Edit tour

Windows Analysis Report
SoundTune.exe

Overview

General Information

Sample name:	SoundTune.exe
Analysis ID:	1425677
MD5:	9fae2084f15f67cc3549bdcdba10e595
SHA1:	372f1fa71e6956647ed4087f063e9601458f926e
SHA256:	1249e422fd97163201b6a38b48f2220a6262133b4302ad2d850669d71e144b06
Tags:	exe
Infos:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Amadey

Yara detected Amadeys stealer DLL

Yara detected UAC Bypass using CMSTP

C2 URLs / IPs found in malware configuration

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

Contains functionality to detect virtual machines (STR)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

SoundTune.exe (PID: 4404 cmdline: "C:\Users\user\Desktop\SoundTune.exe" MD5: 9FAE2084F15F67CC3549BDCDBA10E595)

cmd.exe (PID: 3252 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 5276 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

SoundTune.exe (PID: 6360 cmdline: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe MD5: 9FAE2084F15F67CC3549BDCDBA10E595)

SoundTune.exe (PID: 2448 cmdline: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe MD5: 9FAE2084F15F67CC3549BDCDBA10E595)

cmd.exe (PID: 3500 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 2956 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

SoundTune.exe (PID: 6332 cmdline: "C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe" MD5: 9FAE2084F15F67CC3549BDCDBA10E595)

cmd.exe (PID: 3652 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 5516 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": "responsibilitybridge.com/8BvxwQdec3/index.php", "Version": "4.19"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\yxh	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Temp\nmqufdalfa	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Temp\hdoumnepq	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.2413913656.000000000541B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000007.00000002.2414191195.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000002.2330168207.00000000047A9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000E.00000002.2479094817.0000000005900000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000002.2478639571.00000000052E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000005.00000002.2243163643.00000278AB600000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000002.00000002.2330822665.00000000054A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000002.2254650455.0000025B712CB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000012.00000002.2478523985.0000000004CA2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000012.00000002.2477851015.0000000002C41000.00000020.00000001.01000000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000002.2414365443.0000000002591000.00000004.00000001.01000000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000002.2329605585.0000000002591000.00000020.00000001.01000000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000011.00000002.2414793420.0000000004919000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: SoundTune.exe PID: 4404	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: cmd.exe PID: 3252	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: SoundTune.exe PID: 6360	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: SoundTune.exe PID: 2448	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.SoundTune.exe.278ae41be5f.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
5.2.SoundTune.exe.278ae41be5f.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d08e:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d31a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d119:$s1: CoGetObject 0x1d3a5:$s1: CoGetObject 0x1d072:$s2: Elevation:Administrator!new: 0x1d2fe:$s2: Elevation:Administrator!new:
6.2.SoundTune.exe.2a37f9e925f.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
6.2.SoundTune.exe.2a37f9e925f.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dc8e:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1df1a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd19:$s1: CoGetObject 0x1dfa5:$s1: CoGetObject 0x1dc72:$s2: Elevation:Administrator!new: 0x1defe:$s2: Elevation:Administrator!new:
14.2.cmd.exe.532b378.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
14.2.cmd.exe.532b378.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dc8e:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1df1a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd19:$s1: CoGetObject 0x1dfa5:$s1: CoGetObject 0x1dc72:$s2: Elevation:Administrator!new: 0x1defe:$s2: Elevation:Administrator!new:
16.2.explorer.exe.47f3f78.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
16.2.explorer.exe.47f3f78.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d08e:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d31a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d119:$s1: CoGetObject 0x1d3a5:$s1: CoGetObject 0x1d072:$s2: Elevation:Administrator!new: 0x1d2fe:$s2: Elevation:Administrator!new:
14.2.cmd.exe.59000c8.7.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
18.2.explorer.exe.4ca8a8a.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
18.2.explorer.exe.4ca8a8a.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x6157c:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61808:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61607:$s1: CoGetObject 0x61893:$s1: CoGetObject 0x61560:$s2: Elevation:Administrator!new: 0x617ec:$s2: Elevation:Administrator!new:
0.2.SoundTune.exe.22584b96971.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.SoundTune.exe.22584b96971.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x6157c:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61808:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61607:$s1: CoGetObject 0x61893:$s1: CoGetObject 0x61560:$s2: Elevation:Administrator!new: 0x617ec:$s2: Elevation:Administrator!new:
16.2.explorer.exe.47afa8a.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
16.2.explorer.exe.47afa8a.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x6157c:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61808:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61607:$s1: CoGetObject 0x61893:$s1: CoGetObject 0x61560:$s2: Elevation:Administrator!new: 0x617ec:$s2: Elevation:Administrator!new:
7.2.cmd.exe.5a200c8.7.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
17.2.explorer.exe.491fa8a.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
17.2.explorer.exe.491fa8a.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x6157c:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61808:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61607:$s1: CoGetObject 0x61893:$s1: CoGetObject 0x61560:$s2: Elevation:Administrator!new: 0x617ec:$s2: Elevation:Administrator!new:
2.2.cmd.exe.54a00c8.7.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
7.2.cmd.exe.5a200c8.7.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.SoundTune.exe.22584bdae5f.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.SoundTune.exe.22584bdae5f.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d08e:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d31a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d119:$s1: CoGetObject 0x1d3a5:$s1: CoGetObject 0x1d072:$s2: Elevation:Administrator!new: 0x1d2fe:$s2: Elevation:Administrator!new:
2.2.cmd.exe.4ae3378.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.2.cmd.exe.4ae3378.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dc8e:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1df1a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd19:$s1: CoGetObject 0x1dfa5:$s1: CoGetObject 0x1dc72:$s2: Elevation:Administrator!new: 0x1defe:$s2: Elevation:Administrator!new:
5.2.SoundTune.exe.278ae41b25f.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
5.2.SoundTune.exe.278ae41b25f.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dc8e:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1df1a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd19:$s1: CoGetObject 0x1dfa5:$s1: CoGetObject 0x1dc72:$s2: Elevation:Administrator!new: 0x1defe:$s2: Elevation:Administrator!new:
14.2.cmd.exe.59000c8.7.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.SoundTune.exe.2a37f9e9e5f.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
6.2.SoundTune.exe.2a37f9e9e5f.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d08e:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d31a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d119:$s1: CoGetObject 0x1d3a5:$s1: CoGetObject 0x1d072:$s2: Elevation:Administrator!new: 0x1d2fe:$s2: Elevation:Administrator!new:
14.2.cmd.exe.532bf78.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
14.2.cmd.exe.532bf78.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d08e:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d31a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d119:$s1: CoGetObject 0x1d3a5:$s1: CoGetObject 0x1d072:$s2: Elevation:Administrator!new: 0x1d2fe:$s2: Elevation:Administrator!new:
7.2.cmd.exe.5465378.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
7.2.cmd.exe.5465378.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dc8e:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1df1a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd19:$s1: CoGetObject 0x1dfa5:$s1: CoGetObject 0x1dc72:$s2: Elevation:Administrator!new: 0x1defe:$s2: Elevation:Administrator!new:
7.2.cmd.exe.5465f78.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
7.2.cmd.exe.5465f78.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d08e:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d31a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d119:$s1: CoGetObject 0x1d3a5:$s1: CoGetObject 0x1d072:$s2: Elevation:Administrator!new: 0x1d2fe:$s2: Elevation:Administrator!new:
17.2.explorer.exe.4963378.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
17.2.explorer.exe.4963378.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dc8e:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1df1a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd19:$s1: CoGetObject 0x1dfa5:$s1: CoGetObject 0x1dc72:$s2: Elevation:Administrator!new: 0x1defe:$s2: Elevation:Administrator!new:
18.2.explorer.exe.4cec378.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
18.2.explorer.exe.4cec378.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dc8e:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1df1a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd19:$s1: CoGetObject 0x1dfa5:$s1: CoGetObject 0x1dc72:$s2: Elevation:Administrator!new: 0x1defe:$s2: Elevation:Administrator!new:
13.2.SoundTune.exe.25b71315e5f.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
13.2.SoundTune.exe.25b71315e5f.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d08e:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d31a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d119:$s1: CoGetObject 0x1d3a5:$s1: CoGetObject 0x1d072:$s2: Elevation:Administrator!new: 0x1d2fe:$s2: Elevation:Administrator!new:
0.2.SoundTune.exe.22584bda25f.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.SoundTune.exe.22584bda25f.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dc8e:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1df1a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd19:$s1: CoGetObject 0x1dfa5:$s1: CoGetObject 0x1dc72:$s2: Elevation:Administrator!new: 0x1defe:$s2: Elevation:Administrator!new:
2.2.cmd.exe.4a9fa8a.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.2.cmd.exe.4a9fa8a.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x6157c:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61808:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61607:$s1: CoGetObject 0x61893:$s1: CoGetObject 0x61560:$s2: Elevation:Administrator!new: 0x617ec:$s2: Elevation:Administrator!new:
2.2.cmd.exe.54a00c8.7.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.cmd.exe.4ae3f78.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.2.cmd.exe.4ae3f78.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d08e:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d31a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d119:$s1: CoGetObject 0x1d3a5:$s1: CoGetObject 0x1d072:$s2: Elevation:Administrator!new: 0x1d2fe:$s2: Elevation:Administrator!new:
7.2.cmd.exe.5421a8a.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
7.2.cmd.exe.5421a8a.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x6157c:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61808:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61607:$s1: CoGetObject 0x61893:$s1: CoGetObject 0x61560:$s2: Elevation:Administrator!new: 0x617ec:$s2: Elevation:Administrator!new:
16.2.explorer.exe.47f3378.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
16.2.explorer.exe.47f3378.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dc8e:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1df1a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd19:$s1: CoGetObject 0x1dfa5:$s1: CoGetObject 0x1dc72:$s2: Elevation:Administrator!new: 0x1defe:$s2: Elevation:Administrator!new:
13.2.SoundTune.exe.25b7131525f.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
13.2.SoundTune.exe.25b7131525f.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dc8e:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1df1a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd19:$s1: CoGetObject 0x1dfa5:$s1: CoGetObject 0x1dc72:$s2: Elevation:Administrator!new: 0x1defe:$s2: Elevation:Administrator!new:
18.2.explorer.exe.4cecf78.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
18.2.explorer.exe.4cecf78.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d08e:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d31a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d119:$s1: CoGetObject 0x1d3a5:$s1: CoGetObject 0x1d072:$s2: Elevation:Administrator!new: 0x1d2fe:$s2: Elevation:Administrator!new:
17.2.explorer.exe.4963f78.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
17.2.explorer.exe.4963f78.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d08e:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d31a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d119:$s1: CoGetObject 0x1d3a5:$s1: CoGetObject 0x1d072:$s2: Elevation:Administrator!new: 0x1d2fe:$s2: Elevation:Administrator!new:
6.2.SoundTune.exe.2a37f9a5971.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
6.2.SoundTune.exe.2a37f9a5971.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x6157c:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61808:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61607:$s1: CoGetObject 0x61893:$s1: CoGetObject 0x61560:$s2: Elevation:Administrator!new: 0x617ec:$s2: Elevation:Administrator!new:
13.2.SoundTune.exe.25b712d1971.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
13.2.SoundTune.exe.25b712d1971.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x6157c:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61808:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61607:$s1: CoGetObject 0x61893:$s1: CoGetObject 0x61560:$s2: Elevation:Administrator!new: 0x617ec:$s2: Elevation:Administrator!new:
5.2.SoundTune.exe.278ae3d7971.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
5.2.SoundTune.exe.278ae3d7971.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x6157c:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61808:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61607:$s1: CoGetObject 0x61893:$s1: CoGetObject 0x61560:$s2: Elevation:Administrator!new: 0x617ec:$s2: Elevation:Administrator!new:
14.2.cmd.exe.52e7a8a.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
14.2.cmd.exe.52e7a8a.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x6157c:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61808:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x61607:$s1: CoGetObject 0x61893:$s1: CoGetObject 0x61560:$s2: Elevation:Administrator!new: 0x617ec:$s2: Elevation:Administrator!new:
Click to see the 61 entries

Sigma Signatures

System Summary

Sigma detected: Proxy Execution Via Explorer.exe

Source: Process started

Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative: Data: Command: C:\Windows\SysWOW64\explorer.exe, CommandLine: C:\Windows\SysWOW64\explorer.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\explorer.exe, NewProcessName: C:\Windows\SysWOW64\explorer.exe, OriginalFileName: C:\Windows\SysWOW64\explorer.exe, ParentCommandLine: C:\Windows\SysWOW64\cmd.exe, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3252, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\SysWOW64\explorer.exe, ProcessId: 5276, ProcessName: explorer.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: responsibilitybridge.com/8BvxwQdec3/index.php

Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\nmqufdalfa	Avira: detection malicious, Label: HEUR/AGEN.1319380
Source: C:\Users\user\AppData\Local\Temp\yxh	Avira: detection malicious, Label: HEUR/AGEN.1319380
Source: C:\Users\user\AppData\Local\Temp\hdoumnepq	Avira: detection malicious, Label: HEUR/AGEN.1319380

Found malware configuration

Source: 14.2.cmd.exe.59000c8.7.unpack

Malware Configuration Extractor: Amadey {"C2 url": "responsibilitybridge.com/8BvxwQdec3/index.php", "Version": "4.19"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\hdoumnepq	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\hdoumnepq	Virustotal: Detection: 57%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\nmqufdalfa	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\nmqufdalfa	Virustotal: Detection: 57%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\yxh	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\yxh	Virustotal: Detection: 57%	Perma Link

Multi AV Scanner detection for submitted file

Source: SoundTune.exe

Virustotal: Detection: 22%

Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\nmqufdalfa	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\yxh	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\hdoumnepq	Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: responsibilitybridge.com
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: /8BvxwQdec3/index.php
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: S-%lu-
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: 33a59d2d44
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: Dctooux.exe
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: Startup
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: cmd /C RMDIR /s/q
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: rundll32
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: Programs
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: %USERPROFILE%
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: cred.dll\|clip.dll\|
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: http://
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: https://
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: /Plugins/
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: &unit=
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: shell32.dll
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: kernel32.dll
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: GetNativeSystemInfo
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: ProgramData\
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: AVAST Software
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: Kaspersky Lab
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: Panda Security
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: Doctor Web
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: 360TotalSecurity
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: Bitdefender
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: Norton
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: Sophos
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: Comodo
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: WinDefender
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: 0123456789
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: ------
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: ?scr=1
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: ComputerName
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: -unicode-
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: VideoID
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: DefaultSettings.XResolution
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: DefaultSettings.YResolution
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: ProductName
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: CurrentBuild
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: rundll32.exe
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: "taskkill /f /im "
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: " && timeout 1 && del
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: && Exit"
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: " && ren
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: Powershell.exe
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: -executionpolicy remotesigned -File "
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: shutdown -s -t 0
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: random
Source: 14.2.cmd.exe.59000c8.7.unpack	String decryptor: 64q}cZ

