Analysis
-
max time kernel
129s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 20:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1c4091c6331d0a0a583d38b68dbb5713.exe
Resource
win7-20231215-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
1c4091c6331d0a0a583d38b68dbb5713.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
1c4091c6331d0a0a583d38b68dbb5713.exe
-
Size
27KB
-
MD5
1c4091c6331d0a0a583d38b68dbb5713
-
SHA1
800f9608db9a77155c552c0bdb7db9aa1a86de0f
-
SHA256
c068db2bc2b9701d6e2bb4c393f453f28e93458502cd0583af8fc5a8968c5f06
-
SHA512
af86108f2d12b6811d38c7e48013dedadba914b220da37c1c01fec5e531cf490e222b88687f958739c59c5bcf11c1a001494d6dee9f173a5e1edf2af599b95cb
-
SSDEEP
384:I9SmAkbQdOkP8EUPGgGtqYqvZq5+mf71ufPqVn3G/KJbvc8QK9fN1U:NmAGkEJGgSqvZq5JBufo31Jbk8ZN1U
Score
8/10
Malware Config
Signatures
-
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravtimer.exe S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FESCUE.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ECENGINE.EXE S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WEBSCANX.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VETTRAY.EXE S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TDS2-98.EXE S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IBMASN.EXE S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPTC32.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NISUM.EXE S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IFACE.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BLACKICE.EXE S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWUPD32.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVNT.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IBMAVSP.EXE S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\APVXDWIN.EXE S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAVCL.EXE S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav.exe S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IAMAPP.EXE S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\N32SCANW.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IOMON98.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSHWIN32.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMC.EXE S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVAPW32.EXE S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLEANER3.EXE S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BLACKD.EXE S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVwsc.exe\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPROT.EXE S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ECENGINE.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPM.EXE S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANPM.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKSERV.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCCWIN98.EXE S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NUPGRADE.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICSUPPNT.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICLOAD95.EXE S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXPWATCH.EXE S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\APVXDWIN.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAVtimer.exe S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SPHINX.EXE S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFIAUDIT.EXE S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAVmonD.exe\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVW32.EXE S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLAW95CF.EXE S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVsrvXP.exe S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SWEEP95.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVSCHED32.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_AVP32.EXE S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZONEALARM.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCAN32.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAVW.EXE S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\N32SCANW.EXE S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLAW95CF.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SAFEWEB.EXE S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ESAFE.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DVP95_0.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logo_1.exe\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ÐÞ¸´¹¤¾ß.exe S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSSTAT.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSCAN40.EXE\Debugger = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE -
Deletes itself 1 IoCs
pid Process 2748 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1180 S0UNDMAN.EXE -
Loads dropped DLL 2 IoCs
pid Process 2452 1c4091c6331d0a0a583d38b68dbb5713.exe 2452 1c4091c6331d0a0a583d38b68dbb5713.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TBMonEx = "C:\\Windows\\system\\S0UNDMAN.EXE" S0UNDMAN.EXE -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: S0UNDMAN.EXE File opened (read-only) \??\J: S0UNDMAN.EXE File opened (read-only) \??\L: S0UNDMAN.EXE File opened (read-only) \??\R: S0UNDMAN.EXE File opened (read-only) \??\T: S0UNDMAN.EXE File opened (read-only) \??\I: S0UNDMAN.EXE File opened (read-only) \??\O: S0UNDMAN.EXE File opened (read-only) \??\P: S0UNDMAN.EXE File opened (read-only) \??\B: S0UNDMAN.EXE File opened (read-only) \??\M: S0UNDMAN.EXE File opened (read-only) \??\Q: S0UNDMAN.EXE File opened (read-only) \??\S: S0UNDMAN.EXE File opened (read-only) \??\U: S0UNDMAN.EXE File opened (read-only) \??\W: S0UNDMAN.EXE File opened (read-only) \??\Y: S0UNDMAN.EXE File opened (read-only) \??\G: S0UNDMAN.EXE File opened (read-only) \??\H: S0UNDMAN.EXE File opened (read-only) \??\K: S0UNDMAN.EXE File opened (read-only) \??\N: S0UNDMAN.EXE File opened (read-only) \??\V: S0UNDMAN.EXE File opened (read-only) \??\X: S0UNDMAN.EXE File opened (read-only) \??\Z: S0UNDMAN.EXE -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf S0UNDMAN.EXE File created C:\autorun.inf S0UNDMAN.EXE File opened for modification F:\autorun.inf S0UNDMAN.EXE File created F:\autorun.inf S0UNDMAN.EXE -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Windows Media Player\WMPDMC.exe S0UNDMAN.EXE File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe S0UNDMAN.EXE File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe S0UNDMAN.EXE File opened for modification C:\Program Files\7-Zip\7z.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Windows Media Player\wmprph.exe S0UNDMAN.EXE File opened for modification C:\Program Files\7-Zip\7zG.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Windows Media Player\WMPSideShowGadget.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Windows Journal\Journal.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Java\jre7\bin\java.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe S0UNDMAN.EXE File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe S0UNDMAN.EXE File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Windows Mail\wab.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Windows Mail\wabmig.exe S0UNDMAN.EXE File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe S0UNDMAN.EXE File opened for modification C:\Program Files (x86)\Windows Sidebar\sidebar.exe S0UNDMAN.EXE File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe S0UNDMAN.EXE File opened for modification C:\Program Files (x86)\Windows Media Player\WMPDMC.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe S0UNDMAN.EXE File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe S0UNDMAN.EXE File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe S0UNDMAN.EXE -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\S0UNDMAN.EXE 1c4091c6331d0a0a583d38b68dbb5713.exe File created C:\Windows\system\S0UNDMAN.EXE 1c4091c6331d0a0a583d38b68dbb5713.exe -
Modifies Control Panel 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Cursors\ S0UNDMAN.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Cursors\AppStarting = "%SYSTEMROOT%\\Cursors\\vanisher.ani" S0UNDMAN.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Cursors\AppStarting S0UNDMAN.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2452 1c4091c6331d0a0a583d38b68dbb5713.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2452 1c4091c6331d0a0a583d38b68dbb5713.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2452 wrote to memory of 1180 2452 1c4091c6331d0a0a583d38b68dbb5713.exe 28 PID 2452 wrote to memory of 1180 2452 1c4091c6331d0a0a583d38b68dbb5713.exe 28 PID 2452 wrote to memory of 1180 2452 1c4091c6331d0a0a583d38b68dbb5713.exe 28 PID 2452 wrote to memory of 1180 2452 1c4091c6331d0a0a583d38b68dbb5713.exe 28 PID 2452 wrote to memory of 2748 2452 1c4091c6331d0a0a583d38b68dbb5713.exe 29 PID 2452 wrote to memory of 2748 2452 1c4091c6331d0a0a583d38b68dbb5713.exe 29 PID 2452 wrote to memory of 2748 2452 1c4091c6331d0a0a583d38b68dbb5713.exe 29 PID 2452 wrote to memory of 2748 2452 1c4091c6331d0a0a583d38b68dbb5713.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c4091c6331d0a0a583d38b68dbb5713.exe"C:\Users\Admin\AppData\Local\Temp\1c4091c6331d0a0a583d38b68dbb5713.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\system\S0UNDMAN.EXEC:\Windows\system\S0UNDMAN.EXE2⤵
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Modifies Control Panel
PID:1180
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1c4091c6331d0a0a583d38b68dbb5713.exe.bat""2⤵
- Deletes itself
PID:2748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258B
MD539746420bbce7b7300f0ac4245d977f6
SHA1d20aa6f85b67d0d7db0a70f7c54295a62bb6cb8c
SHA256b258e88d1a25478248a7623f7427554bcc549bc4e2f867c6d76cfce02292ee1b
SHA51223c702ca336fa85a6c300f920afee45000a265e5f4106abbee62d68278a059e08a8c79c9349d98b75c1a9768233aeab9690fee38a24b8f1e31c17e73efa9e28b
-
Filesize
27KB
MD51c4091c6331d0a0a583d38b68dbb5713
SHA1800f9608db9a77155c552c0bdb7db9aa1a86de0f
SHA256c068db2bc2b9701d6e2bb4c393f453f28e93458502cd0583af8fc5a8968c5f06
SHA512af86108f2d12b6811d38c7e48013dedadba914b220da37c1c01fec5e531cf490e222b88687f958739c59c5bcf11c1a001494d6dee9f173a5e1edf2af599b95cb