Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-10-2024 19:01
Static task
static1
Behavioral task
behavioral1
Sample
1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe
Resource
win7-20240903-en
General
-
Target
1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe
-
Size
3.9MB
-
MD5
0b900f1e0009adf08ac7c57878e2f84c
-
SHA1
36d4f6be34343653cb6ffef7bc278603bcf446c1
-
SHA256
1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd
-
SHA512
b3934d8404bdbeeacab1b8c4dd7d8e94cf4c94124e938660a3088d814e89bdf3d4339b8570e3f63615db7759ebb5e0de0fbfb9e6bd0c3849fff36d7d18d51757
-
SSDEEP
98304:8lX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBAlB6D4tyX6kuT4IkQApCgvms0Cv05J5CN:8lX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBN
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Soundcrd.exe -
Executes dropped EXE 3 IoCs
pid Process 2232 Soundcrd.exe 2556 Soundcrd.exe 2512 Soundcrd.exe -
Loads dropped DLL 7 IoCs
pid Process 1716 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe 1716 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe 1716 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe 1716 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe 1716 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe 2232 Soundcrd.exe 2232 Soundcrd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcrosoftt = "C:\\Users\\Admin\\AppData\\Roaming\\Soundcrd.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2232 set thread context of 2556 2232 Soundcrd.exe 32 PID 2232 set thread context of 2512 2232 Soundcrd.exe 33 -
resource yara_rule behavioral1/memory/2556-48-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2556-50-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2556-51-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2556-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2556-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2556-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2556-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2556-58-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2556-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2512-59-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2512-61-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2512-62-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2556-65-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2512-67-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2556-70-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2556-74-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2556-78-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2556-82-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2556-86-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2556-90-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soundcrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soundcrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soundcrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Soundcrd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Soundcrd.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2556 Soundcrd.exe Token: SeSecurityPrivilege 2556 Soundcrd.exe Token: SeTakeOwnershipPrivilege 2556 Soundcrd.exe Token: SeLoadDriverPrivilege 2556 Soundcrd.exe Token: SeSystemProfilePrivilege 2556 Soundcrd.exe Token: SeSystemtimePrivilege 2556 Soundcrd.exe Token: SeProfSingleProcessPrivilege 2556 Soundcrd.exe Token: SeIncBasePriorityPrivilege 2556 Soundcrd.exe Token: SeCreatePagefilePrivilege 2556 Soundcrd.exe Token: SeBackupPrivilege 2556 Soundcrd.exe Token: SeRestorePrivilege 2556 Soundcrd.exe Token: SeShutdownPrivilege 2556 Soundcrd.exe Token: SeDebugPrivilege 2556 Soundcrd.exe Token: SeSystemEnvironmentPrivilege 2556 Soundcrd.exe Token: SeChangeNotifyPrivilege 2556 Soundcrd.exe Token: SeRemoteShutdownPrivilege 2556 Soundcrd.exe Token: SeUndockPrivilege 2556 Soundcrd.exe Token: SeManageVolumePrivilege 2556 Soundcrd.exe Token: SeImpersonatePrivilege 2556 Soundcrd.exe Token: SeCreateGlobalPrivilege 2556 Soundcrd.exe Token: 33 2556 Soundcrd.exe Token: 34 2556 Soundcrd.exe Token: 35 2556 Soundcrd.exe Token: SeDebugPrivilege 2512 Soundcrd.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1716 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe 2232 Soundcrd.exe 2512 Soundcrd.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1716 wrote to memory of 2716 1716 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe 28 PID 1716 wrote to memory of 2716 1716 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe 28 PID 1716 wrote to memory of 2716 1716 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe 28 PID 1716 wrote to memory of 2716 1716 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe 28 PID 2716 wrote to memory of 2632 2716 cmd.exe 30 PID 2716 wrote to memory of 2632 2716 cmd.exe 30 PID 2716 wrote to memory of 2632 2716 cmd.exe 30 PID 2716 wrote to memory of 2632 2716 cmd.exe 30 PID 1716 wrote to memory of 2232 1716 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe 31 PID 1716 wrote to memory of 2232 1716 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe 31 PID 1716 wrote to memory of 2232 1716 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe 31 PID 1716 wrote to memory of 2232 1716 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe 31 PID 2232 wrote to memory of 2556 2232 Soundcrd.exe 32 PID 2232 wrote to memory of 2556 2232 Soundcrd.exe 32 PID 2232 wrote to memory of 2556 2232 Soundcrd.exe 32 PID 2232 wrote to memory of 2556 2232 Soundcrd.exe 32 PID 2232 wrote to memory of 2556 2232 Soundcrd.exe 32 PID 2232 wrote to memory of 2556 2232 Soundcrd.exe 32 PID 2232 wrote to memory of 2556 2232 Soundcrd.exe 32 PID 2232 wrote to memory of 2556 2232 Soundcrd.exe 32 PID 2232 wrote to memory of 2556 2232 Soundcrd.exe 32 PID 2232 wrote to memory of 2512 2232 Soundcrd.exe 33 PID 2232 wrote to memory of 2512 2232 Soundcrd.exe 33 PID 2232 wrote to memory of 2512 2232 Soundcrd.exe 33 PID 2232 wrote to memory of 2512 2232 Soundcrd.exe 33 PID 2232 wrote to memory of 2512 2232 Soundcrd.exe 33 PID 2232 wrote to memory of 2512 2232 Soundcrd.exe 33 PID 2232 wrote to memory of 2512 2232 Soundcrd.exe 33 PID 2232 wrote to memory of 2512 2232 Soundcrd.exe 33 PID 2232 wrote to memory of 2512 2232 Soundcrd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe"C:\Users\Admin\AppData\Local\Temp\1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\oiMLq.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoftt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Soundcrd.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2632
-
-
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exe"C:\Users\Admin\AppData\Roaming\Soundcrd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2556
-
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2512
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139B
MD5173bcce4810d4901872d0ef4f0bfea4e
SHA1561b03fdfe68b6419fddf57f32e1aab9a6126a2f
SHA25610ea37eceabbe80fe9814280b66b957636951dbeeed18a9b4d50a1d24a6f1d1d
SHA5122401e0a5e3f7bf590a0767449da2249d09717e8c1cb71a7475e81d9615580001cfc38705cd1a5b4edc33f7df043bf195e28e4a5442a32bc879dffc6473bd545e
-
Filesize
3.9MB
MD5d171254b66639f746dfcd80b0def33d7
SHA1f7a7830595e430f9291a652a3f62ee5d744ab3ff
SHA256495028b975706e124787f4f2bf921c35970eceb81b41e9f3014d50a90df567bb
SHA512a12a7ea9678dfbf283591da3ddd0bf8ec7fb23f5ecd2623ec88fde13b1afa0069b2f2c5dfec56e4ab8d9ed470ab2a9254b8d54c0614164e1ccc35e6daae2373b