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 5.2.SoundTune.exe.278ae41be5f.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.SoundTune.exe.2a37f9e925f.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.cmd.exe.532b378.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.explorer.exe.47f3f78.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.explorer.exe.4ca8a8a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SoundTune.exe.22584b96971.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.explorer.exe.47afa8a.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.explorer.exe.491fa8a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SoundTune.exe.22584bdae5f.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.cmd.exe.4ae3378.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.SoundTune.exe.278ae41b25f.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.SoundTune.exe.2a37f9e9e5f.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.cmd.exe.532bf78.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.cmd.exe.5465378.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.cmd.exe.5465f78.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.explorer.exe.4963378.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.explorer.exe.4cec378.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.SoundTune.exe.25b71315e5f.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SoundTune.exe.22584bda25f.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.cmd.exe.4a9fa8a.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.cmd.exe.4ae3f78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.cmd.exe.5421a8a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.explorer.exe.47f3378.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.SoundTune.exe.25b7131525f.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.explorer.exe.4cecf78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.explorer.exe.4963f78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.SoundTune.exe.2a37f9a5971.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.SoundTune.exe.25b712d1971.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.SoundTune.exe.278ae3d7971.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.cmd.exe.52e7a8a.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2413913656.000000000541B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2330168207.00000000047A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2478639571.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2243163643.00000278AB600000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2254650455.0000025B712CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2478523985.0000000004CA2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2414793420.0000000004919000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SoundTune.exe PID: 4404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 3252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SoundTune.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SoundTune.exe PID: 2448, type: MEMORYSTR

Source: SoundTune.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\treesheets\treesheets\TS\TreeSheets.pdbP source: SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000000.00000002.2054568199.00007FF77A8E9000.00000002.00000001.01000000.00000003.sdmp, SoundTune.exe, 00000000.00000000.2036588675.00007FF77A8E9000.00000002.00000001.01000000.00000003.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000000.2166738092.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000005.00000002.2246810793.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000002.2202817464.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000000.2168813639.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: SoundTune.exe, 00000000.00000002.2053080712.00000225847BD000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000000.00000002.2053813920.00000225854C7000.00000004.00000001.00020000.00000000.sdmp, SoundTune.exe, 00000000.00000002.2053553749.00000225852C0000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2245550366.00000278AE900000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2243362804.00000278AB904000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2245920757.00000278AEB03000.00000004.00000001.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2200873633.000002A37F5C2000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2199453732.000002A30040E000.00000004.00000001.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2199258711.000002A300200000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: cmd.exe, 00000002.00000002.2330127502.00000000046F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330397398.0000000004B70000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: SoundTune.exe, 00000000.00000002.2053080712.00000225847BD000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000000.00000002.2053813920.00000225854C7000.00000004.00000001.00020000.00000000.sdmp, SoundTune.exe, 00000000.00000002.2053553749.00000225852C0000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2245550366.00000278AE900000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2243362804.00000278AB904000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2245920757.00000278AEB03000.00000004.00000001.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2200873633.000002A37F5C2000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2199453732.000002A30040E000.00000004.00000001.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2199258711.000002A300200000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: cmd.exe, 00000002.00000002.2330127502.00000000046F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330397398.0000000004B70000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\treesheets\treesheets\TS\TreeSheets.pdb source: SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000000.00000002.2054568199.00007FF77A8E9000.00000002.00000001.01000000.00000003.sdmp, SoundTune.exe, 00000000.00000000.2036588675.00007FF77A8E9000.00000002.00000001.01000000.00000003.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000000.2166738092.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000005.00000002.2246810793.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000002.2202817464.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000000.2168813639.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: responsibilitybridge.com/8BvxwQdec3/index.php

Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584A36000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A50000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE277000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitsum.com0/
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000000.00000002.2054568199.00007FF77A8E9000.00000002.00000001.01000000.00000003.sdmp, SoundTune.exe, 00000000.00000000.2036588675.00007FF77A8E9000.00000002.00000001.01000000.00000003.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000000.2166738092.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000005.00000002.2246810793.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000002.2202817464.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000000.2168813639.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.wxwidgets.org/latest/classwx_system_options.html
Source: SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000000.00000002.2054568199.00007FF77A8E9000.00000002.00000001.01000000.00000003.sdmp, SoundTune.exe, 00000000.00000000.2036588675.00007FF77A8E9000.00000002.00000001.01000000.00000003.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000000.2166738092.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000005.00000002.2246810793.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000002.2202817464.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000000.2168813639.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.wxwidgets.org/latest/plat_msw_install.html#msw_manifest
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.SoundTune.exe.278ae41be5f.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.SoundTune.exe.2a37f9e925f.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 14.2.cmd.exe.532b378.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.explorer.exe.47f3f78.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 18.2.explorer.exe.4ca8a8a.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.SoundTune.exe.22584b96971.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.explorer.exe.47afa8a.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 17.2.explorer.exe.491fa8a.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.SoundTune.exe.22584bdae5f.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.cmd.exe.4ae3378.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 5.2.SoundTune.exe.278ae41b25f.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.SoundTune.exe.2a37f9e9e5f.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 14.2.cmd.exe.532bf78.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 7.2.cmd.exe.5465378.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 7.2.cmd.exe.5465f78.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 17.2.explorer.exe.4963378.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 18.2.explorer.exe.4cec378.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.SoundTune.exe.25b71315e5f.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.SoundTune.exe.22584bda25f.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.cmd.exe.4a9fa8a.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.cmd.exe.4ae3f78.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 7.2.cmd.exe.5421a8a.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.explorer.exe.47f3378.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.SoundTune.exe.25b7131525f.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 18.2.explorer.exe.4cecf78.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 17.2.explorer.exe.4963f78.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.SoundTune.exe.2a37f9a5971.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.SoundTune.exe.25b712d1971.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 5.2.SoundTune.exe.278ae3d7971.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 14.2.cmd.exe.52e7a8a.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\Tasks\uiQuick.job

Jump to behavior

Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_00000278A82EA7D0	5_2_00000278A82EA7D0
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_00000278A82EC9D0	5_2_00000278A82EC9D0
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_00000278A83000B8	5_2_00000278A83000B8
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_00000278A82E96D0	5_2_00000278A82E96D0
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_00000278A82EB8D0	5_2_00000278A82EB8D0
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_00000278A82EDAD0	5_2_00000278A82EDAD0
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_00000278AB618700	5_2_00000278AB618700
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_00000278AB618BB0	5_2_00000278AB618BB0
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_00000278AE402D9A	5_2_00000278AE402D9A
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_00000278AE3DA25F	5_2_00000278AE3DA25F
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_00000278AE400F2A	5_2_00000278AE400F2A
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_00000278AE40137A	5_2_00000278AE40137A
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_00000278AE3DC89D	5_2_00000278AE3DC89D
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 6_2_000002A37CD1FFBC	6_2_000002A37CD1FFBC

Source: SoundTune.exe

Static PE information: invalid certificate

Source: SoundTune.exe, 00000000.00000002.2053553749.0000022585446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SoundTune.exe
Source: SoundTune.exe, 00000000.00000002.2053080712.0000022584935000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SoundTune.exe
Source: SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamezip.exe( vs SoundTune.exe
Source: SoundTune.exe	Binary or memory string: OriginalFilename vs SoundTune.exe
Source: SoundTune.exe, 00000005.00000002.2245920757.00000278AEC7B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SoundTune.exe
Source: SoundTune.exe, 00000005.00000002.2245550366.00000278AEA86000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SoundTune.exe
Source: SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamezip.exe( vs SoundTune.exe
Source: SoundTune.exe, 00000006.00000002.2199258711.000002A300386000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SoundTune.exe
Source: SoundTune.exe, 00000006.00000002.2200873633.000002A37F73A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SoundTune.exe
Source: SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamezip.exe( vs SoundTune.exe

Source: 5.2.SoundTune.exe.278ae41be5f.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.SoundTune.exe.2a37f9e925f.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 14.2.cmd.exe.532b378.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.explorer.exe.47f3f78.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 18.2.explorer.exe.4ca8a8a.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.SoundTune.exe.22584b96971.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.explorer.exe.47afa8a.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 17.2.explorer.exe.491fa8a.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.SoundTune.exe.22584bdae5f.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.cmd.exe.4ae3378.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 5.2.SoundTune.exe.278ae41b25f.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.SoundTune.exe.2a37f9e9e5f.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 14.2.cmd.exe.532bf78.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 7.2.cmd.exe.5465378.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 7.2.cmd.exe.5465f78.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 17.2.explorer.exe.4963378.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 18.2.explorer.exe.4cec378.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.SoundTune.exe.25b71315e5f.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.SoundTune.exe.22584bda25f.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.cmd.exe.4a9fa8a.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.cmd.exe.4ae3f78.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 7.2.cmd.exe.5421a8a.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.explorer.exe.47f3378.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.SoundTune.exe.25b7131525f.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 18.2.explorer.exe.4cecf78.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 17.2.explorer.exe.4963f78.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.SoundTune.exe.2a37f9a5971.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.SoundTune.exe.25b712d1971.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 5.2.SoundTune.exe.278ae3d7971.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 14.2.cmd.exe.52e7a8a.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Source: SoundTune.exe

Static PE information: Section: .rsrc ZLIB complexity 0.9917615167025862

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@19/11@0/0

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\updatefa

Jump to behavior

Source: C:\Users\user\Desktop\SoundTune.exe	Mutant created: \Sessions\1\BaseNamedObjects\SoundTune-user
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3924:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5248:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4400:120:WilError_03

Source: C:\Users\user\Desktop\SoundTune.exe

File created: C:\Users\user\AppData\Local\Temp\eb40e7d2

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe

Source: SoundTune.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SoundTune.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SoundTune.exe

Virustotal: Detection: 22%

Source: C:\Users\user\Desktop\SoundTune.exe

File read: C:\Users\user\Desktop\SoundTune.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SoundTune.exe "C:\Users\user\Desktop\SoundTune.exe"
Source: C:\Users\user\Desktop\SoundTune.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe "C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe"
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\Desktop\SoundTune.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe

Source: C:\Users\user\Desktop\SoundTune.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: comsvcs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: cmlua.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: cmutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: shdocvw.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: shdocvw.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mstask.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: shdocvw.dll	Jump to behavior

Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe

File opened: C:\Windows\SYSTEM32\msftedit.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: SoundTune.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: SoundTune.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SoundTune.exe

Static file information: File size 9888656 > 1048576

Source: SoundTune.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x597600
Source: SoundTune.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x243000
Source: SoundTune.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x122000

Source: SoundTune.exe

Static PE information: More than 200 imports for KERNEL32.dll

Source: SoundTune.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SoundTune.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SoundTune.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SoundTune.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SoundTune.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SoundTune.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SoundTune.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SoundTune.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\treesheets\treesheets\TS\TreeSheets.pdbP source: SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000000.00000002.2054568199.00007FF77A8E9000.00000002.00000001.01000000.00000003.sdmp, SoundTune.exe, 00000000.00000000.2036588675.00007FF77A8E9000.00000002.00000001.01000000.00000003.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000000.2166738092.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000005.00000002.2246810793.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000002.2202817464.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000000.2168813639.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: SoundTune.exe, 00000000.00000002.2053080712.00000225847BD000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000000.00000002.2053813920.00000225854C7000.00000004.00000001.00020000.00000000.sdmp, SoundTune.exe, 00000000.00000002.2053553749.00000225852C0000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2245550366.00000278AE900000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2243362804.00000278AB904000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2245920757.00000278AEB03000.00000004.00000001.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2200873633.000002A37F5C2000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2199453732.000002A30040E000.00000004.00000001.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2199258711.000002A300200000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: cmd.exe, 00000002.00000002.2330127502.00000000046F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330397398.0000000004B70000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: SoundTune.exe, 00000000.00000002.2053080712.00000225847BD000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000000.00000002.2053813920.00000225854C7000.00000004.00000001.00020000.00000000.sdmp, SoundTune.exe, 00000000.00000002.2053553749.00000225852C0000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2245550366.00000278AE900000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2243362804.00000278AB904000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2245920757.00000278AEB03000.00000004.00000001.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2200873633.000002A37F5C2000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2199453732.000002A30040E000.00000004.00000001.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2199258711.000002A300200000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: cmd.exe, 00000002.00000002.2330127502.00000000046F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330397398.0000000004B70000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\treesheets\treesheets\TS\TreeSheets.pdb source: SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000000.00000002.2054568199.00007FF77A8E9000.00000002.00000001.01000000.00000003.sdmp, SoundTune.exe, 00000000.00000000.2036588675.00007FF77A8E9000.00000002.00000001.01000000.00000003.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000000.2166738092.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000005.00000002.2246810793.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000002.2202817464.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000000.2168813639.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp

Source: SoundTune.exe	Static PE information: real checksum: 0x97c656 should be: 0x97dc68
Source: nmqufdalfa.2.dr	Static PE information: real checksum: 0x0 should be: 0x6fbf4
Source: hdoumnepq.14.dr	Static PE information: real checksum: 0x0 should be: 0x6fbf4
Source: yxh.7.dr	Static PE information: real checksum: 0x0 should be: 0x6fbf4

Source: SoundTune.exe	Static PE information: section name: _RDATA
Source: nmqufdalfa.2.dr	Static PE information: section name: uxcbu
Source: yxh.7.dr	Static PE information: section name: uxcbu
Source: hdoumnepq.14.dr	Static PE information: section name: uxcbu

Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CAAF7 pushfd ; ret	5_2_0000009AC39CAB1B
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CC0F8 pushfd ; ret	5_2_0000009AC39CC0FB
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CB0EC pushfd ; ret	5_2_0000009AC39CB12B
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CBEE2 pushfd ; ret	5_2_0000009AC39CBEE3
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CE4E2 pushfd ; ret	5_2_0000009AC39CE4F3
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CF6E2 pushfd ; ret	5_2_0000009AC39CF6E3
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CCCE4 pushfd ; ret	5_2_0000009AC39CCCBB
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CACE4 pushfd ; ret	5_2_0000009AC39CACFB
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CB0DA pushfd ; ret	5_2_0000009AC39CB0DB
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CB4DA pushfd ; ret	5_2_0000009AC39CB4DB
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CE6DB pushfd ; ret	5_2_0000009AC39CE6FB
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39C94DC pushfd ; ret	5_2_0000009AC39C94FB
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CB312 pushfd ; ret	5_2_0000009AC39CB313
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CA314 pushfd ; ret	5_2_0000009AC39CA393
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CF314 pushfd ; ret	5_2_0000009AC39CF323
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CDD0A pushfd ; ret	5_2_0000009AC39CDD13
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39C950C pushfd ; ret	5_2_0000009AC39C951B
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CD10C pushfd ; ret	5_2_0000009AC39CD12B
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CF308 pushfd ; ret	5_2_0000009AC39CF313
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CD101 pushfd ; ret	5_2_0000009AC39CD08B
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39C9AFB pushfd ; ret	5_2_0000009AC39C9B43
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CD538 pushfd ; ret	5_2_0000009AC39CD53B
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CCF32 pushfd ; ret	5_2_0000009AC39CCF33
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39C932C pushfd ; ret	5_2_0000009AC39C93C3
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39C9F2C pushfd ; ret	5_2_0000009AC39C9F3B
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CD32C pushfd ; ret	5_2_0000009AC39CD3EB
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39C9D24 pushfd ; ret	5_2_0000009AC39C9D3B
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CAB1C pushfd ; ret	5_2_0000009AC39CAB1B
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CAB1C pushfd ; ret	5_2_0000009AC39CABBB
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CC11C pushfd ; ret	5_2_0000009AC39CC18B
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_0000009AC39CC558 pushfd ; ret	5_2_0000009AC39CC56B

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\yxh	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\hdoumnepq	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\nmqufdalfa	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\nmqufdalfa	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\yxh	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\hdoumnepq	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\Tasks\uiQuick.job

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\cmd.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\NMQUFDALFA
Source: C:\Windows\SysWOW64\cmd.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\YXH
Source: C:\Windows\SysWOW64\cmd.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\HDOUMNEPQ

Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\SoundTune.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe

Code function: 6_2_000002A37CBF707A str word ptr [eax+00000451h]

6_2_000002A37CBF707A

Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\yxh	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\hdoumnepq	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nmqufdalfa	Jump to dropped file

Source: SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0

Source: C:\Users\user\Desktop\SoundTune.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_00000278AE3F5D97 mov eax, dword ptr fs:[00000030h]	5_2_00000278AE3F5D97
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_00000278AE3F5986 mov eax, dword ptr fs:[00000030h]	5_2_00000278AE3F5986
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_00000278AE3E0F53 mov eax, dword ptr fs:[00000030h]	5_2_00000278AE3E0F53
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_00000278AE3E3FD5 mov eax, dword ptr fs:[00000030h]	5_2_00000278AE3E3FD5
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Code function: 5_2_00000278AE3E40CF mov eax, dword ptr fs:[00000030h]	5_2_00000278AE3E40CF

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtCreateFile: Direct from: 0x8100000080	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	NtAllocateVirtualMemory: Direct from: 0x7FF8B7FF8054	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtReadFile: Direct from: 0x7FF8A88E85FB	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	NtQuerySystemInformation: Direct from: 0x22581CEA630	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtQuerySystemInformation: Direct from: 0x25B6E3CFCA0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtAllocateVirtualMemory: Direct from: 0x25B6E3D4D80	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	NtCreateFile: Direct from: 0x7FF8B7FE78EC	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	NtAllocateVirtualMemory: Direct from: 0x22581CEDD20	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtProtectVirtualMemory: Direct from: 0x278AB606F30	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	NtReadFile: Direct from: 0x7FF8B7FE85FB	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtAllocateVirtualMemory: Direct from: 0x7FF8A88F8054	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtProtectVirtualMemory: Direct from: 0x298	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtAllocateVirtualMemory: Direct from: 0x2A37CC1F722	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	NtProtectVirtualMemory: Direct from: 0x22581CF0760	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtSetTimerEx: Direct from: 0x7FF8C88A26A1	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	NtCreateFile: Direct from: 0x4800000080	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	NtAllocateVirtualMemory: Direct from: 0x22581CF0BB0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtProtectVirtualMemory: Direct from: 0x7FF8A88F9B9C	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtProtectVirtualMemory: Direct from: 0x7FF8A88F9BF0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtProtectVirtualMemory: Direct from: 0x7FF8AC0453D3	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtAllocateVirtualMemory: Direct from: 0x2A37CC19070	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtCreateFile: Direct from: 0x7FF8A88E85AD	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtCreateFile: Direct from: 0xDB00000080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtWriteFile: Direct from: 0x25B7189DA30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtQuerySystemInformation: Direct from: 0x2A37CC13E60	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	NtProtectVirtualMemory: Direct from: 0x2B0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtProtectVirtualMemory: Direct from: 0x7FF8C6F6FEE0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtProtectVirtualMemory: Direct from: 0x25B6E51BAB0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtWriteFile: Direct from: 0x2A30009DA30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtQueryInformationToken: Direct from: 0x9AC39CDF70	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtQuerySystemInformation: Direct from: 0x9AC39CF4D0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtProtectVirtualMemory: Direct from: 0x7FF8A88F8735	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtProtectVirtualMemory: Direct from: 0x278AE438E74	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	NtCreateFile: Direct from: 0x7FF8B7FE85AD	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtAllocateVirtualMemory: Direct from: 0xA0A76ACB	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtAllocateVirtualMemory: Direct from: 0x278A9BC3CA2	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	NtWriteFile: Direct from: 0x2258515DA30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtProtectVirtualMemory: Direct from: 0x2A37CD2BBB0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtCreateFile: Direct from: 0x7FF8A88E78EC	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	NtAllocateVirtualMemory: Direct from: 0x25B6E3F5F32	Jump to behavior
Source: C:\Users\user\Desktop\SoundTune.exe	NtAllocateVirtualMemory: Direct from: 0x7FF8B7FE856E	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 5276 base: 2580000 value: 00	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 5276 base: 26902D8 value: 00	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 5276 base: 26911E8 value: 00	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 5276 base: 1279C0 value: 55	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 5276 base: 2590000 value: 00	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 2956 base: 2580000 value: 00
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 2956 base: 26E22D8 value: 00
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 2956 base: 26E31E8 value: 00
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 2956 base: 1279C0 value: 55
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 2956 base: 2590000 value: 00
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 5516 base: 29F0000 value: 00
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 5516 base: 2A5E2D8 value: 00
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 5516 base: 2A5F1E8 value: 00
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 5516 base: 1279C0 value: 55
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 5516 base: 2C40000 value: 00

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\SoundTune.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 1279C0	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 2590000	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 1279C0
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 2590000
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 1279C0
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 2C40000

Source: C:\Users\user\Desktop\SoundTune.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe

Source: C:\Users\user\Desktop\SoundTune.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\eb40e7d2 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\f5e8013d VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\f3455394 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\f751201f VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SoundTune.exe

Code function: 0_2_00007FF77A4CA264 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF77A4CA264

Stealing of Sensitive Information

Yara detected Amadey

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 14.2.cmd.exe.59000c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.cmd.exe.5a200c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.cmd.exe.54a00c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.cmd.exe.5a200c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.cmd.exe.59000c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.cmd.exe.54a00c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2414191195.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2479094817.0000000005900000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2330822665.00000000054A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2477851015.0000000002C41000.00000020.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2414365443.0000000002591000.00000004.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2329605585.0000000002591000.00000020.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\yxh, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nmqufdalfa, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\hdoumnepq, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	311 Process Injection	21 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	11 DLL Side-Loading	1 Scheduled Task/Job	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Abuse Elevation Control Mechanism	311 Process Injection	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SoundTune.exe	8%	ReversingLabs
SoundTune.exe	23%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nmqufdalfa	100%	Avira	HEUR/AGEN.1319380
C:\Users\user\AppData\Local\Temp\yxh	100%	Avira	HEUR/AGEN.1319380
C:\Users\user\AppData\Local\Temp\hdoumnepq	100%	Avira	HEUR/AGEN.1319380
C:\Users\user\AppData\Local\Temp\nmqufdalfa	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\yxh	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\hdoumnepq	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\hdoumnepq	42%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\hdoumnepq	58%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\nmqufdalfa	42%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\nmqufdalfa	58%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\yxh	42%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\yxh	58%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://bitsum.com0/	0%	Avira URL Cloud	safe
responsibilitybridge.com/8BvxwQdec3/index.php	100%	Avira URL Cloud	phishing
responsibilitybridge.com/8BvxwQdec3/index.php	1%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
responsibilitybridge.com/8BvxwQdec3/index.php	true	1%, Virustotal, Browse Avira URL Cloud: phishing	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.vmware.com/0/	SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bitsum.com0/	SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vmware.com/0	SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.symauth.com/rpa00	SoundTune.exe, 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.wxwidgets.org/latest/plat_msw_install.html#msw_manifest	SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000000.00000002.2054568199.00007FF77A8E9000.00000002.00000001.01000000.00000003.sdmp, SoundTune.exe, 00000000.00000000.2036588675.00007FF77A8E9000.00000002.00000001.01000000.00000003.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000000.2166738092.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000005.00000002.2246810793.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000002.2202817464.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000000.2168813639.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.wxwidgets.org/latest/classwx_system_options.html	SoundTune.exe, 00000000.00000002.2052148275.0000022583B6A000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000000.00000002.2054568199.00007FF77A8E9000.00000002.00000001.01000000.00000003.sdmp, SoundTune.exe, 00000000.00000000.2036588675.00007FF77A8E9000.00000002.00000001.01000000.00000003.sdmp, SoundTune.exe, 00000005.00000002.2243607521.00000278AD563000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000000.2166738092.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000005.00000002.2246810793.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000002.2202817464.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000000.2168813639.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmp, SoundTune.exe, 00000006.00000002.2200022527.000002A37E98C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.info-zip.org/	SoundTune.exe, 00000000.00000002.2053261362.0000022584A36000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2330278372.0000000004A50000.00000004.00000800.00020000.00000000.sdmp, SoundTune.exe, 00000005.00000002.2244717993.00000278AE277000.00000004.00000020.00020000.00000000.sdmp, SoundTune.exe, 00000006.00000002.2201257984.000002A37F845000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1425677
Start date and time:	2024-04-14 07:08:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SoundTune.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@19/11@0/0
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, consent.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SoundTune.exe, PID 2448 because there are no executed function
Execution Graph export aborted for target SoundTune.exe, PID 4404 because there are no executed function
Execution Graph export aborted for target SoundTune.exe, PID 6332 because there are no executed function
Execution Graph export aborted for target SoundTune.exe, PID 6360 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:09:01	API Interceptor	3x Sleep call for process: SoundTune.exe modified
07:09:12	Task Scheduler	Run new task: SoundTune path: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe
07:09:13	Task Scheduler	Run new task: uiQuick path: C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe
07:09:29	API Interceptor	3x Sleep call for process: cmd.exe modified
07:09:37	API Interceptor	1x Sleep call for process: explorer.exe modified

Process:	C:\Users\user\Desktop\SoundTune.exe
File Type:	PNG image data, 4480 x 508, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1185377
Entropy (8bit):	7.993121928768052
Encrypted:	true
SSDEEP:	24576:1maY2XFmPdz7lbpV9Py2djrzzoIuCHVoF7idaHWdv:caYDzZbpVgsEdmoF72a2dv
MD5:	FFAF71D4A621E899C82C865F34E937D6
SHA1:	1468830BEE8AFB3ADCE79FDB0BDE3CCB599102D3
SHA-256:	74740FC70974DDC8B2B2ACE5E5098273E3B0DE77071FD6444F197F69AF8415F1
SHA-512:	56C3E369D876234C46368D7D4E782ADAE3A1D77728EFC4F2253A1C6733B00A7CA04F810A14C671E8120187F728A3F270127D06D907982B5B4637FAAE1C5A5419
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...............+... .IDATx..;...&z.....{...w....Kb....Pc.H[$..D...d........gl..5.........<..UY].]......tfeT.....`?.....\..._@@@@...n....m0..@k.._&....._7."....M....uM..?.4.....? ?.9g..@S.~.1.?..&?".0w.......`)%0..UU.K.TUE....K..K)..eY:/U.u...RZkrw)%>{UV.A...&..J)\|..,.o....n_.1&......]I.Xw.Kp.q..&.w...._...H@.6.......#.....I..I....k...H>c...H....\|B5..\|..G...N.;$.........`H..w......f..Ck]..e..^....4...lA........{..K0..a.m.~...a.}.M..c8....c.?F.=....7...I>..3.l2..@.......$..7..RJ.XwW...eI.....6w._..)....\.@5..cL*.......2z.....#...`!.J....8.....}...u.[...E......0...v..}$_.&?"..K......D....i.n.s.)8..4...H> 3w..1..t..w.&.\|9J.Y..w.......n..!...+....ea..p.Q....#........b......z.@.......~a?.....J..O..J\|.,......1<0.Y>N....KyY....,_k.....v.S.{....J2.'.\|.$..D............1.,_J.9.vi....{.......$....Dx....... p......{..&^.......}H...0N..`.....N.'..t{\=$.............o.....@Q..A.$..K5.!...$g..a.-F...K-$;K.. .ij....o......~...5.g.o..

