Analysis
-
max time kernel
35s -
max time network
44s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
18-02-2025 17:23
General
-
Target
Wave-Setup.exe
-
Size
125.0MB
-
MD5
9c2c4ff8c886747f36dfb60baf8dfc58
-
SHA1
447c496617ce26d88040f6b927bd7758f895e704
-
SHA256
5583231982fa337c0ade14f84301cbf2078656bcfe128f99dd082c3ec95cb4c7
-
SHA512
0fc242a792479be540a8d78128efe566229f1b97c39bed840f813b81a5bc6504002f427e06eca14973e17c3789ec4f2d00a8cbbcbbcaa5629a34300fa9635a0f
-
SSDEEP
24576:ZTZS04YNEMuExDiU6E5R9s8xY/2l/d4BNIbt+rx:ZTb4auS+UjfU2TgNIbt+r
Malware Config
Extracted
orcus
147.45.67.158
07a04be20fd64a6f98b69fb858017041
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
2
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\wavecrack.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
02/18/2022 03:09:09
-
plugins
AgUFh/KmowjokAL8tAK+cicSsb2a/R0OQgBzAG8AZABQAHIAbwB0AGUAYwB0AGkAbwBuAAcDMQAuADAAQSA0ADcAZQBiADcANgA1ADAAMwA0ADkAOAA0ADcAYgA0AGEAOQBhAGYANQAyADEAMQBiADMANQA4ADYAMQA4ADQAAQXs/a7YDMDqAcy2Ar9g7F/XqzpdHw9EAGkAcwBhAGIAbABlAEQAZQBmAGUAbgBkAGUAcgAHAzIALgAwAEEgMABkADYAZABmADMAYwBiADgAOAA5ADIANABhADYAMwBhADkAYgBjADMAMgAyAGUAMAA2AGQANQAxADAAZABhAAEAAAQE
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
svchost.exe
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
-
Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs
-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus family
-
UAC bypass 3 TTPs 6 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 3 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 2 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
-
Drops file in System32 directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 45 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 60 IoCs
-
Suspicious use of SendNotifyMessage 59 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
-
System policy modification 1 TTPs 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wave-Setup.exe"C:\Users\Admin\AppData\Local\Temp\Wave-Setup.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe" --install2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\wavecrack.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\wavecrack.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
3Windows Service
3Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
3Windows Service
3Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
5Disable or Modify Tools
5Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD54a061dc67f92f39bf485c821aab2d538
SHA1501434177df0662bde7864560f62380f36e756f6
SHA256cb8716bba78d894b52e5173861913236d731da5e92afd77f9954af5bd3bf2f79
SHA5121db590eb2138e863725462f2e25cce4da15cd374c61676dbe147c5dbd36ed5279f13eeb9dfec52933c5a65e41254f2e9938e0bcf4b3b31331109fe63d8461fa9
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
224B
MD5e469dda91ae810a1f94c96060f3f8a65
SHA10b4b3b0f6f937016b1e045ce5313ee2a65a38630
SHA256d42fee8db8eb0e047ca53ad59b1c9bc69fe04993be36fec502e3532371908842
SHA5122eb4037361c03e195c642a53f55a3182a6df19903db503060e366f2394750e64ae04fdaace61ef5a6dba649defc88322d78edd2928bc53ebd1ce11d68cc88dac
-
Filesize
597B
MD5c2291863df7c2d3038ce3c22fa276506
SHA17b7d2bc07a6c35523807342c747c9b6a19f3184e
SHA25614504199bede3f46129969dbd2b7680f2e5b7fcd73a3e427ce1bb6217a6d13da
SHA51200bf40174a67e3e663d18a887c5b461a1e5ead0b27f0a139d87969158c58f4ca72cfa5a731dda239356192ca4cb5ac6ae2b0e37401d534e686cabacd3cbee8fa
-
Filesize
21KB
MD5e854a4636afc652b320e12e50ba4080e
SHA18a4ac6ecc22ee5f3a8ec846d38b41ff18c641fdc
SHA25694b9c78c6fa2bf61fba20a08ad4563f7dd2f5668c28eff227965ce0a2032d5d5
SHA51230aabd5079b6ed0948eb70fd18e9166096e4ba5d1d47fc35b7270f931d19bbe6cd929b6010f70297bf5272dc5a79e2523721354d211c4080d68ad8d17e316118
-
Filesize
64KB
-
Filesize
1.8MB
-
Filesize
96KB
-
Filesize
40KB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
5.2MB
-
Filesize
1.0MB
-
Filesize
304KB
-
Filesize
312KB
-
Filesize
40KB
-
Filesize
304KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
136KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
872KB
-
Filesize
96KB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
32KB
-
Filesize
216KB
-
Filesize
6.2MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
80KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
200KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
652KB
-
Filesize
56KB
-
Filesize
104KB
-
Filesize
40KB
-
Filesize
600KB
-
Filesize
68KB
-
Filesize
128KB
-
Filesize
624KB
-
Filesize
96KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
144KB
-
Filesize
4.8MB
-
Filesize
9.6MB
-
Filesize
304KB
-
Filesize
68KB
-
Filesize
3.3MB
-
Filesize
80KB
-
Filesize
304KB
-
Filesize
652KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB