤵
                  PID:3600
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8033466278426814620,4673606103577428667,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
                  2⤵
                    PID:4528
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8033466278426814620,4673606103577428667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
                    2⤵
                      PID:2496
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8033466278426814620,4673606103577428667,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
                      2⤵
                        PID:408
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,8033466278426814620,4673606103577428667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
                        2⤵
                          PID:1660
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,8033466278426814620,4673606103577428667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
                          2⤵
                          • NTFS ADS
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3712
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,8033466278426814620,4673606103577428667,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6208 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3660
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:408
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:4040

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            554d6d27186fa7d6762d95dde7a17584

                            SHA1

                            93ea7b20b8fae384cf0be0d65e4295097112fdca

                            SHA256

                            2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

                            SHA512

                            57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            a28bb0d36049e72d00393056dce10a26

                            SHA1

                            c753387b64cc15c0efc80084da393acdb4fc01d0

                            SHA256

                            684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

                            SHA512

                            20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            1KB

                            MD5

                            1d140e4c61bb490d553abb0993aa4c38

                            SHA1

                            12c989b2924e81dd636099a4e249291f7e4e7c0f

                            SHA256

                            ff3f5e56ce394cad71d12582f14e49dc426307e84ddc017be047a2f8b7251a2a

                            SHA512

                            014bb540a049119c92790ea7cf42ba29d8b3756ea18df2d85cf9e8db27b3662fa27f94c90130926edbeb51eab3fddbd3966cc6530135b7b3742eb7fb6948dcc0

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                            Filesize

                            496B

                            MD5

                            5022b10efc3c6d669ded7960cc594a19

                            SHA1

                            a79ad985b345f09f5f4f265ba1867800ab4d3be1

                            SHA256

                            a6c395932ed70d3a45247d91c6593b48d6d389a52aa806ad484aef62b63c8e53

                            SHA512

                            a496101a7c30b7205f91698eec23c53b52d80a24a2208f3184733b905fd34066163df9688e00856278fc536fd955bcb0d2c62f3561f28718e378a08754c53c00

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            f97fe34e14770457d60ce7977f1a9054

                            SHA1

                            0f513fed56ec7623ab61c0d2455f9eeb38adb928

                            SHA256

                            bfa7b8c33feb4108d8a4a5ac23f4a0d0abe6bc2376a8dff0ff56389b05e49ed0

                            SHA512

                            0c95ba52fb4eb484d1881345271e1772e70b02d001d3f612da444b0643cf9791109fa0c2deb4f009316cffeb6b3c83b2138485410a5e98cb7d0641b6839c680c

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            b63bb6e983ed985fa28e87bb4ebd916f

                            SHA1

                            3c26f1d349fb0f307cc86067a3bfdf280111d324

                            SHA256

                            5a78781390f5b002f3427ec25a6b88750b9cb2bfc665dc8f8e9cfb92b3d2dff2

                            SHA512

                            190ca5756dcf40d54d03acc2ea5918491d1274ea4480c867e313951d0100979adcd76d217e33f84f03e02b140f89794df62b10bfea0ce26184dd44d13744c24e

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            872B

                            MD5

                            598088cd285619b816163dce3ca0a19c

                            SHA1

                            e63291b48405ae9431424645695640774f6ba9b6

                            SHA256

                            bc91e1cfa29f81cb77792f2f5b067acf805a0e4f6f6ce129189ea69303afd5af

                            SHA512

                            7dd65f23de73cb0eeb16cd5ce2f534a87879f97b6823a5b5a81ad5b0466df86ead6df4f6304605d43f7bb2527207eb238588338a045c4a690716955a2fa27b6c

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            872B

                            MD5

                            88e18b0983749e2cd2fb83ecf3e2c37a

                            SHA1

                            eb325c4b5876e6683eadf367bef12fdf253e3873

                            SHA256

                            5ef3375f27fed46b2f1a64b5578616b40a9fdc277fcbca3eb3e7570786d98155

                            SHA512

                            8cb58f1d7cf4332563e3d6eab55791f464b150992b2157981b66c8a0fde7c09985597991be6350ee5608fca3be074feaa6a98fd7dc3a71298e60ad00934184a2

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581c3d.TMP

                            Filesize

                            872B

                            MD5

                            96b744de998569efedfb0ee669fae651

                            SHA1

                            d832cf05eb0a78a5c71f5d558fc8eb462c1f4d5f

                            SHA256

                            088f8115368c0205b1365080a0ebddd7e6aedf8df9538a86adad54fc5ef161ef

                            SHA512

                            81fd333791c1110ed2f2b22ba74f51ad2020ac4356e32aa0a53c176eb8c69f537fc830ff1ba49519c586bfff05f3478f99973f7d6151a129d2a1f86b8aa6560a

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            46295cac801e5d4857d09837238a6394

                            SHA1

                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                            SHA256

                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                            SHA512

                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            206702161f94c5cd39fadd03f4014d98

                            SHA1

                            bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                            SHA256

                            1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                            SHA512

                            0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            10KB

                            MD5

                            fe46e7086e3fa22c588ab4faa7c24e6e

                            SHA1

                            d3ae9ad6d6e934c4d82b4a45452f66dd1f2125f5

                            SHA256

                            72d082cc67d9f3951ef4ab2be0f2797610417741d297810aae79330ed993331e

                            SHA512

                            d1112aa77878a4a2165a0dd443daa1dccb08931a429bf7ce4c290ac9982f9b2404b57243d21216ebcfdb798ca7ce2e95495c55fddabf5a6c2f9c01db3750c526

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            10KB

                            MD5

                            0c3c03da5aa221b75ae3117093164039

                            SHA1

                            ee72f138ce70e6e2845af5d33d8fe2fffda647bb

                            SHA256

                            c8ace5497a00e889b5133e6cbc7110af386703d406e90d3d7365bf01acedc6b2

                            SHA512

                            e044a422b9a310ca913341d4a09d0195ad5c363cefde5a5b057c854e86dfb39970192e29932ded8b25b1200c32b76154e4447cf80fc6bba318d3506b1697f944

                          • C:\Users\Admin\Downloads\Setup5.0.zip:Zone.Identifier

                            Filesize

                            101B

                            MD5

                            3a3d180473b86fa64fb98b690bacf365

                            SHA1

                            040fe8a559ce0219d2ac6952d62b7e977e312177

                            SHA256

                            5b0c41fb4993161e345b965db2324e3db2085d3a5de79667fcf63dc839e4f4ba

                            SHA512

                            441998b5bc5c3c1a5644e9745e601cc4893a1d57ba7368e620f0c3c1ca89cec24b80318c2ac4faee360b8b78f68758a0ee576295ead6202332804b867cc03c02

                          • C:\Users\Admin\Downloads\Unconfirmed 847004.crdownload

                            Filesize

                            2.3MB

                            MD5

                            d7d4d1c2aa4cbda1118cd1a9ba8c8092

                            SHA1

                            0935cb34d76369f11ec09c1af2f0320699687bec

                            SHA256

                            3a82d1297c523205405817a019d3923c8f6c8b4802e4e4676d562b17973b21ea

                            SHA512

                            d96d6769afc7af04b80a863895009cd79c8c1f9f68d8631829484611dfce7d4f1c75fc9b54157482975c6968a46e635e533d0cad687ef856ddc81ab3444bb553