C:\Users\user\AppData\Local\Temp\ebb9eca0

Download File

Process:	C:\Users\user\Desktop\SoundTune.exe
File Type:	data
Category:	dropped
Size (bytes):	1159305
Entropy (8bit):	7.629665445129676
Encrypted:	false
SSDEEP:	24576:poSKVXfYCLaLoFG+evn0wq+epoIpibue6yJiK4BI/9zUU9orGDXwh+z:poSKRBaLXls0Ipibue6yJiK4BI/9zUUJ
MD5:	CB139E19EA3CC76B4EA91677CCC6E55F
SHA1:	4A33B1E52EE29A8C3C7EE02BBF1ACC03A14E0C61
SHA-256:	17CFCEA0B3B34CD8C52B20C18F069EF09A7D366BEFAF66F3DFFA8508CC2CB995
SHA-512:	4D7D967F05E2333B3355A5B24D6B39A7A4C0CD3128238FEF86B6E9BE64AB1F2448943B0CD64377E28C33F08BBC1E8255105F110814153FDE837DEAC80F54DB9E
Malicious:	false
Reputation:	low
Preview:	<...<...>...?...>...{...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?.......{.......\...P...h...P...l...K...Q...M...^...l...K...?...?...?...?...?...?...?...?...?...?...?...\|...V...S...z...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...\|...Z...v...^...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?.......{...c...M...Y..z...M...H...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...I...........?...?...?...?...?...?...?...?...?...?...

C:\Users\user\AppData\Local\Temp\f3455394

Download File

Process:	C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe
File Type:	PNG image data, 4480 x 508, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1185377
Entropy (8bit):	7.993121928768052
Encrypted:	true
SSDEEP:	24576:1maY2XFmPdz7lbpV9Py2djrzzoIuCHVoF7idaHWdv:caYDzZbpVgsEdmoF72a2dv
MD5:	FFAF71D4A621E899C82C865F34E937D6
SHA1:	1468830BEE8AFB3ADCE79FDB0BDE3CCB599102D3
SHA-256:	74740FC70974DDC8B2B2ACE5E5098273E3B0DE77071FD6444F197F69AF8415F1
SHA-512:	56C3E369D876234C46368D7D4E782ADAE3A1D77728EFC4F2253A1C6733B00A7CA04F810A14C671E8120187F728A3F270127D06D907982B5B4637FAAE1C5A5419
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...............+... .IDATx..;...&z.....{...w....Kb....Pc.H[$..D...d........gl..5.........<..UY].]......tfeT.....`?.....\..._@@@@...n....m0..@k.._&....._7."....M....uM..?.4.....? ?.9g..@S.~.1.?..&?".0w.......`)%0..UU.K.TUE....K..K)..eY:/U.u...RZkrw)%>{UV.A...&..J)\|..,.o....n_.1&......]I.Xw.Kp.q..&.w...._...H@.6.......#.....I..I....k...H>c...H....\|B5..\|..G...N.;$.........`H..w......f..Ck]..e..^....4...lA........{..K0..a.m.~...a.}.M..c8....c.?F.=....7...I>..3.l2..@.......$..7..RJ.XwW...eI.....6w._..)....\.@5..cL*.......2z.....#...`!.J....8.....}...u.[...E......0...v..}$_.&?"..K......D....i.n.s.)8..4...H> 3w..1..t..w.&.\|9J.Y..w.......n..!...+....ea..p.Q....#........b......z.@.......~a?.....J..O..J\|.,......1<0.Y>N....KyY....,_k.....v.S.{....J2.'.\|.$..D............1.,_J.9.vi....{.......$....Dx....... p......{..&^.......}H...0N..`.....N.'..t{\=$.............o.....@Q..A.$..K5.!...$g..a.-F...K-$;K.. .ij....o......~...5.g.o..

C:\Users\user\AppData\Local\Temp\f4062f52

Download File

Process:	C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe
File Type:	data
Category:	dropped
Size (bytes):	1159305
Entropy (8bit):	7.62970789197951
Encrypted:	false
SSDEEP:	24576:doSKVXfYCLaLoFG+evn0wq+epoIpibue6yJiK4BI/9zUU9orGDXwh+z:doSKRBaLXls0Ipibue6yJiK4BI/9zUUJ
MD5:	FF32599363A0D7C18019FBF9E1E129D0
SHA1:	A58B84A63F0FF213819AB86FDAE3B2DC42199192
SHA-256:	605957F1C4A8AFB62B678AC3E068E178D69E72103702FE8132ECFEA81CB2ED3D
SHA-512:	8C78BD67313A6B7C94236E3F3B9D19B33A69A152B189F5753F3FAE382D89B4FFDB365BACF2DAE38EC9CB27DE96A1CB725B1685E96442A45D615B5A258B036236
Malicious:	false
Preview:	<...<...>...?...>...{...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?.......{.......\...P...h...P...l...K...Q...M...^...l...K...?...?...?...?...?...?...?...?...?...?...?...\|...V...S...z...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...\|...Z...v...^...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?.......{...c...M...Y..z...M...H...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...I...........?...?...?...?...?...?...?...?...?...?...

C:\Users\user\AppData\Local\Temp\f5e8013d

Download File

Process:	C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe
File Type:	PNG image data, 4480 x 508, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1185377
Entropy (8bit):	7.993121928768052
Encrypted:	true
SSDEEP:	24576:1maY2XFmPdz7lbpV9Py2djrzzoIuCHVoF7idaHWdv:caYDzZbpVgsEdmoF72a2dv
MD5:	FFAF71D4A621E899C82C865F34E937D6
SHA1:	1468830BEE8AFB3ADCE79FDB0BDE3CCB599102D3
SHA-256:	74740FC70974DDC8B2B2ACE5E5098273E3B0DE77071FD6444F197F69AF8415F1
SHA-512:	56C3E369D876234C46368D7D4E782ADAE3A1D77728EFC4F2253A1C6733B00A7CA04F810A14C671E8120187F728A3F270127D06D907982B5B4637FAAE1C5A5419
Malicious:	false
Preview:	.PNG........IHDR...............+... .IDATx..;...&z.....{...w....Kb....Pc.H[$..D...d........gl..5.........<..UY].]......tfeT.....`?.....\..._@@@@...n....m0..@k.._&....._7."....M....uM..?.4.....? ?.9g..@S.~.1.?..&?".0w.......`)%0..UU.K.TUE....K..K)..eY:/U.u...RZkrw)%>{UV.A...&..J)\|..,.o....n_.1&......]I.Xw.Kp.q..&.w...._...H@.6.......#.....I..I....k...H>c...H....\|B5..\|..G...N.;$.........`H..w......f..Ck]..e..^....4...lA........{..K0..a.m.~...a.}.M..c8....c.?F.=....7...I>..3.l2..@.......$..7..RJ.XwW...eI.....6w._..)....\.@5..cL*.......2z.....#...`!.J....8.....}...u.[...E......0...v..}$_.&?"..K......D....i.n.s.)8..4...H> 3w..1..t..w.&.\|9J.Y..w.......n..!...+....ea..p.Q....#........b......z.@.......~a?.....J..O..J\|.,......1<0.Y>N....KyY....,_k.....v.S.{....J2.'.\|.$..D............1.,_J.9.vi....{.......$....Dx....... p......{..&^.......}H...0N..`.....N.'..t{\=$.............o.....@Q..A.$..K5.!...$g..a.-F...K-$;K.. .ij....o......~...5.g.o..

C:\Users\user\AppData\Local\Temp\f751201f

Download File

Process:	C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe
File Type:	PNG image data, 4480 x 508, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1185377
Entropy (8bit):	7.993121928768052
Encrypted:	true
SSDEEP:	24576:1maY2XFmPdz7lbpV9Py2djrzzoIuCHVoF7idaHWdv:caYDzZbpVgsEdmoF72a2dv
MD5:	FFAF71D4A621E899C82C865F34E937D6
SHA1:	1468830BEE8AFB3ADCE79FDB0BDE3CCB599102D3
SHA-256:	74740FC70974DDC8B2B2ACE5E5098273E3B0DE77071FD6444F197F69AF8415F1
SHA-512:	56C3E369D876234C46368D7D4E782ADAE3A1D77728EFC4F2253A1C6733B00A7CA04F810A14C671E8120187F728A3F270127D06D907982B5B4637FAAE1C5A5419
Malicious:	false
Preview:	.PNG........IHDR...............+... .IDATx..;...&z.....{...w....Kb....Pc.H[$..D...d........gl..5.........<..UY].]......tfeT.....`?.....\..._@@@@...n....m0..@k.._&....._7."....M....uM..?.4.....? ?.9g..@S.~.1.?..&?".0w.......`)%0..UU.K.TUE....K..K)..eY:/U.u...RZkrw)%>{UV.A...&..J)\|..,.o....n_.1&......]I.Xw.Kp.q..&.w...._...H@.6.......#.....I..I....k...H>c...H....\|B5..\|..G...N.;$.........`H..w......f..Ck]..e..^....4...lA........{..K0..a.m.~...a.}.M..c8....c.?F.=....7...I>..3.l2..@.......$..7..RJ.XwW...eI.....6w._..)....\.@5..cL*.......2z.....#...`!.J....8.....}...u.[...E......0...v..}$_.&?"..K......D....i.n.s.)8..4...H> 3w..1..t..w.&.\|9J.Y..w.......n..!...+....ea..p.Q....#........b......z.@.......~a?.....J..O..J\|.,......1<0.Y>N....KyY....,_k.....v.S.{....J2.'.\|.$..D............1.,_J.9.vi....{.......$....Dx....... p......{..&^.......}H...0N..`.....N.'..t{\=$.............o.....@Q..A.$..K5.!...$g..a.-F...K-$;K.. .ij....o......~...5.g.o..

C:\Users\user\AppData\Local\Temp\f7e11b31

Download File

Process:	C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe
File Type:	data
Category:	dropped
Size (bytes):	1159305
Entropy (8bit):	7.62970789197951
Encrypted:	false
SSDEEP:	24576:doSKVXfYCLaLoFG+evn0wq+epoIpibue6yJiK4BI/9zUU9orGDXwh+z:doSKRBaLXls0Ipibue6yJiK4BI/9zUUJ
MD5:	FF32599363A0D7C18019FBF9E1E129D0
SHA1:	A58B84A63F0FF213819AB86FDAE3B2DC42199192
SHA-256:	605957F1C4A8AFB62B678AC3E068E178D69E72103702FE8132ECFEA81CB2ED3D
SHA-512:	8C78BD67313A6B7C94236E3F3B9D19B33A69A152B189F5753F3FAE382D89B4FFDB365BACF2DAE38EC9CB27DE96A1CB725B1685E96442A45D615B5A258B036236
Malicious:	false
Preview:	<...<...>...?...>...{...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?.......{.......\...P...h...P...l...K...Q...M...^...l...K...?...?...?...?...?...?...?...?...?...?...?...\|...V...S...z...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...\|...Z...v...^...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?.......{...c...M...Y..z...M...H...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...I...........?...?...?...?...?...?...?...?...?...?...

C:\Users\user\AppData\Local\Temp\hdoumnepq

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	431104
Entropy (8bit):	6.522083819371716
Encrypted:	false
SSDEEP:	6144:ypvAjIqqzCYJuahsPf1X7izHrmTo2S2PMr7AwkuF6i38CmzBt6uZewcYW95vZntv:ypvJzlhnzzZ7A3+6i+Bt6uZewcLfv5Bf
MD5:	44F8838F92D5960BC83F091F83A35A63
SHA1:	782415A855EA654A36EE0A9DC455DC75FF6835E5
SHA-256:	2AE0648BB0B6EC4A74952596463338FB939048924EC5926A0FB8F6E9A0CDAF63
SHA-512:	FE3D239C08AAB249E3418BBABA995B0BC52EAA048F6387C044E44B598B5E60D37A03BBFCAD29890E6459F6F0CBA28293FC59EEAB28098D80E7D2C5AABB484964
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\hdoumnepq, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42% Antivirus: Virustotal, Detection: 58%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.Y@...@...@....m..Q....m.......h..R....h..W....h..5....m..U....m..S...@........k..A....k1.A....k..A...Rich@...........PE..L...s.[_..........................................@.......................................@.................................l........p...........................K..0...8...........................h...@............................................text...:........................... ..`.rdata..N...........................@..@.data....E... ...2..................@....rsrc........p.......:..............@..@.reloc...K.......L...<..............@..Buxcbu...............................@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nmqufdalfa

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	431104
Entropy (8bit):	6.522083819371716
Encrypted:	false
SSDEEP:	6144:ypvAjIqqzCYJuahsPf1X7izHrmTo2S2PMr7AwkuF6i38CmzBt6uZewcYW95vZntv:ypvJzlhnzzZ7A3+6i+Bt6uZewcLfv5Bf
MD5:	44F8838F92D5960BC83F091F83A35A63
SHA1:	782415A855EA654A36EE0A9DC455DC75FF6835E5
SHA-256:	2AE0648BB0B6EC4A74952596463338FB939048924EC5926A0FB8F6E9A0CDAF63
SHA-512:	FE3D239C08AAB249E3418BBABA995B0BC52EAA048F6387C044E44B598B5E60D37A03BBFCAD29890E6459F6F0CBA28293FC59EEAB28098D80E7D2C5AABB484964
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\nmqufdalfa, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42% Antivirus: Virustotal, Detection: 58%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.Y@...@...@....m..Q....m.......h..R....h..W....h..5....m..U....m..S...@........k..A....k1.A....k..A...Rich@...........PE..L...s.[_..........................................@.......................................@.................................l........p...........................K..0...8...........................h...@............................................text...:........................... ..`.rdata..N...........................@..@.data....E... ...2..................@....rsrc........p.......:..............@..@.reloc...K.......L...<..............@..Buxcbu...............................@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yxh

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	431104
Entropy (8bit):	6.522083819371716
Encrypted:	false
SSDEEP:	6144:ypvAjIqqzCYJuahsPf1X7izHrmTo2S2PMr7AwkuF6i38CmzBt6uZewcYW95vZntv:ypvJzlhnzzZ7A3+6i+Bt6uZewcLfv5Bf
MD5:	44F8838F92D5960BC83F091F83A35A63
SHA1:	782415A855EA654A36EE0A9DC455DC75FF6835E5
SHA-256:	2AE0648BB0B6EC4A74952596463338FB939048924EC5926A0FB8F6E9A0CDAF63
SHA-512:	FE3D239C08AAB249E3418BBABA995B0BC52EAA048F6387C044E44B598B5E60D37A03BBFCAD29890E6459F6F0CBA28293FC59EEAB28098D80E7D2C5AABB484964
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\yxh, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42% Antivirus: Virustotal, Detection: 58%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.Y@...@...@....m..Q....m.......h..R....h..W....h..5....m..U....m..S...@........k..A....k1.A....k..A...Rich@...........PE..L...s.[_..........................................@.......................................@.................................l........p...........................K..0...8...........................h...@............................................text...:........................... ..`.rdata..N...........................@..@.data....E... ...2..................@....rsrc........p.......:..............@..@.reloc...K.......L...<..............@..Buxcbu...............................@...........................................................................................................................................................................................................................................................................

