45c0b385e633d8eba46c79928914227779c33fba322181b799b367d192c73cf4

Analysis

user interaction
yes
max time kernel
54s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Soundpad.v4.0.30/Soundpad.exe
Size 11.7MB
Sample260728-ya74babe29
SHA256 45c0b385e633d8eba46c79928914227779c33fba322181b799b367d192c73cf4
MD5 9807bf498d1a70b6cb3a5733d90feb24
SHA1 2f92ab6f759a61e3c405610ae6284e21ebea2925
SHA512 102692fccd05ff8d98442ea071e2c366dc50c553ce34dd114bf3164971d1dcf7f5655e6dfb2bc01dab1ef85230094b4e6fedfe143323977f9c57e88b54f31cde
SSDEEP 196608:4Ma4dBpTj4KOizwDbJtratpK2hrLTOHlEQ7lNa:4M9h4KOUwDbJtrbMTOZa
TLSH
T171C69E1E62BA01ECD476D07CCA979A03F3F23846573197FB01A1867A5F2BAD04E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

persistence privilege_escalation upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	Soundpad.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\UniteFx1.8.0.dll	Soundpad.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2236-1-0x00007FFDF2D20000-0x00007FFDF3D88000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Soundpad\SoundpadService.exe	Soundpad.exe
File opened for modification	C:\Program Files\Common Files\Soundpad\SoundpadService.exe	Soundpad.exe

Loads dropped DLL 2 IoCs

pid	Process
4040	regsvr32.exe
4540	AUDIODG.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 48 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.spl\Content Type = "audio/soundpadlist"	Soundpad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\NumAPOInterfaces = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\InprocServer32\	Soundpad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\InprocServer32\ThreadingModel = "Both"	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.spl\OpenWithProgids\Soundpad.Soundlist	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Soundpad\DefaultIcon	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Soundpad\shell	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.spl\OpenWithList\ehshell.exe	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Soundpad.Soundlist\shell	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.spl\OpenWithList	Soundpad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\FriendlyName = "UniteFx"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\MinOutputConnections = "1"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Soundpad.Soundlist\DefaultIcon	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Soundpad.Soundlist\shell\open	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.spl	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Soundpad\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Soundpad.v4.0.30\\Soundpad.exe,0"	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Soundpad\shell\open\command	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Soundpad\shell\open	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Soundpad\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Soundpad.v4.0.30\\Soundpad.exe\" -c \"%1\""	Soundpad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.spl\PerceivedType = "audio"	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Soundpad\ = "URL:Soundpad Protocol"	Soundpad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\Flags = "14"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\APOInterface0 = "{FD7F2B29-24D0-4B5C-B177-592C39F9CA10}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\ = "UniteFx Class"	Soundpad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\InprocServer32\ = "C:\\Windows\\system32\\UniteFx1.8.0.dll"	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.spl\OpenWithList\ehshell.exe\	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Soundpad\shell\open\command\	Soundpad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\MajorVersion = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\MaxOutputConnections = "1"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.spl\OpenWithProgids	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Soundpad.Soundlist	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Soundpad.Soundlist\ = "Soundpad sound list"	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Soundpad.Soundlist\shell\open\command\	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Soundpad.Soundlist\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Soundpad.v4.0.30\\Soundpad.exe\" \"%1\""	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.spl\ = "Soundpad.Soundlist"	Soundpad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\Copyright = "Copyright (C) 2016-2025 Leppsoft"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Soundpad.Soundlist\shell\open\command	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.spl\OpenWithList\ehshell.exe\	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Soundpad\URL Protocol	Soundpad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\MinorVersion = "8"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\MinInputConnections = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\MaxInputConnections = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\MaxInstances = "4294967295"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Soundpad.Soundlist\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Soundpad.v4.0.30\\Soundpad.exe,1"	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Soundpad	Soundpad.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2236	Soundpad.exe
Token: 33	4540	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4540	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	Soundpad.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2236	Soundpad.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2236	Soundpad.exe
2236	Soundpad.exe
2552	SoundpadService.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2552	2236	Soundpad.exe	84
PID 2236 wrote to memory of 4040	2236	Soundpad.exe	88

C:\Users\Admin\AppData\Local\Temp\Soundpad.v4.0.30\Soundpad.exe
"C:\Users\Admin\AppData\Local\Temp\Soundpad.v4.0.30\Soundpad.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\Soundpad.v4.0.30\SoundpadService.exe
  "C:\Users\Admin\AppData\Local\Temp\Soundpad.v4.0.30\SoundpadService.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2552
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\UniteFx1.8.0.dll"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:4040

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x40c 0x514
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SP_8C8F527DA10A4E7E9ACED50683389C2B.dat

Path C:\Users\Admin\AppData\Local\speech\Microsoft\Speech\Files\UserLexicons\SP_8C8F527DA10A4E7E9ACED50683389C2B.dat
Size 940B
SHA256 6124c1434c250e455fd1af99a1f51ff28777b79cc7d9d05f13b315576395c73e
MD5 5e765d68b550e7c556725d9e5ef82f14
SHA1 8abca46b7d3da559c46f3139bce8af0a1312724e
SHA512 470921d834e4cd6c151a66aba45faa70b5971cd30adec8b7a1a1a17c2fb27662ef2c53861b49a35f8673993428c9eb5d0ed7f5c38571ab6b210dc461e490eb7c
TLSH
T1981124041DC03C5DD111303C107CF04310301704F4443CDDD413CC0135C7F044131044
MD5 SHA1 SHA512 TLSH

Submit Download

UniteFx1.8.0.dll

Path C:\Windows\system32\UniteFx1.8.0.dll
Size 575KB
SHA256 065f3af6e9c1e35eabed4cd3a1484b93f76559bf1e8709a62507d5ad254c55ed
MD5 e99464639d42eea371783a30b180b6a7
SHA1 220d3e38a2bb705845f0fe527f218088d502dbfc
SHA512 e3cd2693758487a437857f3add056a94354d702be1171bccbf862a9ebd020a48dfb088c243176fb20ab57c2c3dac5f75448e05afc15d9c4352cce7f16aa08bf9
SSDEEP 12288:THluRTicI2MpmVB1055aRkjM9cHMNyqoERRtLW1nns:THIRXIrmV705MRisc2hRtLW1nns
TLSH
T10BC48E16A6E902B9F177D574C9434512FBB2BC1613709ACF03E05AAB5F277A05B3E322
MD5 SHA1 SHA512 SSDEEP TLSH