Analysis
-
max time kernel
112s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 20:22
Static task
static1
Behavioral task
behavioral1
Sample
044fa6e07fadc7d4e79cc9c41fd9b600N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
044fa6e07fadc7d4e79cc9c41fd9b600N.exe
Resource
win10v2004-20240709-en
General
-
Target
044fa6e07fadc7d4e79cc9c41fd9b600N.exe
-
Size
574KB
-
MD5
044fa6e07fadc7d4e79cc9c41fd9b600
-
SHA1
8a813c15a18cf8849cf0d13547563e828bf950e0
-
SHA256
6809006974702617a89679c25d543ff8dae52a9fec117133a3f5899ce966d91b
-
SHA512
68700c9403e8d919643548fe68cd8c08f4d44e6aa491bc0a3c1540df81a0ff71d57f7f6a7d0c8305c0a992683e85b83cd7dad491949a74b55bf25e71026fff66
-
SSDEEP
12288:zCyEHAWAdljmJqkC3xMX85FSR2f9A08NIX+Vjwd4G/3z1ET4m3Hdsubd:zFhWAfn22m0eD1GPz8HdxR
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Soundcrd.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation 044fa6e07fadc7d4e79cc9c41fd9b600N.exe -
Executes dropped EXE 3 IoCs
pid Process 348 Soundcrd.exe 224 Soundcrd.exe 3252 Soundcrd.exe -
resource yara_rule behavioral2/memory/224-33-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/224-36-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/224-37-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/224-40-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/224-50-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/224-49-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/224-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/224-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/224-52-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3252-48-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3252-45-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3252-44-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3252-38-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/224-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3252-56-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/224-59-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/224-63-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/224-67-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/224-71-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/224-75-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoftt = "C:\\Users\\Admin\\AppData\\Roaming\\Soundcrd.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 348 set thread context of 224 348 Soundcrd.exe 91 PID 348 set thread context of 3252 348 Soundcrd.exe 92 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Soundcrd.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Soundcrd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Soundcrd.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 3252 Soundcrd.exe Token: SeIncreaseQuotaPrivilege 224 Soundcrd.exe Token: SeSecurityPrivilege 224 Soundcrd.exe Token: SeTakeOwnershipPrivilege 224 Soundcrd.exe Token: SeLoadDriverPrivilege 224 Soundcrd.exe Token: SeSystemProfilePrivilege 224 Soundcrd.exe Token: SeSystemtimePrivilege 224 Soundcrd.exe Token: SeProfSingleProcessPrivilege 224 Soundcrd.exe Token: SeIncBasePriorityPrivilege 224 Soundcrd.exe Token: SeCreatePagefilePrivilege 224 Soundcrd.exe Token: SeBackupPrivilege 224 Soundcrd.exe Token: SeRestorePrivilege 224 Soundcrd.exe Token: SeShutdownPrivilege 224 Soundcrd.exe Token: SeDebugPrivilege 224 Soundcrd.exe Token: SeSystemEnvironmentPrivilege 224 Soundcrd.exe Token: SeChangeNotifyPrivilege 224 Soundcrd.exe Token: SeRemoteShutdownPrivilege 224 Soundcrd.exe Token: SeUndockPrivilege 224 Soundcrd.exe Token: SeManageVolumePrivilege 224 Soundcrd.exe Token: SeImpersonatePrivilege 224 Soundcrd.exe Token: SeCreateGlobalPrivilege 224 Soundcrd.exe Token: 33 224 Soundcrd.exe Token: 34 224 Soundcrd.exe Token: 35 224 Soundcrd.exe Token: 36 224 Soundcrd.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2764 044fa6e07fadc7d4e79cc9c41fd9b600N.exe 348 Soundcrd.exe 3252 Soundcrd.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2764 wrote to memory of 3948 2764 044fa6e07fadc7d4e79cc9c41fd9b600N.exe 86 PID 2764 wrote to memory of 3948 2764 044fa6e07fadc7d4e79cc9c41fd9b600N.exe 86 PID 2764 wrote to memory of 3948 2764 044fa6e07fadc7d4e79cc9c41fd9b600N.exe 86 PID 3948 wrote to memory of 2552 3948 cmd.exe 89 PID 3948 wrote to memory of 2552 3948 cmd.exe 89 PID 3948 wrote to memory of 2552 3948 cmd.exe 89 PID 2764 wrote to memory of 348 2764 044fa6e07fadc7d4e79cc9c41fd9b600N.exe 90 PID 2764 wrote to memory of 348 2764 044fa6e07fadc7d4e79cc9c41fd9b600N.exe 90 PID 2764 wrote to memory of 348 2764 044fa6e07fadc7d4e79cc9c41fd9b600N.exe 90 PID 348 wrote to memory of 224 348 Soundcrd.exe 91 PID 348 wrote to memory of 224 348 Soundcrd.exe 91 PID 348 wrote to memory of 224 348 Soundcrd.exe 91 PID 348 wrote to memory of 224 348 Soundcrd.exe 91 PID 348 wrote to memory of 224 348 Soundcrd.exe 91 PID 348 wrote to memory of 224 348 Soundcrd.exe 91 PID 348 wrote to memory of 224 348 Soundcrd.exe 91 PID 348 wrote to memory of 224 348 Soundcrd.exe 91 PID 348 wrote to memory of 3252 348 Soundcrd.exe 92 PID 348 wrote to memory of 3252 348 Soundcrd.exe 92 PID 348 wrote to memory of 3252 348 Soundcrd.exe 92 PID 348 wrote to memory of 3252 348 Soundcrd.exe 92 PID 348 wrote to memory of 3252 348 Soundcrd.exe 92 PID 348 wrote to memory of 3252 348 Soundcrd.exe 92 PID 348 wrote to memory of 3252 348 Soundcrd.exe 92 PID 348 wrote to memory of 3252 348 Soundcrd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\044fa6e07fadc7d4e79cc9c41fd9b600N.exe"C:\Users\Admin\AppData\Local\Temp\044fa6e07fadc7d4e79cc9c41fd9b600N.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uxhgp.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoftt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Soundcrd.exe" /f3⤵
- Adds Run key to start application
PID:2552
-
-
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exe"C:\Users\Admin\AppData\Roaming\Soundcrd.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:224
-
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3252
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139B
MD5173bcce4810d4901872d0ef4f0bfea4e
SHA1561b03fdfe68b6419fddf57f32e1aab9a6126a2f
SHA25610ea37eceabbe80fe9814280b66b957636951dbeeed18a9b4d50a1d24a6f1d1d
SHA5122401e0a5e3f7bf590a0767449da2249d09717e8c1cb71a7475e81d9615580001cfc38705cd1a5b4edc33f7df043bf195e28e4a5442a32bc879dffc6473bd545e
-
Filesize
574KB
MD5f7d37e8b8346929983eb89ab637ab931
SHA16c315b49443047f49d54a587788bd961fb6bd19c
SHA25652b44bb721db755b21d70b776c9041d8f1f00d282f9cac1817d92da0da4ecb29
SHA5123aa18fc732d46fd505d217349ec400144704831eaac87ae062a37749465c733be31e9d474e9ad4bc401734e5f30cc5e55a5ec3a6a07c5508cb867709f23bf0da