C:\Windows\Tasks\uiQuick.job

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.476602724803168
Encrypted:	false
SSDEEP:	6:pam8fX5ZsUEZglJPZzKnslmc6tFXqYEp5t/uy0l5sBq/11:pTmcMJ4E4fXV5sBa
MD5:	3BCB09ED48E87598D7499A0B5EC7B56F
SHA1:	BCD5908B188D874E3826811D7B35745C5924111D
SHA-256:	E27F3897B2094197944F9C82CAF44FC4EF78311F1C39F4B4C0674416ABBE87BF
SHA-512:	2A6EF38B5D7FB2971A4A49BDA398B118FFF6B8D0E74055216EBBA64774B6DA6C1B9893F0B7F919B94FA56C2935B177D7057E05B51A9B596E409EEA3287762F1B
Malicious:	false
Preview:	........@.L.u(...:)F.......<... ................ ....................7.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.u.p.d.a.t.e.f.a.\.S.o.u.n.d.T.u.n.e...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...............................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.811333933290262
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SoundTune.exe
File size:	9'888'656 bytes
MD5:	9fae2084f15f67cc3549bdcdba10e595
SHA1:	372f1fa71e6956647ed4087f063e9601458f926e
SHA256:	1249e422fd97163201b6a38b48f2220a6262133b4302ad2d850669d71e144b06
SHA512:	b710b89aaae2f58eaa382b7f3322f26c2f138a21086a90effebfe411c96c71d68dd976677d64d78ba088ffbf71f7bcec71b6757f4049246eac3279c2eb80c797
SSDEEP:	98304:A9MGsP1O5ytaNopUeCEnOX0a4GXgt6RHVHSNzQpvzk1bpbEd5QDc:AI1O5ytqQw0a4GXgt63HIzj1aoc
TLSH:	CDA6AE16A3E901F8E1F6D1BC8A579907E3B238160731A7EF069146275F27BE49D3B720
File Content Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........./`..A3..A3..A3..B2..A3..D2..A3..A3..A3..E2..A3..G2..A3.BE2..A3..@2..A3..@3Q.A3.B.3..A3.BD2..A3.BE2..A3.BB2..A3.BH2..A3.BD2..A

File Icon


Icon Hash:	88838e869a92908a

Static PE Info

General

Entrypoint:	0x140179b7c
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65EE81C4 [Mon Mar 11 04:00:04 2024 UTC]
TLS Callbacks:	0x40558cc0, 0x1, 0x40558b80, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	92ad1eef9d9db8bbe25d3fde9a911af8

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	07/02/2023 01:00:00 09/03/2025 00:59:59
Subject Chain	CN=Bitsum LLC, O=Bitsum LLC, L=Morristown, S=Tennessee, C=US, SERIALNUMBER=000681038, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Tennessee, OID.1.3.6.1.4.1.311.60.2.1.3=US
Version:	3
Thumbprint MD5:	FB9B0227584CEEB65B18E46C16D44130
Thumbprint SHA-1:	D711D20586F0E0C654A9B0D3AA5EC9BC4295B5DC
Thumbprint SHA-256:	B309179E6516E33D374264683B0751DB5F23B09E625FF0B6A4163DF28051D08C
Serial:	0B494D7DF02097107B9065025133FE92

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F43E0D160F4h
dec eax
add esp, 28h
jmp 00007F43E0D1588Fh
int3
int3
jmp 00007F43E10C3088h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
lea ecx, dword ptr [0067D938h]
call dword ptr [0041FDF2h]
and dword ptr [ebx], 00000000h
dec eax
lea ecx, dword ptr [0067D928h]
call dword ptr [0041FDEAh]
dec eax
lea ecx, dword ptr [0067D913h]
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [0041FDC7h]
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
lea ecx, dword ptr [0067D8FCh]
call dword ptr [0041FDB6h]
mov eax, dword ptr [006626F8h]
dec eax
lea ecx, dword ptr [0067D8E9h]
mov edx, dword ptr [0067DE73h]
inc eax
mov dword ptr [006626E3h], eax
mov dword ptr [ebx], eax
dec eax
mov eax, dword ptr [00000058h]
inc ecx
mov ecx, 00000010h
dec esp
mov eax, dword ptr [eax+edx*8]
mov eax, dword ptr [006626C8h]
inc ebx
mov dword ptr [ecx+eax], eax
call dword ptr [0041FD7Eh]
dec eax
lea ecx, dword ptr [0067D8A7h]
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [0041FD5Bh]
int3
int3
int3
inc eax
push ebx
dec eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7d7f14	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x885000	0x121ed4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x84c000	0x378cc	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x96ba00	0x2990	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x9a7000	0x1c50e
IMAGE_DIRECTORY_ENTRY_DEBUG	0x733d70	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x733f80	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x733c30	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x599000	0x1350	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x59755c	0x597600	a2ba293ff3f59b6467682e8b471acf26	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x599000	0x242ef2	0x243000	adb73c7b524b6fa4246578b9129f16c3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x7dc000	0x6fb58	0x1ae00	4bed99239f8098e46bfddde8fab4c538	False	0.16521620639534884	data	4.282858204960616	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x84c000	0x378cc	0x37a00	6166b1f90e7e7958e8d78411836d9e96	False	0.484936797752809	data	6.405501267802734	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x884000	0x1f4	0x200	a312e392362d19855ae5db508e76d480	False	0.52734375	data	4.206794279284555	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x885000	0x121ed4	0x122000	e6f6f382c2cb2f8b28d51e63114c50e1	False	0.9917615167025862	data	7.992020517788216	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x9a7000	0x1c508	0x1c600	59572eb07d851d58f325167286748692	False	0.07543192455947137	data	5.45142939957041	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
IQ	0x885168	0x121661	PNG image data, 4480 x 508, 8-bit/color RGB, non-interlaced			0.9965143203735352
RT_ICON	0x9a67cc	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	United States	0.30743243243243246
RT_ICON	0x9a68f4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512, 16 important colors	English	United States	0.16801075268817203
RT_GROUP_ICON	0x9a6bdc	0x22	data	English	United States	1.0
RT_MANIFEST	0x9a6c00	0x2d4	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4972375690607735

Imports

DLL	Import
ADVAPI32.dll	GetUserNameA, RegEnumValueW, RegEnumKeyW, RegDeleteValueW, RegDeleteKeyExW, RegCreateKeyExW, RegCloseKey, RegQueryValueExW, RegSetValueExW, GetUserNameW, RegOpenKeyExW
KERNEL32.dll	CreateMutexW, SetThreadPriority, TerminateThread, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FormatMessageW, GetFileType, ExpandEnvironmentStringsW, GetFileTime, GetLongPathNameW, GetTempFileNameW, CreateIoCompletionPort, GetQueuedCompletionStatus, PostQueuedCompletionStatus, ReadDirectoryChangesW, GetEnvironmentVariableW, GetVersionExW, GetModuleFileNameW, LoadResource, LockResource, SizeofResource, FindResourceW, IsValidCodePage, GetCommandLineW, GetModuleHandleExW, SetEvent, CreateEventW, PeekNamedPipe, WaitForMultipleObjects, CreateThread, GetDriveTypeW, GetLogicalDriveStringsW, IsBadReadPtr, IsBadStringPtrA, GetUserPreferredUILanguages, SetThreadPreferredUILanguages, GetUserDefaultLocaleName, GetFileSizeEx, LocalAlloc, OutputDebugStringW, FreeLibrary, GetProcAddress, LoadLibraryA, RtlCaptureContext, GetThreadLocale, GetLocaleInfoW, GetACP, SetErrorMode, LoadLibraryW, GlobalFree, GlobalHandle, GlobalLock, GlobalUnlock, GlobalSize, GlobalAlloc, ExitProcess, ReadConsoleOutputCharacterA, SetConsoleCursorPosition, GetConsoleScreenBufferInfo, FillConsoleOutputCharacterW, GetEnvironmentVariableA, GetCurrentDirectoryA, GetFileAttributesA, OutputDebugStringA, CloseHandle, GetLastError, SetLastError, RtlUnwindEx, InterlockedPushEntrySList, RtlUnwind, InitializeCriticalSectionAndSpinCount, LoadLibraryExW, ExitThread, FreeLibraryAndExitThread, SetStdHandle, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetTimeZoneInformation, DeleteFileW, FlushFileBuffers, GetConsoleMode, ReadConsoleW, GetConsoleOutputCP, SetFilePointerEx, HeapFree, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, HeapReAlloc, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, GetCommandLineA, GetProcessHeap, WriteConsoleW, WriteConsoleA, AttachConsole, GetStdHandle, MulDiv, GetCPInfo, CompareStringEx, SetEndOfFile, HeapSize, LCMapStringEx, DeleteCriticalSection, InitializeCriticalSectionEx, DecodePointer, EncodePointer, GetFileInformationByHandleEx, MoveFileExW, CopyFileW, AreFileApisANSI, GetTempPathW, GetCurrentThread, GetFullPathNameW, GetFileInformationByHandle, GetFileAttributesExW, SuspendThread, GetFileAttributesW, FindNextFileW, FindFirstFileExW, FindFirstFileW, CreateFileW, CreateDirectoryW, GetCurrentDirectoryW, SetCurrentDirectoryW, GetStringTypeW, MultiByteToWideChar, WideCharToMultiByte, WakeConditionVariable, TryAcquireSRWLockExclusive, GetNativeSystemInfo, GetExitCodeThread, Sleep, WaitForSingleObjectEx, GetLocaleInfoEx, FormatMessageA, LocalFree, RaiseException, RtlPcToFileHeader, InitializeSListHead, GetSystemTimeAsFileTime, TerminateProcess, GetModuleHandleW, IsProcessorFeaturePresent, GetStartupInfoW, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, SleepConditionVariableSRW, WakeAllConditionVariable, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, IsDebuggerPresent, GetFullPathNameA, RtlDeleteFunctionTable, GetSystemDirectoryA, InitializeCriticalSection, LeaveCriticalSection, RtlAddFunctionTable, EnterCriticalSection, FreeConsole, AllocConsole, FindClose, FindNextFileA, FindFirstFileA, GetConsoleWindow, GetLogicalProcessorInformation, QueryPerformanceCounter, QueryPerformanceFrequency, GetOverlappedResult, ReadFile, GetExitCodeProcess, WaitForSingleObject, CreateProcessA, CreateEventA, SetHandleInformation, CreatePipe, CreateNamedPipeA, GetCurrentThreadId, WriteProcessMemory, VirtualProtect, GetCurrentProcessId, GetCurrentProcess, FatalAppExitA, SetUnhandledExceptionFilter, WriteFile, CreateFileA, GetModuleFileNameA, ReadProcessMemory, GetVersionExA, GetThreadContext, ResumeThread
USER32.dll	FindWindowExW, ChildWindowFromPoint, GetDesktopWindow, UnionRect, GetComboBoxInfo, IsRectEmpty, ValidateRgn, ValidateRect, PostThreadMessageW, GetMessageW, GetMenuBarInfo, GetWindowDC, HideCaret, keybd_event, IsMenu, CheckMenuRadioItem, GetSysColorBrush, GetMenuItemID, CheckMenuItem, DrawFrameControl, DrawEdge, DrawIconEx, GetCaretBlinkTime, GetDoubleClickTime, TranslateAcceleratorW, DestroyAcceleratorTable, CreateAcceleratorTableW, GetClassNameW, MessageBeep, GetWindowTextLengthW, GetWindowTextW, GetClipboardFormatNameW, RegisterClipboardFormatW, SetForegroundWindow, GetSystemMenu, GetDialogBaseUnits, CreateDialogIndirectParamW, IsZoomed, BringWindowToTop, IsIconic, FlashWindowEx, SetLayeredWindowAttributes, GetMonitorInfoW, MonitorFromWindow, GetWindowPlacement, SetWindowRgn, InsertMenuItemW, SetMenuInfo, RemoveMenu, ModifyMenuW, AppendMenuW, InsertMenuW, EnableMenuItem, DestroyMenu, CreatePopupMenu, CreateMenu, DrawMenuBar, GetMenuState, GetDlgItem, CreateDialogParamW, SystemParametersInfoW, GetScrollInfo, SetScrollInfo, IsDialogMessageW, CallNextHookEx, UnhookWindowsHookEx, SetWindowsHookExW, GetWindow, SetParent, SetWindowLongW, PtInRect, ChildWindowFromPointEx, WindowFromPoint, MapWindowPoints, ScreenToClient, DdeQueryStringW, GetCursorPos, SetCursorPos, GetClientRect, DefMDIChildProcW, DefFrameProcW, AdjustWindowRectEx, EnableScrollBar, ScrollWindow, RedrawWindow, InvalidateRect, GetUpdateRgn, UpdateWindow, GetMenuItemInfoW, TrackPopupMenu, GetMenuItemCount, EnableWindow, ReleaseCapture, IsClipboardFormatAvailable, GetPropW, ChangeDisplaySettingsExW, EnumDisplaySettingsW, MonitorFromPoint, MonitorFromRect, EnumDisplayMonitors, wsprintfW, DdeInitializeW, DdeUninitialize, DdeConnect, DdeDisconnect, DdePostAdvise, DdeNameService, DdeClientTransaction, DdeCreateDataHandle, DdeGetData, SetCapture, GetCapture, MapVirtualKeyW, VkKeyScanW, GetAsyncKeyState, GetFocus, GetActiveWindow, SetFocus, IsWindowVisible, EndDeferWindowPos, DeferWindowPos, BeginDeferWindowPos, SetWindowPos, MoveWindow, AnimateWindow, ShowWindow, IsWindow, CallWindowProcW, DdeFreeStringHandle, PostQuitMessage, DefWindowProcW, GetMessageTime, GetMessagePos, UnregisterHotKey, RegisterHotKey, PeekMessageW, DispatchMessageW, TranslateMessage, CreateIconIndirect, DestroyCursor, GetIconInfo, LoadImageW, LoadBitmapW, SetWindowTextW, ReleaseDC, GetDC, SetWindowLongPtrW, GetWindowLongPtrW, OffsetRect, InflateRect, CopyRect, SetRectEmpty, SetRect, FillRect, DrawFocusRect, GetSysColor, DrawStateW, TranslateMDISysAccel, MessageBoxA, DdeFreeDataHandle, DdeGetLastError, GetParent, DdeCreateStringHandleW, DrawTextW, IsWindowEnabled, GetWindowRect, SetMenu, PostMessageW, RegisterWindowMessageW, GetWindowLongW, EndPaint, BeginPaint, DestroyWindow, CreateWindowExW, SendMessageW, LoadIconW, LoadCursorW, GetProcessDefaultLayout, MessageBoxW, GetKeyState, UnregisterClassW, KillTimer, SetTimer, MsgWaitForMultipleObjects, ClientToScreen, RegisterClassW, DestroyIcon, SetCursor, GetSystemMetrics, SetMenuItemInfoW, GetSubMenu, UpdateLayeredWindow
GDI32.dll	GdiFlush, ExtCreateRegion, GetRegionData, OffsetRgn, GetBkColor, LineTo, MoveToEx, ExtTextOutW, GetStockObject, CreateHatchBrush, CreatePatternBrush, CreatePen, ExtCreatePen, Arc, Ellipse, ExtFloodFill, GetClipBox, GetObjectType, GetPixel, MaskBlt, Pie, PolyPolygon, Rectangle, RoundRect, SelectClipRgn, ExtSelectClipRgn, SetGraphicsMode, SetMapMode, SetLayout, GetLayout, SetPixel, SetPolyFillMode, StretchDIBits, SetROP2, GetWorldTransform, SetWorldTransform, ModifyWorldTransform, CreatePolygonRgn, DPtoLP, LPtoDP, Polygon, SetBrushOrgEx, PolyBezier, SetViewportExtEx, SetWindowExtEx, SetWindowOrgEx, GetTextExtentPoint32W, CreatePalette, GetNearestPaletteIndex, GetPaletteEntries, GetCharABCWidthsW, GetTextExtentExPointW, CombineRgn, CreateRectRgnIndirect, RectInRegion, EqualRgn, GetRgnBox, PtInRegion, CreateDIBitmap, GetDIBits, CreateDIBSection, GetDIBColorTable, SetDIBColorTable, CreateICW, SetAbortProc, CreateDCW, StartDocW, EndDoc, StartPage, EndPage, EnumFontFamiliesExW, GetSystemPaletteEntries, CloseEnhMetaFile, CreateEnhMetaFileW, DeleteEnhMetaFile, GetEnhMetaFileW, GetEnhMetaFileHeader, PlayEnhMetaFile, SelectPalette, RealizePalette, ExcludeClipRect, CreateRectRgn, CreateCompatibleBitmap, CreateBitmapIndirect, CreateBitmap, SetStretchBltMode, BitBlt, StretchBlt, DeleteDC, CreateCompatibleDC, GetObjectW, GetTextMetricsW, SelectObject, GetOutlineTextMetricsW, GetDeviceCaps, CreateFontIndirectW, SetTextColor, SetBkMode, SetBkColor, GetWindowExtEx, GetViewportExtEx, GetGraphicsMode, DeleteObject, Polyline, CreateSolidBrush
WINSPOOL.DRV	OpenPrinterW, DocumentPropertiesW, ClosePrinter, GetPrinterW
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW, PageSetupDlgW, PrintDlgExW, PrintDlgW, CommDlgExtendedError, ChooseFontW, ChooseColorW
SHELL32.dll	ExtractIconExW, DragQueryFileW, DragQueryPoint, SHGetFolderPathW, CommandLineToArgvW, SHCreateItemFromParsingName, ExtractIconW, SHGetStockIconInfo, SHGetFileInfoW, Shell_NotifyIconW, ShellExecuteExW, DragAcceptFiles, DragFinish
ole32.dll	DoDragDrop, CoInitializeEx, CoTaskMemAlloc, RevokeDragDrop, OleGetClipboard, CoCreateInstance, CoLockObjectExternal, ReleaseStgMedium, OleUninitialize, OleInitialize, OleSetClipboard, OleFlushClipboard, OleIsCurrentClipboard, RegisterDragDrop, CoUninitialize, CoTaskMemFree
OLEACC.dll	LresultFromObject
UxTheme.dll	CloseThemeData, IsThemeBackgroundPartiallyTransparent, GetThemeMargins, DrawThemeParentBackground, GetThemeBackgroundContentRect, GetThemePartSize, GetCurrentThemeName, GetThemeBackgroundExtent, IsThemePartDefined, GetThemeTextExtent, GetThemeFont, IsAppThemed, IsThemeActive, GetThemeColor, DrawThemeBackground, OpenThemeData, DrawThemeTextEx, SetWindowTheme, GetThemeSysFont, GetThemeSysColor, GetThemeInt
VERSION.dll	GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA
MSIMG32.dll	GradientFill, AlphaBlend
SHLWAPI.dll	PathMatchSpecW, SHAutoComplete
COMCTL32.dll	ImageList_GetImageInfo, ImageList_GetIconSize, ImageList_GetIcon, ImageList_Remove, ImageList_AddMasked, ImageList_Replace, ImageList_Draw, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
RPCRT4.dll	UuidToStringW, RpcStringFreeW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	07:08:59
Start date:	14/04/2024
Path:	C:\Users\user\Desktop\SoundTune.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SoundTune.exe"
Imagebase:	0x7ff77a350000
File size:	9'888'656 bytes
MD5 hash:	9FAE2084F15F67CC3549BDCDBA10E595
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2053261362.0000022584B90000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:09:01
Start date:	14/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.2330278372.0000000004A99000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2330822665.00000000054A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:09:01
Start date:	14/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:09:12
Start date:	14/04/2024
Path:	C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe
Imagebase:	0x7ff6fde40000
File size:	9'888'656 bytes
MD5 hash:	9FAE2084F15F67CC3549BDCDBA10E595
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000005.00000002.2243163643.00000278AB600000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:09:13
Start date:	14/04/2024
Path:	C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe
Imagebase:	0x7ff6fde40000
File size:	9'888'656 bytes
MD5 hash:	9FAE2084F15F67CC3549BDCDBA10E595
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000006.00000002.2201257984.000002A37F99F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:09:14
Start date:	14/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000007.00000002.2413913656.000000000541B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000002.2414191195.0000000005A20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 5248, Parent PID: 3500

