17e162eae3204595e6e0806599fbb9e12f721aea16597307dca0ee9c25204d39

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SoundPad.4.0.9/Soundpad.exe
Size 11.6MB
Sample261113-e14n2af16p
SHA256 17e162eae3204595e6e0806599fbb9e12f721aea16597307dca0ee9c25204d39
MD5 c68f3f2622c4b536eec4da473c294190
SHA1 db4481248e32fa14b253d839b1809a55042039d2
SHA512 08a2aec7df0eb5a24c1a73ad46b92ad4263eac3cf70645e6dc6ea8ea187f7ec302aa92f6fc72e698747074ec2fbe5c09ce6833f1eb8afe22473d375bfdc52d77
SSDEEP 196608:GAce3mzQ0ZDKIfy60DOe+td1duxkelckFU:YVXKIf90DOec1dul2kU
TLSH
T153C69E1AA3B600FCD4B6D0BC89539903F3F33846173597EB05A18A6B8F1B6D19E7A750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

persistence privilege_escalation upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	Soundpad.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\UniteFx1.8.0.dll	Soundpad.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5084-0-0x00007FF864EA0000-0x00007FF865F08000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Soundpad\SoundpadService.exe	Soundpad.exe
File opened for modification	C:\Program Files\Common Files\Soundpad\SoundpadService.exe	Soundpad.exe

Loads dropped DLL 2 IoCs

pid	Process
2056	regsvr32.exe
3752	AUDIODG.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 48 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.spl\OpenWithList\ehshell.exe\	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.spl\OpenWithProgids	Soundpad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\FriendlyName = "UniteFx"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\MajorVersion = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\	Soundpad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\ = "UniteFx Class"	Soundpad.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\InprocServer32\	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Soundpad.Soundlist	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Soundpad.Soundlist\DefaultIcon	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Soundpad.Soundlist\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SoundPad.4.0.9\\Soundpad.exe,1"	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Soundpad\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SoundPad.4.0.9\\Soundpad.exe,0"	Soundpad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\MinorVersion = "8"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Soundpad.Soundlist\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\SoundPad.4.0.9\\Soundpad.exe\" \"%1\""	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Soundpad\shell\open	Soundpad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\InprocServer32\ThreadingModel = "Both"	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Soundpad.Soundlist\shell\open\command	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Soundpad\shell	Soundpad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\Flags = "14"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\MaxInputConnections = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\MinOutputConnections = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\MaxInstances = "4294967295"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Soundpad.Soundlist\ = "Soundpad sound list"	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Soundpad.Soundlist\shell\open\command\	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.spl\ = "Soundpad.Soundlist"	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.spl\OpenWithList\ehshell.exe	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Soundpad\URL Protocol	Soundpad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\InprocServer32\ = "C:\\Windows\\system32\\UniteFx1.8.0.dll"	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.spl\Content Type = "audio/soundpadlist"	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.spl\OpenWithProgids\Soundpad.Soundlist	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Soundpad\DefaultIcon	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Soundpad\shell\open\command	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Soundpad\shell\open\command\	Soundpad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\NumAPOInterfaces = "1"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Soundpad.Soundlist\shell\open	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.spl\PerceivedType = "audio"	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.spl\OpenWithList\ehshell.exe\	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Soundpad	Soundpad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\Copyright = "Copyright (C) 2016-2024 Leppsoft"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\MinInputConnections = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\APOInterface0 = "{FD7F2B29-24D0-4B5C-B177-592C39F9CA10}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Soundpad.Soundlist\shell	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.spl	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.spl\OpenWithList	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Soundpad\ = "URL:Soundpad Protocol"	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Soundpad\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\SoundPad.4.0.9\\Soundpad.exe\" -c \"%1\""	Soundpad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC3-9519-C60EBCAA2C71}\MaxOutputConnections = "1"	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5084	Soundpad.exe
Token: 33	3752	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3752	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5084	Soundpad.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5084	Soundpad.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5084	Soundpad.exe
5084	Soundpad.exe
3372	SoundpadService.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 3372	5084	Soundpad.exe	84
PID 5084 wrote to memory of 2056	5084	Soundpad.exe	87

C:\Users\Admin\AppData\Local\Temp\SoundPad.4.0.9\Soundpad.exe
"C:\Users\Admin\AppData\Local\Temp\SoundPad.4.0.9\Soundpad.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Users\Admin\AppData\Local\Temp\SoundPad.4.0.9\SoundpadService.exe
  "C:\Users\Admin\AppData\Local\Temp\SoundPad.4.0.9\SoundpadService.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3372
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\UniteFx1.8.0.dll"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:2056

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x504
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SP_80AE7F6F6FC145C9BE0CB120E3CD05F5.dat

Path C:\Users\Admin\AppData\Local\speech\Microsoft\Speech\Files\UserLexicons\SP_80AE7F6F6FC145C9BE0CB120E3CD05F5.dat
Size 940B
SHA256 8738e2eb29030ddf3aac10e967964bf6baf28d555eb2b6fe1237510cb146243a
MD5 661280109c236178800b8c2f643dc30e
SHA1 da9ab856895cd143bb4ea92439a556b1649a3676
SHA512 4a7ce2892464f91d81f975ea4d102c5d3a8c4b3612dd9cbc8c1f1f18d2a03fa3e72e4990ef54af5fc242d03fc1af8491a1ef0c7766c5efa394f9cdc037b756e6
TLSH
T1E8112B0200362C89D40C057D021CE7D813C11408A178B610BE404122B02A08A2C45156
MD5 SHA1 SHA512 TLSH

Submit Download

UniteFx1.8.0.dll

Path C:\Windows\system32\UniteFx1.8.0.dll
Size 581KB
SHA256 16b9bcf7be1fc7829299229323efab0e9c9594c626eab6ff0bff8eb7495ccf60
MD5 9feae88cb8eff25628382749c84ac55c
SHA1 9c4f308e0b7a6f4e71d62a671607ffe8ca56e51c
SHA512 c381ab754b8b0db482c4893f279d76063dc65238f1a0331dd887ed4e3e3ffc7ec5ec34205fef98121cc8b1f4b38116fa16820ff8ad887ccbebbb677642a671e1
SSDEEP 12288:3bMYSzbsXmJmD02otfTo98md2FMN/a9oOt0q+LZeb:rMdbsXmhfTomSKMA9tt0q+LZeb
TLSH
T19EC47D2662E841B8F177A17489874516F7B2785623719ACF03F086AF2F277B15B3E321
MD5 SHA1 SHA512 SSDEEP TLSH