Analysis
-
max time kernel
43s -
max time network
38s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-01-2025 23:23
Behavioral task
behavioral1
Sample
wave.executor.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
wave.executor.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
wave.executor.exe
-
Size
79KB
-
MD5
810d912112f579781879ada392b70a53
-
SHA1
247bc212d2d44184bae484049765240ac9fa5c32
-
SHA256
aee4ca6b2f3b07e85920f81b32acc5350d198439b181e997cd6a8e3ecbe9c939
-
SHA512
30fb6d77563a3a0d6b94a9ea9fc2f67c6dda3dc3ac2afd4e968ec998f2eabd1797d751fdac491a979e68301efc633c47fb2668a8abd0c5f0dcff6d12ed8ead0e
-
SSDEEP
1536:N/SpZjwaZD0YqEnwqaDrMk+bXxNEPZSBVGGmMRZOf4miljMt8xwR2:CEYqEwjrv+bB8DMRZOf4m8M+a2
Score
10/10
Malware Config
Extracted
Family
xworm
C2
daily-sexually.gl.at.ply.gg:25670
Attributes
-
Install_directory
%AppData%
-
install_file
Update.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/memory/3596-1-0x0000000000D30000-0x0000000000D4A000-memory.dmp family_xworm behavioral2/files/0x0007000000023cbb-37.dat family_xworm -
Xworm family
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk wave.executor.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk wave.executor.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "C:\\Users\\Admin\\AppData\\Roaming\\Update.exe" wave.executor.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 3596 wave.executor.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3596 wave.executor.exe Token: SeDebugPrivilege 3596 wave.executor.exe Token: SeDebugPrivilege 4524 taskmgr.exe Token: SeSystemProfilePrivilege 4524 taskmgr.exe Token: SeCreateGlobalPrivilege 4524 taskmgr.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe -
Suspicious use of SendNotifyMessage 35 IoCs
pid Process 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3596 wave.executor.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\wave.executor.exe"C:\Users\Admin\AppData\Local\Temp\wave.executor.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3596
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4524
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
766B
MD53f69f6477e5485eb5bcbd8002c0e0126
SHA15dfbd5bf999c7cbae0a09f76114c827cae01d396
SHA25691cbc1cbcc7c5bc7347c487d162424cb970d1bbeab6ad0e393ad8666cfa1d92c
SHA5120aed5cb8902a4bfb5f7e345bed4c48c290a68d942d4cf89c4808c20f8e770cc24caec900eee08a01eed39713f789d0372ced4480e98e497b96cd561c9a7af101
-
Filesize
79KB
MD5810d912112f579781879ada392b70a53
SHA1247bc212d2d44184bae484049765240ac9fa5c32
SHA256aee4ca6b2f3b07e85920f81b32acc5350d198439b181e997cd6a8e3ecbe9c939
SHA51230fb6d77563a3a0d6b94a9ea9fc2f67c6dda3dc3ac2afd4e968ec998f2eabd1797d751fdac491a979e68301efc633c47fb2668a8abd0c5f0dcff6d12ed8ead0e