Analysis
-
max time kernel
114s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 20:22
Static task
static1
Behavioral task
behavioral1
Sample
044fa6e07fadc7d4e79cc9c41fd9b600N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
044fa6e07fadc7d4e79cc9c41fd9b600N.exe
Resource
win10v2004-20240709-en
General
-
Target
044fa6e07fadc7d4e79cc9c41fd9b600N.exe
-
Size
574KB
-
MD5
044fa6e07fadc7d4e79cc9c41fd9b600
-
SHA1
8a813c15a18cf8849cf0d13547563e828bf950e0
-
SHA256
6809006974702617a89679c25d543ff8dae52a9fec117133a3f5899ce966d91b
-
SHA512
68700c9403e8d919643548fe68cd8c08f4d44e6aa491bc0a3c1540df81a0ff71d57f7f6a7d0c8305c0a992683e85b83cd7dad491949a74b55bf25e71026fff66
-
SSDEEP
12288:zCyEHAWAdljmJqkC3xMX85FSR2f9A08NIX+Vjwd4G/3z1ET4m3Hdsubd:zFhWAfn22m0eD1GPz8HdxR
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Soundcrd.exe -
Executes dropped EXE 3 IoCs
pid Process 2652 Soundcrd.exe 2708 Soundcrd.exe 2572 Soundcrd.exe -
Loads dropped DLL 7 IoCs
pid Process 1908 044fa6e07fadc7d4e79cc9c41fd9b600N.exe 1908 044fa6e07fadc7d4e79cc9c41fd9b600N.exe 1908 044fa6e07fadc7d4e79cc9c41fd9b600N.exe 1908 044fa6e07fadc7d4e79cc9c41fd9b600N.exe 1908 044fa6e07fadc7d4e79cc9c41fd9b600N.exe 2652 Soundcrd.exe 2652 Soundcrd.exe -
resource yara_rule behavioral1/memory/2708-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2708-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2708-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2708-65-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2708-70-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2708-73-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2708-72-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2708-67-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2572-66-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2572-63-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2708-62-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2572-59-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2708-74-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2572-75-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2708-78-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2708-82-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2708-86-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2708-90-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2708-94-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcrosoftt = "C:\\Users\\Admin\\AppData\\Roaming\\Soundcrd.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2652 set thread context of 2708 2652 Soundcrd.exe 35 PID 2652 set thread context of 2572 2652 Soundcrd.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Soundcrd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Soundcrd.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 2572 Soundcrd.exe Token: SeIncreaseQuotaPrivilege 2708 Soundcrd.exe Token: SeSecurityPrivilege 2708 Soundcrd.exe Token: SeTakeOwnershipPrivilege 2708 Soundcrd.exe Token: SeLoadDriverPrivilege 2708 Soundcrd.exe Token: SeSystemProfilePrivilege 2708 Soundcrd.exe Token: SeSystemtimePrivilege 2708 Soundcrd.exe Token: SeProfSingleProcessPrivilege 2708 Soundcrd.exe Token: SeIncBasePriorityPrivilege 2708 Soundcrd.exe Token: SeCreatePagefilePrivilege 2708 Soundcrd.exe Token: SeBackupPrivilege 2708 Soundcrd.exe Token: SeRestorePrivilege 2708 Soundcrd.exe Token: SeShutdownPrivilege 2708 Soundcrd.exe Token: SeDebugPrivilege 2708 Soundcrd.exe Token: SeSystemEnvironmentPrivilege 2708 Soundcrd.exe Token: SeChangeNotifyPrivilege 2708 Soundcrd.exe Token: SeRemoteShutdownPrivilege 2708 Soundcrd.exe Token: SeUndockPrivilege 2708 Soundcrd.exe Token: SeManageVolumePrivilege 2708 Soundcrd.exe Token: SeImpersonatePrivilege 2708 Soundcrd.exe Token: SeCreateGlobalPrivilege 2708 Soundcrd.exe Token: 33 2708 Soundcrd.exe Token: 34 2708 Soundcrd.exe Token: 35 2708 Soundcrd.