General

Target ID:	8
Start time:	07:09:15
Start date:	14/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:09:20
Start date:	14/04/2024
Path:	C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\updatefa\SoundTune.exe"
Imagebase:	0x7ff6fde40000
File size:	9'888'656 bytes
MD5 hash:	9FAE2084F15F67CC3549BDCDBA10E595
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000D.00000002.2254650455.0000025B712CB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:09:21
Start date:	14/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000002.2479094817.0000000005900000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000E.00000002.2478639571.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 3924, Parent PID: 3652

General

Target ID:	15
Start time:	07:09:21
Start date:	14/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:09:22
Start date:	14/04/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x40000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000010.00000002.2330168207.00000000047A9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000002.2329605585.0000000002591000.00000020.00000001.01000000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:09:29
Start date:	14/04/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x40000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000002.2414365443.0000000002591000.00000004.00000001.01000000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000011.00000002.2414793420.0000000004919000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	07:09:35
Start date:	14/04/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x40000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000012.00000002.2478523985.0000000004CA2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000012.00000002.2477851015.0000000002C41000.00000020.00000001.01000000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Function 00007FF77A4CA264 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF77A4CA290
GetCurrentThreadId.KERNEL32 ref: 00007FF77A4CA29E
GetCurrentProcessId.KERNEL32 ref: 00007FF77A4CA2AA
QueryPerformanceCounter.KERNEL32 ref: 00007FF77A4CA2BA

Memory Dump Source

Source File: 00000000.00000002.2054106831.00007FF77A351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77A350000, based on PE: true

Associated: 00000000.00000002.2054084454.00007FF77A350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054568199.00007FF77A8E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054789704.00007FF77AB2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054821048.00007FF77AB33000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054853341.00007FF77AB46000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054853341.00007FF77AB52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054853341.00007FF77AB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054939920.00007FF77AB9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77a350000_SoundTune.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d24632a9d7cbfeac47ec91ea4afc9551f528e4bafdd956463c956835574216d6
Instruction ID: 114739ecf774822932b71b029816236804458216cc47fe4a0f76f695fe55340b
Opcode Fuzzy Hash: d24632a9d7cbfeac47ec91ea4afc9551f528e4bafdd956463c956835574216d6
Instruction Fuzzy Hash: CF111C23B28F0189FB009B64E8542A8B3A4FB59758F840E31EA6D46BA4DF7CD1648350

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SoundTune.exePID: 6360, Parent PID: 1068COMMON

Non-executed Functions

Function 00000278A82EA7D0 Relevance: 15.4, APIs: 6, Strings: 2, Instructions: 1382COMMON

Download Yara Rule

Strings

F, xrefs: 00000278A82EA88B
F, xrefs: 00000278A82EB802

Memory Dump Source

Source File: 00000005.00000002.2238113527.00000278A82D4000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278A82D4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278a82d4000_SoundTune.jbxd

Similarity

API ID:
String ID: F$F
API String ID: 0-3842059619
Opcode ID: 4ee8cd6e0099949ee7e3de4809a1d67a6e3a3d3dda47f7623f4c4ef407459fc0
Instruction ID: 592b6115601777a03f9d273a82e1a71b97f3c3b6cad5b717c0e81dc2abf4408d
Opcode Fuzzy Hash: 4ee8cd6e0099949ee7e3de4809a1d67a6e3a3d3dda47f7623f4c4ef407459fc0
Instruction Fuzzy Hash: D4B2917159CA498FE762DB68C88E3A67AE1FBA5300F54412BD04AC72E1EF34C485CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00000278A82EC9D0 Relevance: 15.4, APIs: 6, Strings: 2, Instructions: 1382COMMON

Download Yara Rule

Strings

N, xrefs: 00000278A82EDA02
N, xrefs: 00000278A82ECA8B

Memory Dump Source

Source File: 00000005.00000002.2238113527.00000278A82D4000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278A82D4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278a82d4000_SoundTune.jbxd

Similarity

API ID:
String ID: N$N
API String ID: 0-3855217897
Opcode ID: ee48e87e63c0dfedfa4d5318cedfa5ca47cce991329359ddbdce0cfcca9fc923
Instruction ID: 03ce9f71c9ccc9281112035d30aba12ea52bd376e54005c1ce44076d0eca6d19
Opcode Fuzzy Hash: ee48e87e63c0dfedfa4d5318cedfa5ca47cce991329359ddbdce0cfcca9fc923
Instruction Fuzzy Hash: DAB29F3159CA498FE762EB28C84E7B67AE1FBA5300F54412BD04DC72E1EF748981CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00000278A82E96D0 Relevance: 15.4, APIs: 6, Strings: 2, Instructions: 1382COMMON

Download Yara Rule

Strings

A, xrefs: 00000278A82EA702
A, xrefs: 00000278A82E978B

Memory Dump Source

Source File: 00000005.00000002.2238113527.00000278A82D4000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278A82D4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278a82d4000_SoundTune.jbxd

Similarity

API ID:
String ID: A$A
API String ID: 0-2116726341
Opcode ID: cc709553d37fb9f742f60e05f6f9532686fe4be471f2e81f3f8d64585817493e
Instruction ID: c149c9b0eaac1d0d0e3fbaf0c91b4eb6ff9cb1604c60ceebf0dd35a6e77258ad
Opcode Fuzzy Hash: cc709553d37fb9f742f60e05f6f9532686fe4be471f2e81f3f8d64585817493e
Instruction Fuzzy Hash: 70B2923159CA498FE762DB28C88A7AA7BE0FBA5300F54416BD04EC71E1FF748485CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00000278A82EB8D0 Relevance: 15.4, APIs: 6, Strings: 2, Instructions: 1382COMMON

Download Yara Rule

Strings

I, xrefs: 00000278A82EC902
I, xrefs: 00000278A82EB98B

Memory Dump Source

Source File: 00000005.00000002.2238113527.00000278A82D4000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278A82D4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278a82d4000_SoundTune.jbxd

Similarity

API ID:
String ID: I$I
API String ID: 0-2128771023
Opcode ID: 9d629832e2347b0e85e4e90e9fab74ea1ae34d6c0a7c66158f31fbb2b7efbab1
Instruction ID: 1973aa326f15ea990c9fb9c01b6db2bbfb4ed590b0d2a69b469cab640f3edbd8
Opcode Fuzzy Hash: 9d629832e2347b0e85e4e90e9fab74ea1ae34d6c0a7c66158f31fbb2b7efbab1
Instruction Fuzzy Hash: 14B293315A8A498FE762DB68C84E3BA7BE0FBA5301F54412BD049C71E1FF748885CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00000278A82EDAD0 Relevance: 15.4, APIs: 6, Strings: 2, Instructions: 1382COMMON

Download Yara Rule

Strings

A, xrefs: 00000278A82EEB02
A, xrefs: 00000278A82EDB8B

Memory Dump Source

Source File: 00000005.00000002.2238113527.00000278A82D4000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278A82D4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278a82d4000_SoundTune.jbxd

Similarity

API ID:
String ID: A$A
API String ID: 0-2116726341
Opcode ID: 13a9e0c9c5d3a4d7b9cdafbb92186155365882b569e8a2d2909a03f4d75ef840
Instruction ID: 151353e295102e71f58c0d1962f32d528601eb6f2c2a77ed32f17685a72dea8d
Opcode Fuzzy Hash: 13a9e0c9c5d3a4d7b9cdafbb92186155365882b569e8a2d2909a03f4d75ef840
Instruction Fuzzy Hash: F1B2B375558A488FE772EB28D84E3BA7AE1FB91300F54412BD04AC71E2FF748885CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00000278AE3DC89D Relevance: 5.7, Strings: 4, Instructions: 661COMMON

