Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7Soundpad_M...m4.rar
windows7-x64
7Soundpad_M...m4.rar
windows10-2004-x64
7Soundpad M...ID.cfg
windows7-x64
3Soundpad M...ID.cfg
windows10-2004-x64
3Soundpad M...me.txt
windows7-x64
1Soundpad M...me.txt
windows10-2004-x64
1Soundpad M...ad.exe
windows7-x64
7Soundpad M...ad.exe
windows10-2004-x64
7Soundpad M...ig.ini
windows7-x64
1Soundpad M...ig.ini
windows10-2004-x64
1Soundpad M...ol.dll
windows7-x64
1Soundpad M...ol.dll
windows10-2004-x64
1Soundpad M...te.dll
windows7-x64
1Soundpad M...te.dll
windows10-2004-x64
1Soundpad M...pt.vdf
windows7-x64
3Soundpad M...pt.vdf
windows10-2004-x64
3Soundpad M...ion.mo
windows7-x64
3Soundpad M...ion.mo
windows10-2004-x64
3Soundpad M...ss.mp3
windows7-x64
1Soundpad M...ss.mp3
windows10-2004-x64
6Soundpad M...ue.mp3
windows7-x64
1Soundpad M...ue.mp3
windows10-2004-x64
6Soundpad M...rk.mp3
windows7-x64
1Soundpad M...rk.mp3
windows10-2004-x64
6Soundpad M...ed.m4a
windows7-x64
1Soundpad M...ed.m4a
windows10-2004-x64
6Soundpad M...ed.m4a
windows7-x64
1Soundpad M...ed.m4a
windows10-2004-x64
6Soundpad M...lt.m4a
windows7-x64
1Soundpad M...lt.m4a
windows10-2004-x64
6Soundpad M...ed.m4a
windows7-x64
1Soundpad M...ed.m4a
windows10-2004-x64
6Analysis
-
max time kernel
128s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/04/2024, 18:23
Behavioral task
behavioral1
Sample
Soundpad_Mohamed_m4.rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Soundpad_Mohamed_m4.rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Soundpad Mohamed m4/Profile/CRACKED BY Ray_Black/SteamUserID.cfg
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Soundpad Mohamed m4/Profile/CRACKED BY Ray_Black/SteamUserID.cfg
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Soundpad Mohamed m4/Readme.txt
Resource
win7-20240319-en
Behavioral task
behavioral6
Sample
Soundpad Mohamed m4/Readme.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Soundpad Mohamed m4/Soundpad.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Soundpad Mohamed m4/Soundpad.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Soundpad Mohamed m4/SteamConfig.ini
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Soundpad Mohamed m4/SteamConfig.ini
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Soundpad Mohamed m4/UniteFxControl.dll
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
Soundpad Mohamed m4/UniteFxControl.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Soundpad Mohamed m4/UniteFxUpdate.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Soundpad Mohamed m4/UniteFxUpdate.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
Soundpad Mohamed m4/installscript.vdf
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Soundpad Mohamed m4/installscript.vdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Soundpad Mohamed m4/languages/es_ES/translation.mo
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
Soundpad Mohamed m4/languages/es_ES/translation.mo
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Soundpad Mohamed m4/sounds/ba dum tss.mp3
Resource
win7-20240319-en
Behavioral task
behavioral20
Sample
Soundpad Mohamed m4/sounds/ba dum tss.mp3
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
Soundpad Mohamed m4/sounds/cue.mp3
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Soundpad Mohamed m4/sounds/cue.mp3
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
Soundpad Mohamed m4/sounds/firework.mp3
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Soundpad Mohamed m4/sounds/firework.mp3
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
Soundpad Mohamed m4/sounds/notify/auto-keys-disabled.m4a
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Soundpad Mohamed m4/sounds/notify/auto-keys-disabled.m4a
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
Soundpad Mohamed m4/sounds/notify/auto-keys-enabled.m4a
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Soundpad Mohamed m4/sounds/notify/auto-keys-enabled.m4a
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
Soundpad Mohamed m4/sounds/notify/default.m4a
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
Soundpad Mohamed m4/sounds/notify/default.m4a
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Soundpad Mohamed m4/sounds/notify/disabled.m4a
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Soundpad Mohamed m4/sounds/notify/disabled.m4a
Resource
win10v2004-20240226-en
General
-
Target
Soundpad_Mohamed_m4.rar
-
Size
6.8MB
-
MD5
cf8dccf33ebaf63ea18d00bcb24bc5b2
-
SHA1
cfaeaebfe0cd7c40d0ac9fbd8065a7da5c9f0241
-
SHA256
703c98b215698a72cb6de36c33e66c821a470a52565ba79da213243d0aed458b
-
SHA512
75103f5309e5be1bf6c9585129b2c3c694762bca753c6bd2ac4e829bf4c22ade107bcbf0c94458eeff14836f88b374a22daf4a4a344e7f7c3ac9402e799441de
-
SSDEEP
196608:Ke8fPDaxJLrQo87HeDxWeHnCvozDOv9wKuLZTFj0:Ke83cJ47HGlCvQ0uzk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2676 Soundpad.exe -
Loads dropped DLL 1 IoCs
pid Process 2644 7zFM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 324 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2644 7zFM.exe 2644 7zFM.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2644 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 2644 7zFM.exe Token: 35 2644 7zFM.exe Token: SeSecurityPrivilege 2644 7zFM.exe Token: SeSecurityPrivilege 2644 7zFM.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2644 7zFM.exe 2644 7zFM.exe 2644 7zFM.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 840 wrote to memory of 2644 840 cmd.exe 29 PID 840 wrote to memory of 2644 840 cmd.exe 29 PID 840 wrote to memory of 2644 840 cmd.exe 29 PID 2644 wrote to memory of 324 2644 7zFM.exe 32 PID 2644 wrote to memory of 324 2644 7zFM.exe 32 PID 2644 wrote to memory of 324 2644 7zFM.exe 32 PID 2644 wrote to memory of 2676 2644 7zFM.exe 33 PID 2644 wrote to memory of 2676 2644 7zFM.exe 33 PID 2644 wrote to memory of 2676 2644 7zFM.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Soundpad_Mohamed_m4.rar1⤵
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Soundpad_Mohamed_m4.rar"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO45A0CE08\Readme.txt3⤵
- Opens file in notepad (likely ransom note)
PID:324
-
-
C:\Users\Admin\AppData\Local\Temp\7zO45AACD18\Soundpad.exe"C:\Users\Admin\AppData\Local\Temp\7zO45AACD18\Soundpad.exe"3⤵
- Executes dropped EXE
PID:2676
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
247B
MD575e1c9f2df88bb43b0171a9cc4869230
SHA16153db66cce38bbebfe6b42b42ed65f9afb5ed33
SHA256e8cd560f199c8e666ec1cfd460e444479eb2f1360040376a4eb03c3c14316b20
SHA5124a5f57f00889fcb55ec2c7a4204bdd4857ab6bfc41050e50a18452515c31e0dc2dd87aca2bda11840f463ba24c044b1e03a53d4ebe48f8f809ff07b3ee3703b9
-
Filesize
10.9MB
MD50ae4f60d72e0d1c159505500b8a08ebb
SHA1bb352dafd3c3ebebb4414b799010fe5ebddbef44
SHA256ed3371229647ef876b45cb5940e48b461df58d4e68ad4932f5877eba90c8d379
SHA51288495911df544a04a4e09828ae10b57d3d945c41d6e28964c2d4d077afa43fec1c82a8ff6dcce57a3c7b9e5d02d1e47f800f557b022866f5f7be4a2db9b07536