fdddc5f2d005696b1923e8192a0f66b599dbf92aff40447869f2c278a736c50c

Analysis

user interaction
yes
max time kernel
24s
max time network
23s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Wave.exe
Size 9.6MB
Sample260809-d1frjazapf
SHA256 fdddc5f2d005696b1923e8192a0f66b599dbf92aff40447869f2c278a736c50c
MD5 1852c2d25f644263c7beb6fd8183e3bd
SHA1 380d73cc5e4edb0640a8911fcf39846974c734ca
SHA512 d7e49f7d0fe95c1f0f00a9ab815e121024d327c28aa66e2646b2366b0f0e702ccec741d7f0adae8c236f489d423e4eb3dc51410aa395bba42943363190069b19
SSDEEP 196608:2DyDXOliXInuU6ljcYtRRoyqgFk99AamtOjNswoTu5evlQm2mtnMUwEa9BeLibsF:2aKnd6lLBSgC99Ai5sw0u5evlQm2mtnj
TLSH
T128A6011897E85552D73E9B7CC126C543FEB1B886032592CF0818FD582FEB7C2A636636
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution themida

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2940	Wave.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000c00000001c60f-7.dat	themida

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3620	tasklist.exe
5068	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2940	Wave.exe
2940	Wave.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4964	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2636	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2636	PING.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4468	Wave.exe
Token: SeDebugPrivilege	3620	tasklist.exe
Token: SeDebugPrivilege	5068	tasklist.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 4964	4468	Wave.exe	89
PID 4964 wrote to memory of 3620	4964	cmd.exe	91
PID 4964 wrote to memory of 5868	4964	cmd.exe	92
PID 4964 wrote to memory of 2636	4964	cmd.exe	94
PID 4964 wrote to memory of 5068	4964	cmd.exe	95
PID 4964 wrote to memory of 2020	4964	cmd.exe	96
PID 4964 wrote to memory of 1200	4964	cmd.exe	97
PID 4964 wrote to memory of 2940	4964	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\Wave.exe
"C:\Users\Admin\AppData\Local\Temp\Wave.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_47fa2c07a9244c678977b1ef2538e0ee.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 4468"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3620
- - C:\Windows\system32\find.exe
    find "4468"
    3⤵
    PID:5868
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2636
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 4468"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5068
- - C:\Windows\system32\find.exe
    find "4468"
    3⤵
    PID:2020
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_5b504c83e4b4425eba8c8d02701310fd\*" "C:\Users\Admin\AppData\Local\Temp\" /S /E /Y /R /H /Q
    3⤵
    PID:1200
- - C:\Users\Admin\AppData\Local\Temp\Wave.exe
    "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WaveUpdate_47fa2c07a9244c678977b1ef2538e0ee.bat

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_47fa2c07a9244c678977b1ef2538e0ee.bat
Size 673B
SHA256 47753cb1b916fefbded5c64c9aa0e2a4959d7a649efeaef9dcd2b86b01405c82
MD5 866757e36262680042bd966d88e0e21a
SHA1 7c906a0d278b83901e590384376e6d9d0598f022
SHA512 c930b27d41bbc6c96ac9fed8af5a29215118ac9c777768359d19f8aad5a0f95708f5fea6c035b4070e3740f6256d5ad2e2f7f61799fb6d6c59a35f0340b21c45
TLSH
T16F01D362354A5A860421494F0BFEA708EFAFC58F3F0F660D56F4844A326E54B76ACDC5
MD5 SHA1 SHA512 TLSH

Submit Download

Wave.exe

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_5b504c83e4b4425eba8c8d02701310fd\Wave.exe
Size 13.2MB
SHA256 cb3fdd72eeb1e87df8414ccc105814eae2d491498334bd6516bc97f00d80324e
MD5 771152b26aff891eca8cec1e2779e04a
SHA1 c6d67415702bca39019126d96872e07a27f8afba
SHA512 d52289ebc1ccd56485d84971ec4b8a3b22f709886b5fdffe4bcea8b50886517cdbb8681910ce5fc64373e4bde45d83026e6e5bcf4eb49e55c8f963fdb484fe72
SSDEEP 196608:62OV7xf5MqPa9QyS6GBKwophvvi/H7bJR6B3BkamaJU8Al2vw0pETwnrZfVnXGt7:CoqPzfKp6vxR6l6aJYEPTNn2tScT0K
TLSH
T11ED612D526C4927DC4818238E54516F8F0D57CC89CF9842AFFC76A217A71CAAC8B6B73
MD5 SHA1 SHA512 SSDEEP TLSH