45c0b385e633d8eba46c79928914227779c33fba322181b799b367d192c73cf4

Analysis

max time kernel
78s
max time network
80s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Soundpad.v4.0.30/Soundpad.exe
Size 11.7MB
Sample260728-ya74babe29
SHA256 45c0b385e633d8eba46c79928914227779c33fba322181b799b367d192c73cf4
MD5 9807bf498d1a70b6cb3a5733d90feb24
SHA1 2f92ab6f759a61e3c405610ae6284e21ebea2925
SHA512 102692fccd05ff8d98442ea071e2c366dc50c553ce34dd114bf3164971d1dcf7f5655e6dfb2bc01dab1ef85230094b4e6fedfe143323977f9c57e88b54f31cde
SSDEEP 196608:4Ma4dBpTj4KOizwDbJtratpK2hrLTOHlEQ7lNa:4M9h4KOUwDbJtrbMTOZa
TLSH
T171C69E1E62BA01ECD476D07CCA979A03F3F23846573197FB01A1867A5F2BAD04E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

persistence privilege_escalation upx

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\UniteFx1.8.0.dll	Soundpad.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5960-0-0x00007FFB116C0000-0x00007FFB12728000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Soundpad\SoundpadService.exe	Soundpad.exe

Loads dropped DLL 2 IoCs

pid	Process
5076	regsvr32.exe
5588	AUDIODG.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 48 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Soundpad.Soundlist\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Soundpad.v4.0.30\\Soundpad.exe,1"	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Soundpad.Soundlist\shell\open\command	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.spl	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.spl\OpenWithList\ehshell.exe\	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.spl\OpenWithProgids	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Soundpad\shell\open\command	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Soundpad\shell	Soundpad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\MinInputConnections = "1"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Soundpad\shell\open\command\	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Soundpad.Soundlist\DefaultIcon	Soundpad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\MinOutputConnections = "1"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Soundpad.Soundlist\ = "Soundpad sound list"	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Soundpad.Soundlist\shell\open\command\	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Soundpad.Soundlist\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Soundpad.v4.0.30\\Soundpad.exe\" \"%1\""	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.spl\OpenWithList	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.spl\OpenWithList\ehshell.exe\	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Soundpad\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Soundpad.v4.0.30\\Soundpad.exe,0"	Soundpad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\MaxInputConnections = "1"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.spl\ = "Soundpad.Soundlist"	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.spl\PerceivedType = "audio"	Soundpad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\FriendlyName = "UniteFx"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\Copyright = "Copyright (C) 2016-2025 Leppsoft"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\MajorVersion = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\Flags = "14"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\MaxOutputConnections = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\MaxInstances = "4294967295"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Soundpad.Soundlist	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.spl\OpenWithList\ehshell.exe	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Soundpad	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Soundpad\ = "URL:Soundpad Protocol"	Soundpad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\APOInterface0 = "{FD7F2B29-24D0-4B5C-B177-592C39F9CA10}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\	Soundpad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\ = "UniteFx Class"	Soundpad.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\InprocServer32\	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Soundpad.Soundlist\shell	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Soundpad.Soundlist\shell\open	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Soundpad\DefaultIcon	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Soundpad\shell\open	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Soundpad\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Soundpad.v4.0.30\\Soundpad.exe\" -c \"%1\""	Soundpad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\NumAPOInterfaces = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\InprocServer32\ = "C:\\Windows\\system32\\UniteFx1.8.0.dll"	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.spl\Content Type = "audio/soundpadlist"	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\.spl\OpenWithProgids\Soundpad.Soundlist	Soundpad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\InprocServer32\ThreadingModel = "Both"	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Soundpad\URL Protocol	Soundpad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\MinorVersion = "8"	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5588	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5588	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5960	Soundpad.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5960	Soundpad.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5960	Soundpad.exe
5960	Soundpad.exe
1448	SoundpadService.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5960 wrote to memory of 1448	5960	Soundpad.exe	89
PID 5960 wrote to memory of 5076	5960	Soundpad.exe	90

C:\Users\Admin\AppData\Local\Temp\Soundpad.v4.0.30\Soundpad.exe
"C:\Users\Admin\AppData\Local\Temp\Soundpad.v4.0.30\Soundpad.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Users\Admin\AppData\Local\Temp\Soundpad.v4.0.30\SoundpadService.exe
  "C:\Users\Admin\AppData\Local\Temp\Soundpad.v4.0.30\SoundpadService.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1448
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\UniteFx1.8.0.dll"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:5076

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004EC
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SP_66C70BA047944D06960436C37F6080E8.dat

Path C:\Users\Admin\AppData\Local\speech\Microsoft\Speech\Files\UserLexicons\SP_66C70BA047944D06960436C37F6080E8.dat
Size 940B
SHA256 02d57004a39def66ddd73146ac9239283a477c03d2c35c1c7fa2e1b841718b53
MD5 023f01437e14aeeb3e1e65cd962a0ba8
SHA1 cbadf04f2f32f9baf919d6f2b6b0892a3fd5b244
SHA512 44f73f42efb7cfb20d3e781ce95dca5c0ae97c283751aaed7074e859ebf51cdc341aeff3beaee493d0609933f639a1bc7a558c53eb4fd5d79a63bdcf5ef9aa23
TLSH
T18C112B5208D05F50D45B613C70902680C0003000854C34E832500D54B0F1854C1C3552
MD5 SHA1 SHA512 TLSH

Submit Download

UniteFx1.8.0.dll

Path C:\Windows\System32\UniteFx1.8.0.dll
Size 575KB
SHA256 065f3af6e9c1e35eabed4cd3a1484b93f76559bf1e8709a62507d5ad254c55ed
MD5 e99464639d42eea371783a30b180b6a7
SHA1 220d3e38a2bb705845f0fe527f218088d502dbfc
SHA512 e3cd2693758487a437857f3add056a94354d702be1171bccbf862a9ebd020a48dfb088c243176fb20ab57c2c3dac5f75448e05afc15d9c4352cce7f16aa08bf9
SSDEEP 12288:THluRTicI2MpmVB1055aRkjM9cHMNyqoERRtLW1nns:THIRXIrmV705MRisc2hRtLW1nns
TLSH
T10BC48E16A6E902B9F177D574C9434512FBB2BC1613709ACF03E05AAB5F277A05B3E322
MD5 SHA1 SHA512 SSDEEP TLSH