ac17a59eff4e1d771db808a5f308b98ef8df866765bfa180a5c1f1c722c2afe7

Analysis

max time kernel
150s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/05/2023, 15:39

Target

SoundPad/SoundPad/languages/nl/translation.mo
Size

48KB
MD5

0046ea807dc7df2742c6c932ebe71e84
SHA1

4ee9872acb8b2581f1cb91167f18889062f0207b
SHA256

e57b67e9989d3d86d835cb7164e7b9704638509c60e6e89170829f26915bbec5
SHA512

11cc8aa7bc39199fb75d1c9b9b6e81a8391548aaf8d7f1d83e143b7002dbc1fa537f1a24f77829fb009e89bdaaccef515f85b57028dbb135e3f43cf70fdd5831
SSDEEP

1536:4AJUTNlDFDH3PW/hKUKN6l2pGgZhSql/mj:RCPBbUKN6l2pGgZkqle

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\mo_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.mo	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.mo\ = "mo_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\mo_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\mo_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\mo_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\mo_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\mo_auto_file\shell\Read\command	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1196	1948	cmd.exe	27
PID 1948 wrote to memory of 1196	1948	cmd.exe	27
PID 1948 wrote to memory of 1196	1948	cmd.exe	27
PID 1196 wrote to memory of 1352	1196	rundll32.exe	28
PID 1196 wrote to memory of 1352	1196	rundll32.exe	28
PID 1196 wrote to memory of 1352	1196	rundll32.exe	28
PID 1196 wrote to memory of 1352	1196	rundll32.exe	28

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SoundPad\SoundPad\languages\nl\translation.mo
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SoundPad\SoundPad\languages\nl\translation.mo
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SoundPad\SoundPad\languages\nl\translation.mo"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1352

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact