8332091688507f3ccc5b3d8c24bdeb7fa423e6d859a50e2bb70fada72bedca89

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Wayne-Setup.exe
Size 1.0MB
Sample260930-phra4aeh57
SHA256 8332091688507f3ccc5b3d8c24bdeb7fa423e6d859a50e2bb70fada72bedca89
MD5 fcec57e870b775a417ac716011e50e51
SHA1 e4b97c87f7e34bd116ff5a0db9cf5e2d5a48fc39
SHA512 0574631d48c9d0c5c42e2d64ab0bf3ddc847a550661b14660e138f157a9bbadddb2d728856efafb184865e5c994d6d53a691b92190012868a53e50558f02b3d3
SSDEEP 12288:8TJyP5R9Y0W0e9efkk3FHI81xzSS1XiLHjoiSMWzD68koMSo:8gzo9KkOZI8HzSggU4D
TLSH
T1F3358D47F6A6A1BCD15AC035934BA1B3BB33B88B02257DBB13F096342E65E506F1DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1184	wayne.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wayne = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Wayne\\wayne.exe\" --hidden"	Wayne-Setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	wayne.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	wayne.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	wayne.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	wayne.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	wayne.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	wayne.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5224	Wayne-Setup.exe
5224	Wayne-Setup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1184	wayne.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1184	wayne.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5224 wrote to memory of 1184	5224	Wayne-Setup.exe	89

C:\Users\Admin\AppData\Local\Temp\Wayne-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Wayne-Setup.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5224
- C:\Users\Admin\AppData\Local\Programs\Wayne\wayne.exe
  "C:\Users\Admin\AppData\Local\Programs\Wayne\wayne.exe" --hidden
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wayne.exe

Path C:\Users\Admin\AppData\Local\Programs\Wayne\wayne.exe
Size 667KB
SHA256 9af60d9a4cf4e58af4a31c6fd18cf0b339671631f38e9440da77520eb34f4271
MD5 80e4c04672e0189c17294779009ca6e2
SHA1 74b0b0b66f8986cc9ea63d2bfa3e8be2d01facc2
SHA512 7f81828b23d535f5052203513486ec543250f25f7b835c4d66cafd46db256c5e064bb2cfbc9d30cfc143c5a1d5b9a0a886c928e70951721213c0ba0b0cee3dfd
SSDEEP 6144:Fcg3dffNs3FHIU2pJMku5Jh1BSPAJRzYgARRhEi/y1XQAtbtzKp+CKAHjZWiSMsJ:Gkk3FHI81xzSS1XiLHjoiSMWzD68ko
TLSH
T12CE47C47F5A6A1BCD11AC036435BA173BB33B88B01297DBB57F09B342E65E506F09B18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1184-13-0x00007FF787630000-0x00007FF7876DC000-memory.dmp

Download

memory/5224-0-0x00007FF6E61C0000-0x00007FF6E62CD000-memory.dmp

Download

memory/5224-11-0x00007FF6E61C0000-0x00007FF6E62CD000-memory.dmp

Download

memory/5224-12-0x00007FF6E61C0000-0x00007FF6E62CD000-memory.dmp

Download