Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-10-2024 19:01
Static task
static1
Behavioral task
behavioral1
Sample
1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe
Resource
win7-20240903-en
General
-
Target
1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe
-
Size
3.9MB
-
MD5
0b900f1e0009adf08ac7c57878e2f84c
-
SHA1
36d4f6be34343653cb6ffef7bc278603bcf446c1
-
SHA256
1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd
-
SHA512
b3934d8404bdbeeacab1b8c4dd7d8e94cf4c94124e938660a3088d814e89bdf3d4339b8570e3f63615db7759ebb5e0de0fbfb9e6bd0c3849fff36d7d18d51757
-
SSDEEP
98304:8lX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBAlB6D4tyX6kuT4IkQApCgvms0Cv05J5CN:8lX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBN
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Soundcrd.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe -
Executes dropped EXE 3 IoCs
pid Process 2380 Soundcrd.exe 1648 Soundcrd.exe 2160 Soundcrd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoftt = "C:\\Users\\Admin\\AppData\\Roaming\\Soundcrd.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2380 set thread context of 1648 2380 Soundcrd.exe 92 PID 2380 set thread context of 2160 2380 Soundcrd.exe 93 -
resource yara_rule behavioral2/memory/1648-31-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1648-34-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2160-39-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1648-43-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2160-42-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1648-45-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1648-46-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1648-44-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1648-41-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2160-36-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1648-35-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1648-49-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2160-50-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1648-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1648-59-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1648-63-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1648-67-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1648-71-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1648-75-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soundcrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soundcrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soundcrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Soundcrd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Soundcrd.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1648 Soundcrd.exe Token: SeSecurityPrivilege 1648 Soundcrd.exe Token: SeTakeOwnershipPrivilege 1648 Soundcrd.exe Token: SeLoadDriverPrivilege 1648 Soundcrd.exe Token: SeSystemProfilePrivilege 1648 Soundcrd.exe Token: SeSystemtimePrivilege 1648 Soundcrd.exe Token: SeProfSingleProcessPrivilege 1648 Soundcrd.exe Token: SeIncBasePriorityPrivilege 1648 Soundcrd.exe Token: SeCreatePagefilePrivilege 1648 Soundcrd.exe Token: SeBackupPrivilege 1648 Soundcrd.exe Token: SeRestorePrivilege 1648 Soundcrd.exe Token: SeShutdownPrivilege 1648 Soundcrd.exe Token: SeDebugPrivilege 1648 Soundcrd.exe Token: SeSystemEnvironmentPrivilege 1648 Soundcrd.exe Token: SeChangeNotifyPrivilege 1648 Soundcrd.exe Token: SeRemoteShutdownPrivilege 1648 Soundcrd.exe Token: SeUndockPrivilege 1648 Soundcrd.exe Token: SeManageVolumePrivilege 1648 Soundcrd.exe Token: SeImpersonatePrivilege 1648 Soundcrd.exe Token: SeCreateGlobalPrivilege 1648 Soundcrd.exe Token: 33 1648 Soundcrd.exe Token: 34 1648 Soundcrd.exe Token: 35 1648 Soundcrd.exe Token: 36 1648 Soundcrd.exe Token: SeDebugPrivilege 2160 Soundcrd.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 852 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe 2380 Soundcrd.exe 2160 Soundcrd.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 852 wrote to memory of 2308 852 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe 86 PID 852 wrote to memory of 2308 852 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe 86 PID 852 wrote to memory of 2308 852 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe 86 PID 2308 wrote to memory of 3032 2308 cmd.exe 90 PID 2308 wrote to memory of 3032 2308 cmd.exe 90 PID 2308 wrote to memory of 3032 2308 cmd.exe 90 PID 852 wrote to memory of 2380 852 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe 91 PID 852 wrote to memory of 2380 852 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe 91 PID 852 wrote to memory of 2380 852 1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe 91 PID 2380 wrote to memory of 1648 2380 Soundcrd.exe 92 PID 2380 wrote to memory of 1648 2380 Soundcrd.exe 92 PID 2380 wrote to memory of 1648 2380 Soundcrd.exe 92 PID 2380 wrote to memory of 1648 2380 Soundcrd.exe 92 PID 2380 wrote to memory of 1648 2380 Soundcrd.exe 92 PID 2380 wrote to memory of 1648 2380 Soundcrd.exe 92 PID 2380 wrote to memory of 1648 2380 Soundcrd.exe 92 PID 2380 wrote to memory of 1648 2380 Soundcrd.exe 92 PID 2380 wrote to memory of 2160 2380 Soundcrd.exe 93 PID 2380 wrote to memory of 2160 2380 Soundcrd.exe 93 PID 2380 wrote to memory of 2160 2380 Soundcrd.exe 93 PID 2380 wrote to memory of 2160 2380 Soundcrd.exe 93 PID 2380 wrote to memory of 2160 2380 Soundcrd.exe 93 PID 2380 wrote to memory of 2160 2380 Soundcrd.exe 93 PID 2380 wrote to memory of 2160 2380 Soundcrd.exe 93 PID 2380 wrote to memory of 2160 2380 Soundcrd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe"C:\Users\Admin\AppData\Local\Temp\1c18e114b3f7d6744d43288a16d1acfaf95d6c694d3e729109d13621fe9b6afd.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PKJEp.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoftt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Soundcrd.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3032
-
-
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exe"C:\Users\Admin\AppData\Roaming\Soundcrd.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1648
-
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2160
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139B
MD5173bcce4810d4901872d0ef4f0bfea4e
SHA1561b03fdfe68b6419fddf57f32e1aab9a6126a2f
SHA25610ea37eceabbe80fe9814280b66b957636951dbeeed18a9b4d50a1d24a6f1d1d
SHA5122401e0a5e3f7bf590a0767449da2249d09717e8c1cb71a7475e81d9615580001cfc38705cd1a5b4edc33f7df043bf195e28e4a5442a32bc879dffc6473bd545e
-
Filesize
3.9MB
MD505e62921fccc1f2015e5f4bc503b2371
SHA179fefae9b778878d7cbde0e4fc5baddbb332f3fc
SHA256461c9b2a5c77189c3319e1433a5dfa554f5d0cac72a3e73759a2a18b18e8b5e7
SHA5128ca9189e36d690a04a5ca8f60fcf4f8feb99b741cc28616adf7cfa565fa55a2fafd81a29e78e66ad2ca553c9847e5abef69945db6cd60ca2dd4381f1e9f60760