General
- Target HitWave.exe
- Size 69.9MB
- Sample260712-cdkljaby6l
- SHA256 a0be1a9fac8962be991092ae26a5153f8df0555c83faafb1df2c3b7c3c253a11
Malware Config
Targets
-
- Target HitWave.exe
- Size 69.9MB
- SHA256 a0be1a9fac8962be991092ae26a5153f8df0555c83faafb1df2c3b7c3c253a11
Score10/10Windows security bypass
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target Installer.exe
- Size 168.1MB
- SHA256 f1fdb3e045eff53d860bb757980dd194b392910fc8a9b640bae912388cda9c4c
Score10/10Windows security bypass
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
- Target LICENSES.chromium.html
- Size 8.7MB
- SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
Score3/10 -
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
Score1/10 -
- Target ffmpeg.dll
- Size 2.7MB
- SHA256 11daf2bf89a3ac660533b3e487e0624668b35f45d2bd94e9b0324bce8758de60
Score1/10 -
- Target libEGL.dll
- Size 468KB
- SHA256 a4336a318e8d92a47843d5fe429dc6d1ff7271d8bac189d719bc8074a128fd6e
Score1/10 -
- Target libGLESv2.dll
- Size 7.3MB
- SHA256 7b0baa9e2e731716efe3e0bebf6a0bcd2d64f35d9f62b20d23acb4e098c9be36
Score1/10 -
- Target resources/app/main.js
- Size 138KB
- SHA256 e49aa6da6718c5ffb6a0f4632301340979dcd23381c7c458ca929e6681220001
Score3/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target vk_swiftshader.dll
- Size 5.1MB
- SHA256 46afb1ed7ab1b1a679e00784b2e78cc2358cec615553699624ff77882f55787b
Score1/10 -
- Target vulkan-1.dll
- Size 932KB
- SHA256 fa6b4e20eb448746e2eff9a7fde7a62585e371f3497a6a928eade0a8ce8c1a9f
Score1/10 -
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10
MITRE ATT&CK Enterprise v16
Defense Evasion
Hide Artifacts
3File/Path Exclusions
1Hidden Window
1Ignore Process Interrupts
1Impair Defenses
2Disable or Modify Tools
2Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1