Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
13-05-2021 02:19
Static task
static1
Behavioral task
behavioral1
Sample
c9c9bc27f596eb25d234491aeb394d85bbba1a640bcf72f39e4b3c373fbe8eb9.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
c9c9bc27f596eb25d234491aeb394d85bbba1a640bcf72f39e4b3c373fbe8eb9.exe
-
Size
143KB
-
MD5
28b6e7754847c8c90eed3c0d8b82819f
-
SHA1
e960661b7f2e2e2465dd4fe9eb1b69dd049b8e34
-
SHA256
c9c9bc27f596eb25d234491aeb394d85bbba1a640bcf72f39e4b3c373fbe8eb9
-
SHA512
84ff731622c8ac225da655c4f1c5859dae48c8a7d37318584b50820aabe948ac320faf04424e29ed8d88192ad97c19e79cfedb6d31114a18957cdfc43342cf48
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
soundtexture.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat soundtexture.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
soundtexture.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings soundtexture.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 soundtexture.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070022000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 soundtexture.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32} soundtexture.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 soundtexture.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network" soundtexture.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" soundtexture.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" soundtexture.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" soundtexture.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings soundtexture.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1" soundtexture.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = e01ad595ad47d701 soundtexture.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0" soundtexture.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = e01ad595ad47d701 soundtexture.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections soundtexture.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 soundtexture.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\32-e2-17-db-d2-77 soundtexture.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" soundtexture.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix soundtexture.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" soundtexture.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad soundtexture.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
soundtexture.exepid process 800 soundtexture.exe 800 soundtexture.exe 800 soundtexture.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
c9c9bc27f596eb25d234491aeb394d85bbba1a640bcf72f39e4b3c373fbe8eb9.exepid process 1596 c9c9bc27f596eb25d234491aeb394d85bbba1a640bcf72f39e4b3c373fbe8eb9.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
c9c9bc27f596eb25d234491aeb394d85bbba1a640bcf72f39e4b3c373fbe8eb9.exec9c9bc27f596eb25d234491aeb394d85bbba1a640bcf72f39e4b3c373fbe8eb9.exesoundtexture.exesoundtexture.exepid process 2020 c9c9bc27f596eb25d234491aeb394d85bbba1a640bcf72f39e4b3c373fbe8eb9.exe 1596 c9c9bc27f596eb25d234491aeb394d85bbba1a640bcf72f39e4b3c373fbe8eb9.exe 280 soundtexture.exe 800 soundtexture.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
c9c9bc27f596eb25d234491aeb394d85bbba1a640bcf72f39e4b3c373fbe8eb9.exesoundtexture.exedescription pid process target process PID 2020 wrote to memory of 1596 2020 c9c9bc27f596eb25d234491aeb394d85bbba1a640bcf72f39e4b3c373fbe8eb9.exe c9c9bc27f596eb25d234491aeb394d85bbba1a640bcf72f39e4b3c373fbe8eb9.exe PID 2020 wrote to memory of 1596 2020 c9c9bc27f596eb25d234491aeb394d85bbba1a640bcf72f39e4b3c373fbe8eb9.exe c9c9bc27f596eb25d234491aeb394d85bbba1a640bcf72f39e4b3c373fbe8eb9.exe PID 2020 wrote to memory of 1596 2020 c9c9bc27f596eb25d234491aeb394d85bbba1a640bcf72f39e4b3c373fbe8eb9.exe c9c9bc27f596eb25d234491aeb394d85bbba1a640bcf72f39e4b3c373fbe8eb9.exe PID 2020 wrote to memory of 1596 2020 c9c9bc27f596eb25d234491aeb394d85bbba1a640bcf72f39e4b3c373fbe8eb9.exe c9c9bc27f596eb25d234491aeb394d85bbba1a640bcf72f39e4b3c373fbe8eb9.exe PID 280 wrote to memory of 800 280 soundtexture.exe soundtexture.exe PID 280 wrote to memory of 800 280 soundtexture.exe soundtexture.exe PID 280 wrote to memory of 800 280 soundtexture.exe soundtexture.exe PID 280 wrote to memory of 800 280 soundtexture.exe soundtexture.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9c9bc27f596eb25d234491aeb394d85bbba1a640bcf72f39e4b3c373fbe8eb9.exe"C:\Users\Admin\AppData\Local\Temp\c9c9bc27f596eb25d234491aeb394d85bbba1a640bcf72f39e4b3c373fbe8eb9.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\c9c9bc27f596eb25d234491aeb394d85bbba1a640bcf72f39e4b3c373fbe8eb9.exe--c48b4b282⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1596
-
C:\Windows\SysWOW64\soundtexture.exe"C:\Windows\SysWOW64\soundtexture.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:280 -
C:\Windows\SysWOW64\soundtexture.exe--4936fa5e2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:800
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/800-66-0x0000000000000000-mapping.dmp
-
memory/1596-60-0x0000000000000000-mapping.dmp
-
memory/1596-64-0x0000000076281000-0x0000000076283000-memory.dmpFilesize
8KB
-
memory/2020-59-0x0000000000230000-0x0000000000241000-memory.dmpFilesize
68KB
-
memory/2020-61-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB