General
- Target SoundPad_Cracked.zip
- Size 8.9MB
- Sample260820-1sjjsafh84
- SHA256 bb6d09dac5d8a4fe68f4b9b00c875cd5b8aef7dc8fdb357810f57b39020ff58e
Malware Config
Targets
-
- Target SoundPad_Cracked.zip
- Size 8.9MB
- SHA256 bb6d09dac5d8a4fe68f4b9b00c875cd5b8aef7dc8fdb357810f57b39020ff58e
Score1/10 -
- Target SoundPad/SoundPad/Profile/CRACKED BY Ray_Black/SteamUserID.cfg
- Size 61B
- SHA256 2c2f3f8d579f9d0703fe251d162456572c9d4c07408493a512b0f069bb892a98
Score3/10 -
- Target SoundPad/SoundPad/Soundpad.exe
- Size 10.9MB
- SHA256 ed3371229647ef876b45cb5940e48b461df58d4e68ad4932f5877eba90c8d379
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Loads dropped DLL
-
Drops file in System32 directory
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target SoundPad/SoundPad/SteamConfig.ini
- Size 135B
- SHA256 c2702d244e84cb0abc4f964062b9ecf51b1697712ad4c03b37d345f93d045bba
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target SoundPad/SoundPad/UniteFxControl.dll
- Size 1.1MB
- SHA256 afe6075ea7dd1bdcbc47b38385216d11cdd5ebc3f82eeedfa6d766e9249d6252
Score1/10 -
- Target SoundPad/SoundPad/UniteFxUpdate.dll
- Size 442KB
- SHA256 562b17370c7283e92a3353b76ab2aefd301c2e78782fa60ec9ee35676ad44f96
Score1/10 -
- Target SoundPad/SoundPad/installscript.vdf
- Size 631B
- SHA256 270d2a3eef463b768ca4368e62444a7ccaff4e98c71f2ca05b721bfef2e03e05
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target SoundPad/SoundPad/languages/cs/translation.mo
- Size 48KB
- SHA256 ca876dcfb11522ee63977c07e176cd3fdddc8bde374fde53a6a7367680638214
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target SoundPad/SoundPad/languages/da/translation.mo
- Size 46KB
- SHA256 c954cca2b32bab1cb5a8a8a578329c72c49368598126b90ea480340b7aacd524
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target SoundPad/SoundPad/languages/de/translation.mo
- Size 49KB
- SHA256 5220672f99b439b1db77479ab170a5a0f2b65b4b14416b72447ded6f1ebcd40e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target SoundPad/SoundPad/languages/es_ES/translation.mo
- Size 50KB
- SHA256 d35905c669534e8770849dd51ba74071836f43e1047a7df7ef99c373ca185c73
Score3/10 -
- Target SoundPad/SoundPad/languages/fi/translation.mo
- Size 48KB
- SHA256 8dcf58474fc5ab1514461e1f9b8e336ef0c13b49f26f7bceb14d477da7a85b6a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target SoundPad/SoundPad/languages/fr/translation.mo
- Size 51KB
- SHA256 bf44674158ed2dec81843c7bfd0dee6595bb36946bec92e09ecfb9943fd0e5a4
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target SoundPad/SoundPad/languages/it/translation.mo
- Size 49KB
- SHA256 9e5fb77abbc5b636cca97637a07c9d40e03af74981afa2835900e3b65beeaf38
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target SoundPad/SoundPad/languages/ja/translation.mo
- Size 54KB
- SHA256 7a6b8050163aace177a004a2cf14eaa825229e7e3366318517f2ed434563cd87
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target SoundPad/SoundPad/languages/ko/translation.mo
- Size 50KB
- SHA256 dd6d1dacef96225413043914fb7ae5beabafc72969b6312e47dce033896c32fc
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1