fdddc5f2d005696b1923e8192a0f66b599dbf92aff40447869f2c278a736c50c

Analysis

user interaction
yes
max time kernel
53s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Wave.exe
Size 9.6MB
Sample260809-d1frjazapf
SHA256 fdddc5f2d005696b1923e8192a0f66b599dbf92aff40447869f2c278a736c50c
MD5 1852c2d25f644263c7beb6fd8183e3bd
SHA1 380d73cc5e4edb0640a8911fcf39846974c734ca
SHA512 d7e49f7d0fe95c1f0f00a9ab815e121024d327c28aa66e2646b2366b0f0e702ccec741d7f0adae8c236f489d423e4eb3dc51410aa395bba42943363190069b19
SSDEEP 196608:2DyDXOliXInuU6ljcYtRRoyqgFk99AamtOjNswoTu5evlQm2mtnMUwEa9BeLibsF:2aKnd6lLBSgC99Ai5sw0u5evlQm2mtnj
TLSH
T128A6011897E85552D73E9B7CC126C543FEB1B886032592CF0818FD582FEB7C2A636636
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution themida

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3868	Wave.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x00070000000246be-7.dat	themida

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1072	tasklist.exe
5888	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3868	Wave.exe
3868	Wave.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3228	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5952	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5952	PING.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6088	Wave.exe
Token: SeDebugPrivilege	1072	tasklist.exe
Token: SeDebugPrivilege	5888	tasklist.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 6088 wrote to memory of 3228	6088	Wave.exe	89
PID 3228 wrote to memory of 1072	3228	cmd.exe	91
PID 3228 wrote to memory of 5716	3228	cmd.exe	92
PID 3228 wrote to memory of 5952	3228	cmd.exe	94
PID 3228 wrote to memory of 5888	3228	cmd.exe	95
PID 3228 wrote to memory of 4676	3228	cmd.exe	96
PID 3228 wrote to memory of 1248	3228	cmd.exe	97
PID 3228 wrote to memory of 3868	3228	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\Wave.exe
"C:\Users\Admin\AppData\Local\Temp\Wave.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6088
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_caa898e124d54a85b26c390fb5b7e190.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 6088"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1072
- - C:\Windows\system32\find.exe
    find "6088"
    3⤵
    PID:5716
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5952
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 6088"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5888
- - C:\Windows\system32\find.exe
    find "6088"
    3⤵
    PID:4676
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_36b4eefdfc5844b9a5966d41e48e490e\*" "C:\Users\Admin\AppData\Local\Temp\" /S /E /Y /R /H /Q
    3⤵
    PID:1248
- - C:\Users\Admin\AppData\Local\Temp\Wave.exe
    "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Wave.exe

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_36b4eefdfc5844b9a5966d41e48e490e\Wave.exe
Size 13.2MB
SHA256 cb3fdd72eeb1e87df8414ccc105814eae2d491498334bd6516bc97f00d80324e
MD5 771152b26aff891eca8cec1e2779e04a
SHA1 c6d67415702bca39019126d96872e07a27f8afba
SHA512 d52289ebc1ccd56485d84971ec4b8a3b22f709886b5fdffe4bcea8b50886517cdbb8681910ce5fc64373e4bde45d83026e6e5bcf4eb49e55c8f963fdb484fe72
SSDEEP 196608:62OV7xf5MqPa9QyS6GBKwophvvi/H7bJR6B3BkamaJU8Al2vw0pETwnrZfVnXGt7:CoqPzfKp6vxR6l6aJYEPTNn2tScT0K
TLSH
T11ED612D526C4927DC4818238E54516F8F0D57CC89CF9842AFFC76A217A71CAAC8B6B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaveUpdate_caa898e124d54a85b26c390fb5b7e190.bat

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_caa898e124d54a85b26c390fb5b7e190.bat
Size 673B
SHA256 f336ed9b374b54fd4e039e55228cd976e413f637c8028c6a2de41c53da252abd
MD5 d0d4bd81fc1e82f533308aaaa7fbd12e
SHA1 2047ef128fcb662d7f4d5558932deb520284d884
SHA512 89fa9940c563671698298c67ea36fde5fe4e3838ed015e5e3f7259be61773a50d3f3c8baf960ca1f013ba21a12b7a7c6bf7edf0679ec6ba5257de73146637ddf
TLSH
T124012362254A498604218F8F0BEE9B09DE6FC48F2F0E610C55B8440A332E14B76E8DC0
MD5 SHA1 SHA512 TLSH