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1908 044fa6e07fadc7d4e79cc9c41fd9b600N.exe 2652 Soundcrd.exe 2572 Soundcrd.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1908 wrote to memory of 3044 1908 044fa6e07fadc7d4e79cc9c41fd9b600N.exe 31 PID 1908 wrote to memory of 3044 1908 044fa6e07fadc7d4e79cc9c41fd9b600N.exe 31 PID 1908 wrote to memory of 3044 1908 044fa6e07fadc7d4e79cc9c41fd9b600N.exe 31 PID 1908 wrote to memory of 3044 1908 044fa6e07fadc7d4e79cc9c41fd9b600N.exe 31 PID 3044 wrote to memory of 2748 3044 cmd.exe 33 PID 3044 wrote to memory of 2748 3044 cmd.exe 33 PID 3044 wrote to memory of 2748 3044 cmd.exe 33 PID 3044 wrote to memory of 2748 3044 cmd.exe 33 PID 1908 wrote to memory of 2652 1908 044fa6e07fadc7d4e79cc9c41fd9b600N.exe 34 PID 1908 wrote to memory of 2652 1908 044fa6e07fadc7d4e79cc9c41fd9b600N.exe 34 PID 1908 wrote to memory of 2652 1908 044fa6e07fadc7d4e79cc9c41fd9b600N.exe 34 PID 1908 wrote to memory of 2652 1908 044fa6e07fadc7d4e79cc9c41fd9b600N.exe 34 PID 2652 wrote to memory of 2708 2652 Soundcrd.exe 35 PID 2652 wrote to memory of 2708 2652 Soundcrd.exe 35 PID 2652 wrote to memory of 2708 2652 Soundcrd.exe 35 PID 2652 wrote to memory of 2708 2652 Soundcrd.exe 35 PID 2652 wrote to memory of 2708 2652 Soundcrd.exe 35 PID 2652 wrote to memory of 2708 2652 Soundcrd.exe 35 PID 2652 wrote to memory of 2708 2652 Soundcrd.exe 35 PID 2652 wrote to memory of 2708 2652 Soundcrd.exe 35 PID 2652 wrote to memory of 2708 2652 Soundcrd.exe 35 PID 2652 wrote to memory of 2572 2652 Soundcrd.exe 36 PID 2652 wrote to memory of 2572 2652 Soundcrd.exe 36 PID 2652 wrote to memory of 2572 2652 Soundcrd.exe 36 PID 2652 wrote to memory of 2572 2652 Soundcrd.exe 36 PID 2652 wrote to memory of 2572 2652 Soundcrd.exe 36 PID 2652 wrote to memory of 2572 2652 Soundcrd.exe 36 PID 2652 wrote to memory of 2572 2652 Soundcrd.exe 36 PID 2652 wrote to memory of 2572 2652 Soundcrd.exe 36 PID 2652 wrote to memory of 2572 2652 Soundcrd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\044fa6e07fadc7d4e79cc9c41fd9b600N.exe"C:\Users\Admin\AppData\Local\Temp\044fa6e07fadc7d4e79cc9c41fd9b600N.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\dQtJS.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoftt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Soundcrd.exe" /f3⤵
- Adds Run key to start application
PID:2748
-
-
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exe"C:\Users\Admin\AppData\Roaming\Soundcrd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2572
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139B
MD5173bcce4810d4901872d0ef4f0bfea4e
SHA1561b03fdfe68b6419fddf57f32e1aab9a6126a2f
SHA25610ea37eceabbe80fe9814280b66b957636951dbeeed18a9b4d50a1d24a6f1d1d
SHA5122401e0a5e3f7bf590a0767449da2249d09717e8c1cb71a7475e81d9615580001cfc38705cd1a5b4edc33f7df043bf195e28e4a5442a32bc879dffc6473bd545e
-
Filesize
574KB
MD5976131ee8ac96ad6b4ebf942b67ac360
SHA148db9fb6ca20e6cde9deef0cca04e5856ac72ec7
SHA256da1fe2e5a1ede7a0436e6956ceda87bcbff97ae599fb8b454fbeb5d84a7fe11e
SHA512865db360bdd36d9174744ffdbc0536ed7722c4b61494e434432906bc2515d139e6392e2f53e4d580ac346ebb13a9813fd3f849e032a0fc09159e7b4799231c61