Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7Soundpad_M...m4.rar
windows7-x64
7Soundpad_M...m4.rar
windows10-2004-x64
7Soundpad M...ID.cfg
windows7-x64
3Soundpad M...ID.cfg
windows10-2004-x64
3Soundpad M...me.txt
windows7-x64
1Soundpad M...me.txt
windows10-2004-x64
1Soundpad M...ad.exe
windows7-x64
7Soundpad M...ad.exe
windows10-2004-x64
7Soundpad M...ig.ini
windows7-x64
1Soundpad M...ig.ini
windows10-2004-x64
1Soundpad M...ol.dll
windows7-x64
1Soundpad M...ol.dll
windows10-2004-x64
1Soundpad M...te.dll
windows7-x64
1Soundpad M...te.dll
windows10-2004-x64
1Soundpad M...pt.vdf
windows7-x64
3Soundpad M...pt.vdf
windows10-2004-x64
3Soundpad M...ion.mo
windows7-x64
3Soundpad M...ion.mo
windows10-2004-x64
3Soundpad M...ss.mp3
windows7-x64
1Soundpad M...ss.mp3
windows10-2004-x64
6Soundpad M...ue.mp3
windows7-x64
1Soundpad M...ue.mp3
windows10-2004-x64
6Soundpad M...rk.mp3
windows7-x64
1Soundpad M...rk.mp3
windows10-2004-x64
6Soundpad M...ed.m4a
windows7-x64
1Soundpad M...ed.m4a
windows10-2004-x64
6Soundpad M...ed.m4a
windows7-x64
1Soundpad M...ed.m4a
windows10-2004-x64
6Soundpad M...lt.m4a
windows7-x64
1Soundpad M...lt.m4a
windows10-2004-x64
6Soundpad M...ed.m4a
windows7-x64
1Soundpad M...ed.m4a
windows10-2004-x64
6Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07/04/2024, 18:23
Behavioral task
behavioral1
Sample
Soundpad_Mohamed_m4.rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Soundpad_Mohamed_m4.rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Soundpad Mohamed m4/Profile/CRACKED BY Ray_Black/SteamUserID.cfg
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Soundpad Mohamed m4/Profile/CRACKED BY Ray_Black/SteamUserID.cfg
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Soundpad Mohamed m4/Readme.txt
Resource
win7-20240319-en
Behavioral task
behavioral6
Sample
Soundpad Mohamed m4/Readme.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Soundpad Mohamed m4/Soundpad.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Soundpad Mohamed m4/Soundpad.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Soundpad Mohamed m4/SteamConfig.ini
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Soundpad Mohamed m4/SteamConfig.ini
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Soundpad Mohamed m4/UniteFxControl.dll
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
Soundpad Mohamed m4/UniteFxControl.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Soundpad Mohamed m4/UniteFxUpdate.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Soundpad Mohamed m4/UniteFxUpdate.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
Soundpad Mohamed m4/installscript.vdf
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Soundpad Mohamed m4/installscript.vdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Soundpad Mohamed m4/languages/es_ES/translation.mo
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
Soundpad Mohamed m4/languages/es_ES/translation.mo
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Soundpad Mohamed m4/sounds/ba dum tss.mp3
Resource
win7-20240319-en
Behavioral task
behavioral20
Sample
Soundpad Mohamed m4/sounds/ba dum tss.mp3
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
Soundpad Mohamed m4/sounds/cue.mp3
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Soundpad Mohamed m4/sounds/cue.mp3
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
Soundpad Mohamed m4/sounds/firework.mp3
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Soundpad Mohamed m4/sounds/firework.mp3
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
Soundpad Mohamed m4/sounds/notify/auto-keys-disabled.m4a
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Soundpad Mohamed m4/sounds/notify/auto-keys-disabled.m4a
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
Soundpad Mohamed m4/sounds/notify/auto-keys-enabled.m4a
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Soundpad Mohamed m4/sounds/notify/auto-keys-enabled.m4a
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
Soundpad Mohamed m4/sounds/notify/default.m4a
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
Soundpad Mohamed m4/sounds/notify/default.m4a
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Soundpad Mohamed m4/sounds/notify/disabled.m4a
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Soundpad Mohamed m4/sounds/notify/disabled.m4a
Resource
win10v2004-20240226-en
General
-
Target
Soundpad Mohamed m4/sounds/notify/auto-keys-enabled.m4a
-
Size
27KB
-
MD5
9d26118ea89fbfcb98cc2426f7dd7e21
-
SHA1
2c84658a3d46ed5a091da0c671c7ef22ebb83da4
-
SHA256
fef59bde5cdafa50f43052e292f5f8d9c714aea34fa9a5865c11771446e0695b
-
SHA512
d1c1e8203d29e06ed713d483b8d01b731376a219c642b80b75d99208eb6b6028bd351b34e32019b9f366050157cae07020a3fd639940b01ad9c120c2aa6e5c77
-
SSDEEP
768:O2kT5o5NqVvwkePSBB9lGs3/AKEV8Djbks7K:O2kF8mqSBJ13/AgK
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 4756 unregmp2.exe Token: SeCreatePagefilePrivilege 4756 unregmp2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3284 wrote to memory of 3112 3284 wmplayer.exe 85 PID 3284 wrote to memory of 3112 3284 wmplayer.exe 85 PID 3284 wrote to memory of 3112 3284 wmplayer.exe 85 PID 3284 wrote to memory of 2608 3284 wmplayer.exe 86 PID 3284 wrote to memory of 2608 3284 wmplayer.exe 86 PID 3284 wrote to memory of 2608 3284 wmplayer.exe 86 PID 2608 wrote to memory of 4756 2608 unregmp2.exe 87 PID 2608 wrote to memory of 4756 2608 unregmp2.exe 87
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Soundpad Mohamed m4\sounds\notify\auto-keys-enabled.m4a"1⤵
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Soundpad Mohamed m4\sounds\notify\auto-keys-enabled.m4a"2⤵PID:3112
-
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4756
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
MD5c7ca2711d80cd052da0d98ce7e6dec6b
SHA1b051f0425224cf70e3a10636c21bf113bd1cd301
SHA256a0c1147d7f6adb99735dc3fa370ef6fb8e6ddd3687eb7afd677af5c71df6957f
SHA512487b985fe8a4fb9a0cb59ffb0b485133e0b089115e36b9bc3f0cbb64babd899daf1b282a9554b45874a59a4c7d9c07db370650c28a5731bde50f52e66a0fc0af
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
Filesize
1KB
MD5c45ab4efc36d4129586f3bf62fca67d6
SHA1a5d8441b4817f479d9cb7710949c5bc01f1a0cb2
SHA2561527549a5f6d65af788ed8c26bb11e4b6fe8e354fec75970035bf677e2f87a66
SHA51297a8ce5c93b5a716465ce2485755af8c0255c1205329ab9ed817529cc4b12e1946a29c0ff3514c30717d3eb150275b85b80cf5bc35d21f82b50265f8a31535e9