Overview
overview
7Static
static
7SoundPad/Soundpad.exe
windows7-x64
SoundPad/Soundpad.exe
windows10-2004-x64
SoundPad/U...ol.dll
windows7-x64
1SoundPad/U...ol.dll
windows10-2004-x64
1SoundPad/U...te.dll
windows7-x64
1SoundPad/U...te.dll
windows10-2004-x64
1SoundPad/s...64.dll
windows7-x64
7SoundPad/s...64.dll
windows10-2004-x64
7Analysis
-
max time kernel
6s -
max time network
9s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-09-2024 12:43
Behavioral task
behavioral1
Sample
SoundPad/Soundpad.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
SoundPad/Soundpad.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
SoundPad/UniteFxControl.dll
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
SoundPad/UniteFxControl.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
SoundPad/UniteFxUpdate.dll
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
SoundPad/UniteFxUpdate.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
SoundPad/steam_api64.dll
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
SoundPad/steam_api64.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
SoundPad/Soundpad.exe
-
Size
10.9MB
-
MD5
0ae4f60d72e0d1c159505500b8a08ebb
-
SHA1
bb352dafd3c3ebebb4414b799010fe5ebddbef44
-
SHA256
ed3371229647ef876b45cb5940e48b461df58d4e68ad4932f5877eba90c8d379
-
SHA512
88495911df544a04a4e09828ae10b57d3d945c41d6e28964c2d4d077afa43fec1c82a8ff6dcce57a3c7b9e5d02d1e47f800f557b022866f5f7be4a2db9b07536
-
SSDEEP
196608:fDRlger67uOemwy1LR/XU3gmsRM0wWM+wC89ooEvu:UerSwAVE3XsRMiJpsf
Score
7/10
Malware Config
Signatures
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Loads dropped DLL 2 IoCs
pid Process 2244 regsvr32.exe 484 regsvr32.exe -
resource yara_rule behavioral1/memory/2168-1-0x000007FEF5220000-0x000007FEF6270000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\UniteFx.dll Soundpad.exe File opened for modification C:\Windows\system32\UniteFx.dll Soundpad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinInputConnections = "1" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.spl\PerceivedType = "audio" Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Soundpad\shell Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.spl\OpenWithList\ehshell.exe\ Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.spl\OpenWithProgids Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Soundpad\URL Protocol Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Soundpad.Soundlist\ = "Soundpad sound list" Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.spl\ = "Soundpad.Soundlist" Soundpad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinorVersion = "6" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\Flags = "14" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\Copyright = "Copyright (C) 2016-2019 Leppsoft" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\NumAPOInterfaces = "1" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.spl\OpenWithProgids\Soundpad.Soundlist Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Soundpad\ = "URL:Soundpad Protocol" Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Soundpad.Soundlist\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SoundPad\\Soundpad.exe,1" Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.spl\OpenWithList\ehshell.exe Soundpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxInputConnections = "1" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\ Soundpad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinorVersion = "6" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\Flags = "14" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Soundpad.Soundlist\\DefaultIcon Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Soundpad\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\SoundPad\\Soundpad.exe\" -c \"%1\"" Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Soundpad\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SoundPad\\Soundpad.exe,0" Soundpad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxInstances = "4294967295" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Soundpad.Soundlist\shell\open\command Soundpad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MajorVersion = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinOutputConnections = "1" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Soundpad.Soundlist\shell\open Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Soundpad Soundpad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MajorVersion = "1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\InprocServer32\ = "C:\\Windows\\system32\\UniteFx.dll" Soundpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\FriendlyName = "UniteFx" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinInputConnections = "1" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Soundpad.Soundlist\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\SoundPad\\Soundpad.exe\" \"%1\"" Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Soundpad\shell\open\command Soundpad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\APOInterface0 = "{FD7F2B29-24D0-4B5C-B177-592C39F9CA10}" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\NumAPOInterfaces = "1" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\InprocServer32\ Soundpad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxInputConnections = "1" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Soundpad.Soundlist\shell Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.spl\OpenWithList Soundpad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\APOInterface0 = "{FD7F2B29-24D0-4B5C-B177-592C39F9CA10}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\ = "UniteFx Class" Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.spl\Content Type = "audio/soundpadlist" Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Soundpad\shell\open Soundpad.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Soundpad\DefaultIcon Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Soundpad\shell\open\command\ Soundpad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\Copyright = "Copyright (C) 2016-2019 Leppsoft" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\InprocServer32\ThreadingModel = "Both" Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Soundpad.Soundlist Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Soundpad.Soundlist\shell\open\command\ Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.spl\OpenWithList\ehshell.exe\ Soundpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\FriendlyName = "UniteFx" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinOutputConnections = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxOutputConnections = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxInstances = "4294967295" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Soundpad.Soundlist\\shell\open\command Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.spl Soundpad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxOutputConnections = "1" regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2168 Soundpad.exe Token: SeShutdownPrivilege 2168 Soundpad.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2168 Soundpad.exe 2168 Soundpad.exe 2168 Soundpad.exe 2168 Soundpad.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2244 2168 Soundpad.exe 30 PID 2168 wrote to memory of 2244 2168 Soundpad.exe 30 PID 2168 wrote to memory of 2244 2168 Soundpad.exe 30 PID 2168 wrote to memory of 2244 2168 Soundpad.exe 30 PID 2168 wrote to memory of 2244 2168 Soundpad.exe 30 PID 2168 wrote to memory of 484 2168 Soundpad.exe 31 PID 2168 wrote to memory of 484 2168 Soundpad.exe 31 PID 2168 wrote to memory of 484 2168 Soundpad.exe 31 PID 2168 wrote to memory of 484 2168 Soundpad.exe 31 PID 2168 wrote to memory of 484 2168 Soundpad.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\SoundPad\Soundpad.exe"C:\Users\Admin\AppData\Local\Temp\SoundPad\Soundpad.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\UniteFx.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:2244
-
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\UniteFx.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:484
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:1308
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:2968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
442KB
MD50ee743073ee6b68f8222be2661d95315
SHA12e642772ec19edf73422fe25a8d45db1a006ff85
SHA256562b17370c7283e92a3353b76ab2aefd301c2e78782fa60ec9ee35676ad44f96
SHA512c3f2037bd37cef7978187f67f1d0633ee3067b4837e0ad9ae2a5c8efab8ec4ce6a14c1d88e200ffaa8677f74fd5995789297e6a7b5ac18d19dc9d53b4d9170ba