Download Yara Rule

Strings

?, xrefs: 00000278AE3DCA0D
r, xrefs: 00000278AE3DC982
Mb=L, xrefs: 00000278AE3DCE1C
G, xrefs: 00000278AE3DCEC1

Memory Dump Source

Source File: 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278AE3D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278ae3d1000_SoundTune.jbxd

Yara matches

Similarity

API ID:
String ID: ?$G$Mb=L$r
API String ID: 0-3654495462
Opcode ID: 8f6580deefc9ef82fb16fd9907306da5e85ba4bdcd4373a521f3b78b7fee00db
Instruction ID: 5200eec9a41f271ece7d1a0248862c9533e83b4da8447af816d3b56546e3ef42
Opcode Fuzzy Hash: 8f6580deefc9ef82fb16fd9907306da5e85ba4bdcd4373a521f3b78b7fee00db
Instruction Fuzzy Hash: BD420D3111CB888FE7A4EB18C499B9AB7E5FBA9300F50496EE0CDC72A1DB74D545CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00000278AE3DA25F Relevance: 5.5, Strings: 4, Instructions: 538COMMON

Download Yara Rule

Strings

G, xrefs: 00000278AE3DA6D0
?, xrefs: 00000278AE3DA36F
r, xrefs: 00000278AE3DA309
Mb=L, xrefs: 00000278AE3DA6D9, 00000278AE3DA6DC

Memory Dump Source

Source File: 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278AE3D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278ae3d1000_SoundTune.jbxd

Yara matches

Similarity

API ID:
String ID: ?$G$Mb=L$r
API String ID: 0-3654495462
Opcode ID: 48b1b01cc0f6f2c6672f808714e99a76ab20513145e0672fad2e55d988f32716
Instruction ID: 02dcc4be7a684770d8607017d65c800caebc07fa26edc63a65a13d842ffe4c2a
Opcode Fuzzy Hash: 48b1b01cc0f6f2c6672f808714e99a76ab20513145e0672fad2e55d988f32716
Instruction Fuzzy Hash: E9326D75E04208DFDB04CFA8C585BEEBBB5FF89300F208559E559AB391D735AA42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00000278AB618BB0 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2243163643.00000278AB600000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278AB600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278ab600000_SoundTune.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e99f7be9754a4167ea69dca9a5031b767fcc4f5de38cfc64e6778bbb43c050
Instruction ID: 137570d70a1223c4c837720bade577927c1d9a7dcfa7c96a0d99f39a62d9d390
Opcode Fuzzy Hash: 74e99f7be9754a4167ea69dca9a5031b767fcc4f5de38cfc64e6778bbb43c050
Instruction Fuzzy Hash: 80C1A974268A489FDBC4EF5CD498F66BBE1FFA9300F941499F04DCB2A1DA25E801DB11

Uniqueness

Uniqueness Score: -1.00%

Function 00000278A83000B8 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2238113527.00000278A82D4000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278A82D4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278a82d4000_SoundTune.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4dfddccc88188192dd0ef26447d97251ced8e11b36c8ed9b66b0a98952fcd64
Instruction ID: 041ac4dba5c495d116231748777083bd7e0600013c03cace135737deeaf30009
Opcode Fuzzy Hash: e4dfddccc88188192dd0ef26447d97251ced8e11b36c8ed9b66b0a98952fcd64
Instruction Fuzzy Hash: 93A19F8288E3D01FEB4387B848BD6913FB09F17154B1E45DBC4C98F4B3DA48595AD762

Uniqueness

Uniqueness Score: -1.00%

Function 00000278AE40137A Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278AE3D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278ae3d1000_SoundTune.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0584256760886f1c0de052bda9cb983dfa805c86c380863e95e061973f17d90d
Instruction ID: 40f66af078e4c565d7c67893b19362f168eca241db5d0816073b20d2520f6409
Opcode Fuzzy Hash: 0584256760886f1c0de052bda9cb983dfa805c86c380863e95e061973f17d90d
Instruction Fuzzy Hash: E4B18679645604AFEB08DF20C49AE6937A6BF89350F108969FD4D4F392DB39ED41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00000278AE402D9A Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278AE3D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278ae3d1000_SoundTune.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0188eab908d132f09881b594e4668dde1a15273a1c878c0fa1d29f8a98a688
Instruction ID: b702c6761b154d6b9e75b9f73fee4ff0421d0dd26a85c3769f803dfea2b62177
Opcode Fuzzy Hash: 5f0188eab908d132f09881b594e4668dde1a15273a1c878c0fa1d29f8a98a688
Instruction Fuzzy Hash: 81A193B5604104EFDB44DF54C489EAA77BABF88340F108559F94D8F382DA39EE42DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00000278AB618700 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2243163643.00000278AB600000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278AB600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278ab600000_SoundTune.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b38f73b0a4d43c3d345f33e4ad5e53a60e6b22988b1a985ab0bd22df309355
Instruction ID: 56d1719974d0af03438b1e9852df8ea2772eccbd7a7a1c72d74e4cf2d2c53cd4
Opcode Fuzzy Hash: 17b38f73b0a4d43c3d345f33e4ad5e53a60e6b22988b1a985ab0bd22df309355
Instruction Fuzzy Hash: 117153302586159FE780DFA8E45D7BABBE4FF5A301F8408A6F14ECB292CE15DC019751

Uniqueness

Uniqueness Score: -1.00%

Function 00000278AE400F2A Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278AE3D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278ae3d1000_SoundTune.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 186fe38cc052511de10dfd47768647201f785e6ccd01fae26765a661eda3a6e4
Instruction ID: 4f50ba559de400b07f75cf23819577b24fb2d2b680a151ac06eba59296112609
Opcode Fuzzy Hash: 186fe38cc052511de10dfd47768647201f785e6ccd01fae26765a661eda3a6e4
Instruction Fuzzy Hash: 0371CAB66496006BEB08DE30C45FBA7335A6F49340F008975F9894F3C2DE3EEE019691

Uniqueness

Uniqueness Score: -1.00%

Function 00000278AE3F5986 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278AE3D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278ae3d1000_SoundTune.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d58e5e0029f841941ee71f791d62e557e3015b908add20f1f5d801ed639b7bd
Instruction ID: 4388b2614a45bbe4751f53b75331b334ec66a42169baeed66b1aa8bccd59cc9a
Opcode Fuzzy Hash: 1d58e5e0029f841941ee71f791d62e557e3015b908add20f1f5d801ed639b7bd
Instruction Fuzzy Hash: 53219933D55505AFEB21EB64C68E69AB3F4FF44710F250C2BD4899B291DBB1AD01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00000278AE3E3FD5 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278AE3D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278ae3d1000_SoundTune.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cd9824c77b7b7b3d32199752a248329110d2d7983c4df8e0aad9ad6444cee97
Instruction ID: 1eb811949aa6d55ff79d2cc468f288c43288b475eba39395633f1ba861c92c10
Opcode Fuzzy Hash: 6cd9824c77b7b7b3d32199752a248329110d2d7983c4df8e0aad9ad6444cee97
Instruction Fuzzy Hash: EA217332D482059FEB60DB68C54E6AAF3F5EF88710F1508BAE48993691FB70AD018740

Uniqueness

Uniqueness Score: -1.00%

Function 00000278AE3F5D97 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278AE3D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278ae3d1000_SoundTune.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00000278AE3E0F53 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278AE3D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278ae3d1000_SoundTune.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00000278AE3E40CF Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278AE3D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278ae3d1000_SoundTune.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00000278AB60A950 Relevance: 36.5, Strings: 29, Instructions: 244COMMON

Download Yara Rule

Strings

/, xrefs: 00000278AB60AA1A
c, xrefs: 00000278AB60AA1F
m, xrefs: 00000278AB60AA4C
n, xrefs: 00000278AB60AA56
c, xrefs: 00000278AB60A9F2
%, xrefs: 00000278AB60AA74
", xrefs: 00000278AB60AA7E
, xrefs: 00000278AB60AA15
s, xrefs: 00000278AB60AA29
/, xrefs: 00000278AB60AA47
, xrefs: 00000278AB60AA6A
d, xrefs: 00000278AB60A9FC
a, xrefs: 00000278AB60AA33
e, xrefs: 00000278AB60AA10
", xrefs: 00000278AB60AA65
t, xrefs: 00000278AB60AA2E
., xrefs: 00000278AB60AA01
, xrefs: 00000278AB60AA24
, xrefs: 00000278AB60AA5B
, xrefs: 00000278AB60AA42
e, xrefs: 00000278AB60AA06
", xrefs: 00000278AB60AA60
i, xrefs: 00000278AB60AA51
m, xrefs: 00000278AB60A9F7
s, xrefs: 00000278AB60AA79
t, xrefs: 00000278AB60AA3D
r, xrefs: 00000278AB60AA38
", xrefs: 00000278AB60AA6F
x, xrefs: 00000278AB60AA0B

Memory Dump Source

Source File: 00000005.00000002.2243163643.00000278AB600000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278AB600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278ab600000_SoundTune.jbxd

Yara matches

Similarity

API ID:
String ID: $ $ $ $ $"$"$"$"$%$.$/$/$a$c$c$d$e$e$i$m$m$n$r$s$s$t$t$x
API String ID: 0-407333426
Opcode ID: efd4f444f1070b543fb005905694dfbca1e8ce65fe8e0cd3f6e4f275d1c7893f
Instruction ID: 7a9700609c4216871dd7a13e7ff42007b9c9746e4a3857d234cce0f6d72092a0
Opcode Fuzzy Hash: efd4f444f1070b543fb005905694dfbca1e8ce65fe8e0cd3f6e4f275d1c7893f
Instruction Fuzzy Hash: 74B1043011CBC48FE7A1DB28C458B9BBBE1FBA9344F54485DA0C9C72A2CA79D944CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00000278AB60C6C0 Relevance: 34.0, Strings: 27, Instructions: 203COMMON

Download Yara Rule

Strings

l, xrefs: 00000278AB60C852
S, xrefs: 00000278AB60C7A6
N, xrefs: 00000278AB60C7B1
&, xrefs: 00000278AB60C77A
Q, xrefs: 00000278AB60C809
;, xrefs: 00000278AB60C761
Xa4, xrefs: 00000278AB60CA19
H, xrefs: 00000278AB60C70A
o, xrefs: 00000278AB60C702
Xa4, xrefs: 00000278AB60C988
X, xrefs: 00000278AB60C7E8
M, xrefs: 00000278AB60C73B
", xrefs: 00000278AB60C880
W, xrefs: 00000278AB60C7C1
_, xrefs: 00000278AB60C847
w, xrefs: 00000278AB60C785
=, xrefs: 00000278AB60C751
F, xrefs: 00000278AB60C814
, xrefs: 00000278AB60C725
g, xrefs: 00000278AB60C6FA
3, xrefs: 00000278AB60C7F3
Xa4, xrefs: 00000278AB60C98C
6, xrefs: 00000278AB60C766
Xa4, xrefs: 00000278AB60C9D9
w, xrefs: 00000278AB60C955
1, xrefs: 00000278AB60C7C6
x, xrefs: 00000278AB60C79B

Memory Dump Source

Source File: 00000005.00000002.2243163643.00000278AB600000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278AB600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278ab600000_SoundTune.jbxd

Yara matches

Similarity

API ID:
String ID: $"$&$1$3$6$;$=$F$H$M$N$Q$S$W$X$Xa4$Xa4$Xa4$Xa4$_$g$l$o$w$w$x
API String ID: 0-1030656984
Opcode ID: d51c9e0b5b090725f69d30dbca927642991fc7c199e8415c61726fa51ff925f5
Instruction ID: f65e41d11657e44f3d9c7ab7c633fdaf35a514e4bb137ff36592c484a0f7130e
Opcode Fuzzy Hash: d51c9e0b5b090725f69d30dbca927642991fc7c199e8415c61726fa51ff925f5
Instruction Fuzzy Hash: A7A1E57021C7808BE364DF28C59875EBAE0FB89308F50592EF1D9CB3A1D7B98945CB06

Uniqueness

Uniqueness Score: -1.00%

Function 00000278AB60CC50 Relevance: 34.0, Strings: 27, Instructions: 203COMMON

Download Yara Rule

Strings

Xa4, xrefs: 00000278AB60CF18
x, xrefs: 00000278AB60CD2B
6, xrefs: 00000278AB60CCF6
M, xrefs: 00000278AB60CCCB
1, xrefs: 00000278AB60CD56
Q, xrefs: 00000278AB60CD99
3, xrefs: 00000278AB60CD83
w, xrefs: 00000278AB60CD15
g, xrefs: 00000278AB60CC8A
Xa4, xrefs: 00000278AB60CFA9
N, xrefs: 00000278AB60CD41
S, xrefs: 00000278AB60CD36
W, xrefs: 00000278AB60CD51
Xa4, xrefs: 00000278AB60CF1C
X, xrefs: 00000278AB60CD78
Xa4, xrefs: 00000278AB60CF69
&, xrefs: 00000278AB60CD0A
, xrefs: 00000278AB60CCB5
", xrefs: 00000278AB60CE10
H, xrefs: 00000278AB60CC9A
l, xrefs: 00000278AB60CDE2
F, xrefs: 00000278AB60CDA4
w, xrefs: 00000278AB60CEE5
;, xrefs: 00000278AB60CCF1
_, xrefs: 00000278AB60CDD7
o, xrefs: 00000278AB60CC92
=, xrefs: 00000278AB60CCE1

Memory Dump Source

Source File: 00000005.00000002.2243163643.00000278AB600000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278AB600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278ab600000_SoundTune.jbxd

Yara matches

Similarity

API ID:
String ID: $"$&$1$3$6$;$=$F$H$M$N$Q$S$W$X$Xa4$Xa4$Xa4$Xa4$_$g$l$o$w$w$x
API String ID: 0-1030656984
Opcode ID: 6d3ebd19bb5a44dbed7d84cb9fb5a42c73d0dacfff23186c174dda975f8ead67
Instruction ID: eb0ba43b4cb8ebe2e83a024c9cd33a15f93f97810066a290ea9e3c440553b08d
Opcode Fuzzy Hash: 6d3ebd19bb5a44dbed7d84cb9fb5a42c73d0dacfff23186c174dda975f8ead67
Instruction Fuzzy Hash: 2DA1C37020C7818BE3649F28C59875EBAE1FB89308F50592EF1D9DB3A1D7B98945CB07

