Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
8Soundpad/P...ID.cfg
windows10-2004-x64
8Soundpad/Soundpad.exe
windows10-2004-x64
8Soundpad/S...ig.ini
windows10-2004-x64
8Soundpad/U...ol.dll
windows10-2004-x64
8Soundpad/U...te.dll
windows10-2004-x64
8Soundpad/i...pt.vdf
windows10-2004-x64
8Soundpad/l...ion.mo
windows10-2004-x64
3Soundpad/s...ed.ps1
windows10-2004-x64
1Soundpad/s...64.dll
windows10-2004-x64
8Analysis
-
max time kernel
1738s -
max time network
1588s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
14/01/2023, 15:28
Behavioral task
behavioral1
Sample
Soundpad/Profile/CRACKED BY Ray_Black/SteamUserID.cfg
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Soundpad/Soundpad.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Soundpad/SteamConfig.ini
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Soundpad/UniteFxControl.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Soundpad/UniteFxUpdate.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Soundpad/installscript.vdf
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Soundpad/languages/cs/translation.mo
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Soundpad/sounds/notify/auto-keys-disabled.ps1
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Soundpad/steam_api64.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
Soundpad/languages/cs/translation.mo
-
Size
48KB
-
MD5
5e8a5fee87f5795b0c3c8d02a6a83eff
-
SHA1
6f86c686a7f29260d7d9b03180488fe668765c47
-
SHA256
ca876dcfb11522ee63977c07e176cd3fdddc8bde374fde53a6a7367680638214
-
SHA512
13fbd8912a361b59bd23b9ecb2ad4a80e0f6e32fc91fcf0befda5d31b182b1f492cd0ca6c095550383e2fb75258d6fc6230ac5f70e34d18e0a4c65e90262a5ec
-
SSDEEP
768:4ZPGJavWhcadx7PW2DH3PdVvW/h7jUUhllX+XVSlngTvDpzWAAePn:4AJaehc6xDFDH3PW/hse+XVSlWpzWA9
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 908 taskmgr.exe Token: SeSystemProfilePrivilege 908 taskmgr.exe Token: SeCreateGlobalPrivilege 908 taskmgr.exe Token: 33 908 taskmgr.exe Token: SeIncBasePriorityPrivilege 908 taskmgr.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe -
Suspicious use of SendNotifyMessage 39 IoCs
pid Process 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe 908 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4844 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Soundpad\languages\cs\translation.mo1⤵
- Modifies registry class
PID:2248
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4844
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:908