Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/08/2026, 23:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Wave.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target Wave.exe
- Size 9.6MB
- Sample260818-29pmssaq21
- SHA256 fdddc5f2d005696b1923e8192a0f66b599dbf92aff40447869f2c278a736c50c
- MD5 1852c2d25f644263c7beb6fd8183e3bd
- SHA1 380d73cc5e4edb0640a8911fcf39846974c734ca
- SHA512 d7e49f7d0fe95c1f0f00a9ab815e121024d327c28aa66e2646b2366b0f0e702ccec741d7f0adae8c236f489d423e4eb3dc51410aa395bba42943363190069b19
- SSDEEP 196608:2DyDXOliXInuU6ljcYtRRoyqgFk99AamtOjNswoTu5evlQm2mtnMUwEa9BeLibsF:2aKnd6lLBSgC99Ai5sw0u5evlQm2mtnj
- TLSH T128A6011897E85552D73E9B7CC126C543FEB1B886032592CF0818FD582FEB7C2A636636
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1912 Wave.exe Token: SeDebugPrivilege 4828 taskmgr.exe Token: SeSystemProfilePrivilege 4828 taskmgr.exe Token: SeCreateGlobalPrivilege 4828 taskmgr.exe Token: 33 4828 taskmgr.exe Token: SeIncBasePriorityPrivilege 4828 taskmgr.exe - Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 1912 Wave.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wave.exe"C:\Users\Admin\AppData\Local\Temp\Wave.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1912
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4828