e1f5f78f744ddd0c1d9392ac2f19b1a7077ee27043a09355a60de06980fc4963

Analysis

max time kernel
44s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Crack SoundPad , By Burdix.rar
Size

7.2MB
MD5

73164c909d0347b14798395ef88ce211
SHA1

6f51c7e4c246982aa8651690678d66fcc2f70520
SHA256

e1f5f78f744ddd0c1d9392ac2f19b1a7077ee27043a09355a60de06980fc4963
SHA512

3c27722ab836291aeac916ae64e42ec74d7d6cb075b2a2d11d7b28cc723853b2b4765c13c2ef662c274636f329e1193945740237b54944e78f33b0eda6642cb9
SSDEEP

196608:ae8fPDao4PcoJDxWeHnCvofD8befhcfEx7CIt3AbY:ae83b4nlCvIeefKsxm83AbY

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1636	2076	cmd.exe	31
PID 2076 wrote to memory of 1636	2076	cmd.exe	31
PID 2076 wrote to memory of 1636	2076	cmd.exe	31
PID 1636 wrote to memory of 2988	1636	rundll32.exe	33
PID 1636 wrote to memory of 2988	1636	rundll32.exe	33
PID 1636 wrote to memory of 2988	1636	rundll32.exe	33
PID 2988 wrote to memory of 2752	2988	rundll32.exe	34
PID 2988 wrote to memory of 2752	2988	rundll32.exe	34
PID 2988 wrote to memory of 2752	2988	rundll32.exe	34
PID 2752 wrote to memory of 2676	2752	rundll32.exe	35
PID 2752 wrote to memory of 2676	2752	rundll32.exe	35
PID 2752 wrote to memory of 2676	2752	rundll32.exe	35
PID 2676 wrote to memory of 2640	2676	rundll32.exe	36
PID 2676 wrote to memory of 2640	2676	rundll32.exe	36
PID 2676 wrote to memory of 2640	2676	rundll32.exe	36
PID 2640 wrote to memory of 3064	2640	rundll32.exe	37
PID 2640 wrote to memory of 3064	2640	rundll32.exe	37
PID 2640 wrote to memory of 3064	2640	rundll32.exe	37
PID 3064 wrote to memory of 1232	3064	rundll32.exe	38
PID 3064 wrote to memory of 1232	3064	rundll32.exe	38
PID 3064 wrote to memory of 1232	3064	rundll32.exe	38
PID 1232 wrote to memory of 1932	1232	rundll32.exe	39
PID 1232 wrote to memory of 1932	1232	rundll32.exe	39
PID 1232 wrote to memory of 1932	1232	rundll32.exe	39

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Crack SoundPad , By Burdix.rar"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Crack SoundPad , By Burdix.rar
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Crack SoundPad , By Burdix.rar
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Crack SoundPad , By Burdix.rar
      4⤵
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2752
    - - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Crack SoundPad , By Burdix.rar
        5⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2676
      - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Crack SoundPad , By Burdix.rar
        6⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2640
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Crack SoundPad , By Burdix.rar
        7⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Crack SoundPad , By Burdix.rar
        8⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1232
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Crack SoundPad , By Burdix.rar
        9⤵
        Modifies registry class
        
        PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...