Uniqueness

Uniqueness Score: -1.00%

Function 00000278AE3E3A92 Relevance: 31.4, Strings: 25, Instructions: 147COMMON

Download Yara Rule

Strings

3, xrefs: 00000278AE3E3B8E
g, xrefs: 00000278AE3E3AE2
=, xrefs: 00000278AE3E3B20
&, xrefs: 00000278AE3E3B3B
o, xrefs: 00000278AE3E3AEC
_, xrefs: 00000278AE3E3BCB
", xrefs: 00000278AE3E3AC7
Xa4, xrefs: 00000278AE3E3C70
w, xrefs: 00000278AE3E3B42
H, xrefs: 00000278AE3E3AF3
6, xrefs: 00000278AE3E3B2F
S, xrefs: 00000278AE3E3B57
Q, xrefs: 00000278AE3E3B9C
, xrefs: 00000278AE3E3B08
w, xrefs: 00000278AE3E3C21
j, xrefs: 00000278AE3E3C13
;, xrefs: 00000278AE3E3B2B
l, xrefs: 00000278AE3E3BD2
Xa4, xrefs: 00000278AE3E3AB3
Xa4, xrefs: 00000278AE3E3CA2
X, xrefs: 00000278AE3E3B87
W, xrefs: 00000278AE3E3B69
N, xrefs: 00000278AE3E3B5E
x, xrefs: 00000278AE3E3B50
Xa4, xrefs: 00000278AE3E3C53

Memory Dump Source

Source File: 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278AE3D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278ae3d1000_SoundTune.jbxd

Yara matches

Similarity

API ID:
String ID: $"$&$3$6$;$=$H$N$Q$S$W$X$Xa4$Xa4$Xa4$Xa4$_$g$j$l$o$w$w$x
API String ID: 0-2902430524
Opcode ID: 0a2c656b731585a4625f2ba0236d19889665718c32ac025bede13eea2fb82884
Instruction ID: 4619d10df652512a632b95c97ce9ffd2572f4e3fc233ccdbc4425f05db6018a3
Opcode Fuzzy Hash: 0a2c656b731585a4625f2ba0236d19889665718c32ac025bede13eea2fb82884
Instruction Fuzzy Hash: 06617871D04289DAEB10CFA8C8893EDFBF1AF04318F14859AD458BB391D7B95A4ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 00000278AE3F5753 Relevance: 31.4, Strings: 25, Instructions: 147COMMON

Download Yara Rule

Strings

Q, xrefs: 00000278AE3F585D
w, xrefs: 00000278AE3F5803
w, xrefs: 00000278AE3F58E2
&, xrefs: 00000278AE3F57FC
Xa4, xrefs: 00000278AE3F5914
j, xrefs: 00000278AE3F58D4
N, xrefs: 00000278AE3F581F
_, xrefs: 00000278AE3F588C
Xa4, xrefs: 00000278AE3F5963
Xa4, xrefs: 00000278AE3F5931
;, xrefs: 00000278AE3F57EC
g, xrefs: 00000278AE3F57A3
l, xrefs: 00000278AE3F5893
6, xrefs: 00000278AE3F57F0
H, xrefs: 00000278AE3F57B4
W, xrefs: 00000278AE3F582A
, xrefs: 00000278AE3F57C9
x, xrefs: 00000278AE3F5811
", xrefs: 00000278AE3F5788
X, xrefs: 00000278AE3F5848
=, xrefs: 00000278AE3F57E1
o, xrefs: 00000278AE3F57AD
S, xrefs: 00000278AE3F5818
3, xrefs: 00000278AE3F584F
Xa4, xrefs: 00000278AE3F5774

Memory Dump Source

Source File: 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278AE3D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278ae3d1000_SoundTune.jbxd

Yara matches

Similarity

API ID:
String ID: $"$&$3$6$;$=$H$N$Q$S$W$X$Xa4$Xa4$Xa4$Xa4$_$g$j$l$o$w$w$x
API String ID: 0-2902430524
Opcode ID: 0a2c656b731585a4625f2ba0236d19889665718c32ac025bede13eea2fb82884
Instruction ID: bbfae3f941ab63c5bcaf32751adb4ac58f90a6d6eb2e0fc7cbaf48ddc9020c56
Opcode Fuzzy Hash: 0a2c656b731585a4625f2ba0236d19889665718c32ac025bede13eea2fb82884
Instruction Fuzzy Hash: A5616971D04289DAEB10DFA8D9483EEBBF1EF05318F10855AD458BB391D7BA0A4ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 00000278AE3F5A48 Relevance: 28.9, Strings: 23, Instructions: 147COMMON

Download Yara Rule

Strings

j, xrefs: 00000278AE3F5BC3
l, xrefs: 00000278AE3F5B7B
N, xrefs: 00000278AE3F5B07
&, xrefs: 00000278AE3F5AE4
=, xrefs: 00000278AE3F5AC9
_, xrefs: 00000278AE3F5B74
6, xrefs: 00000278AE3F5AD8
g, xrefs: 00000278AE3F5A8B
o, xrefs: 00000278AE3F5A95
3, xrefs: 00000278AE3F5B37
, xrefs: 00000278AE3F5AB1
", xrefs: 00000278AE3F5B82
w, xrefs: 00000278AE3F5AEB
W, xrefs: 00000278AE3F5B12
H, xrefs: 00000278AE3F5A9C
x, xrefs: 00000278AE3F5AF9
w, xrefs: 00000278AE3F5BD1
Xa4, xrefs: 00000278AE3F5C1F
Xa4, xrefs: 00000278AE3F5A7A
S, xrefs: 00000278AE3F5B00
;, xrefs: 00000278AE3F5AD4
Q, xrefs: 00000278AE3F5B45
X, xrefs: 00000278AE3F5B30

Memory Dump Source

Source File: 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278AE3D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278ae3d1000_SoundTune.jbxd

Yara matches

Similarity

API ID:
String ID: $"$&$3$6$;$=$H$N$Q$S$W$X$Xa4$Xa4$_$g$j$l$o$w$w$x
API String ID: 0-124078437
Opcode ID: 6f957bf0e52ff8f6cda14630bee9f7884332855c505a2a3676227f2166986fb8
Instruction ID: 8636dcb50f6aa4495bb6b8a65ba88eff08cbf79d0da9ca3f07f859c98e8e2f59
Opcode Fuzzy Hash: 6f957bf0e52ff8f6cda14630bee9f7884332855c505a2a3676227f2166986fb8
Instruction Fuzzy Hash: A7617B70D49289DAEF10DFA8C9483EDBBF1AF05304F20815AD058BB3C1D7BA4A49CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00000278AE3E3CC5 Relevance: 28.9, Strings: 23, Instructions: 147COMMON

Download Yara Rule

Strings

w, xrefs: 00000278AE3E3E4E
x, xrefs: 00000278AE3E3D76
o, xrefs: 00000278AE3E3D12
;, xrefs: 00000278AE3E3D51
H, xrefs: 00000278AE3E3D19
w, xrefs: 00000278AE3E3D68
, xrefs: 00000278AE3E3D2E
N, xrefs: 00000278AE3E3D84
=, xrefs: 00000278AE3E3D46
3, xrefs: 00000278AE3E3DB4
Q, xrefs: 00000278AE3E3DC2
W, xrefs: 00000278AE3E3D8F
Xa4, xrefs: 00000278AE3E3E9C
l, xrefs: 00000278AE3E3DF8
&, xrefs: 00000278AE3E3D61
6, xrefs: 00000278AE3E3D55
X, xrefs: 00000278AE3E3DAD
Xa4, xrefs: 00000278AE3E3CF7
j, xrefs: 00000278AE3E3E40
S, xrefs: 00000278AE3E3D7D
g, xrefs: 00000278AE3E3D08
", xrefs: 00000278AE3E3DFF
_, xrefs: 00000278AE3E3DF1

Memory Dump Source

Source File: 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278AE3D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278ae3d1000_SoundTune.jbxd

Yara matches

Similarity

API ID:
String ID: $"$&$3$6$;$=$H$N$Q$S$W$X$Xa4$Xa4$_$g$j$l$o$w$w$x
API String ID: 0-124078437
Opcode ID: 6f957bf0e52ff8f6cda14630bee9f7884332855c505a2a3676227f2166986fb8
Instruction ID: 4ecd6108a8958eb0023f76319751f2b3b8772be1c4ce6103e792dc01039d3f41
Opcode Fuzzy Hash: 6f957bf0e52ff8f6cda14630bee9f7884332855c505a2a3676227f2166986fb8
Instruction Fuzzy Hash: 96618C71D08289DAEF10CFA8C9483EDBBF1AF55308F24815AD458BB3C1D7B90A4ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 00000278AE3DC46D Relevance: 17.6, Strings: 14, Instructions: 128COMMON

Download Yara Rule

Strings

a, xrefs: 00000278AE3DC577
x, xrefs: 00000278AE3DC58B
m, xrefs: 00000278AE3DC57C
t, xrefs: 00000278AE3DC559
e, xrefs: 00000278AE3DC581
e, xrefs: 00000278AE3DC554
s, xrefs: 00000278AE3DC563
G, xrefs: 00000278AE3DC54F
E, xrefs: 00000278AE3DC586
N, xrefs: 00000278AE3DC572
W, xrefs: 00000278AE3DC590
r, xrefs: 00000278AE3DC56D
U, xrefs: 00000278AE3DC55E
e, xrefs: 00000278AE3DC568

Memory Dump Source

Source File: 00000005.00000002.2244717993.00000278AE3D1000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278AE3D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278ae3d1000_SoundTune.jbxd

Yara matches

Similarity

API ID:
String ID: E$G$N$U$W$a$e$e$e$m$r$s$t$x
API String ID: 0-1325830154
Opcode ID: 77d8e45362ac90ce13e70f84bf46c132bdeb855c935fa87385f52472c5ab7223
Instruction ID: 645fa5ec1269cb3c7a1d6a115617101ea04910318147fff5e29a27aa093ea3df
Opcode Fuzzy Hash: 77d8e45362ac90ce13e70f84bf46c132bdeb855c935fa87385f52472c5ab7223
Instruction Fuzzy Hash: F551AF3451C7848FE790DB68C08875ABBE1EFA9305F44595EF0C9C72A1DABAC944CB17

Uniqueness

Uniqueness Score: -1.00%

Function 00000278AB6154C0 Relevance: 15.1, Strings: 12, Instructions: 110COMMON

Download Yara Rule

Strings

t, xrefs: 00000278AB615570
o, xrefs: 00000278AB61555C
a, xrefs: 00000278AB61557A
i, xrefs: 00000278AB61556B
C, xrefs: 00000278AB615557
i, xrefs: 00000278AB615575
I, xrefs: 00000278AB615561
i, xrefs: 00000278AB615584
n, xrefs: 00000278AB615566
e, xrefs: 00000278AB61558E
z, xrefs: 00000278AB615589
l, xrefs: 00000278AB61557F

Memory Dump Source

Source File: 00000005.00000002.2243163643.00000278AB600000.00000004.00000020.00020000.00000000.sdmp, Offset: 00000278AB600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_278ab600000_SoundTune.jbxd

Yara matches

Similarity

API ID:
String ID: C$I$a$e$i$i$i$l$n$o$t$z
API String ID: 0-3631944187
Opcode ID: 374f5339107ca790e6ba45c4230742c1aebc487dbf654c531ba010c7fd23baf2
Instruction ID: 2600e1d9e83dd59db107c37fbf2bd4d8a7a3f3e21a093c22dd2db37aafa45db6
Opcode Fuzzy Hash: 374f5339107ca790e6ba45c4230742c1aebc487dbf654c531ba010c7fd23baf2
Instruction Fuzzy Hash: B941FB3461C7888FE791DB28C048B6ABBE2FFA9304F44196EB08DC72A1D676C545C717

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SoundTune.exePID: 2448, Parent PID: 1068COMMON

Non-executed Functions

Function 000002A37CBF707A Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2199752462.000002A37CBF0000.00000004.00000020.00020000.00000000.sdmp, Offset: 000002A37CBF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a37cbf0000_SoundTune.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e823343bdd2ca0a3ece7c4bd8bf698368fe962fc053a27b5877336254ca9f80
Instruction ID: 5c4386e9fe12cbb0743ed774f42b0b85017964c0cc8f7fbe8650a1f34cb27692
Opcode Fuzzy Hash: 8e823343bdd2ca0a3ece7c4bd8bf698368fe962fc053a27b5877336254ca9f80
Instruction Fuzzy Hash: 4551CE8664E3D05FE71383B92CA96D4BFB48F57214F1A08DBE0C49B2E3D919562AC316

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SoundTune.exePID: 6332, Parent PID: 5708COMMON

Non-executed Functions

Function 00007FF6FDFBA264 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6FDFBA290
GetCurrentThreadId.KERNEL32 ref: 00007FF6FDFBA29E
GetCurrentProcessId.KERNEL32 ref: 00007FF6FDFBA2AA
QueryPerformanceCounter.KERNEL32 ref: 00007FF6FDFBA2BA

Memory Dump Source

Source File: 0000000D.00000002.2256268537.00007FF6FDE41000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6FDE40000, based on PE: true

Associated: 0000000D.00000002.2256231509.00007FF6FDE40000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2257278341.00007FF6FE3D9000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2257714453.00007FF6FE61C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2257744654.00007FF6FE623000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2257773979.00007FF6FE636000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2257773979.00007FF6FE642000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2257773979.00007FF6FE664000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2258013462.00007FF6FE68C000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff6fde40000_SoundTune.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d24632a9d7cbfeac47ec91ea4afc9551f528e4bafdd956463c956835574216d6
Instruction ID: 7f0da41c26e65e4fd40aba832ed87b2617dc7bfdedddcbf1a1946ef44d514f3f
Opcode Fuzzy Hash: d24632a9d7cbfeac47ec91ea4afc9551f528e4bafdd956463c956835574216d6
Instruction Fuzzy Hash: F6113326B14F058AEB00CFB0E8542B837A4F7A9758F441D31EA6D867A8EF7CD1548340

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SoundTune.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\eb40e7d2

C:\Users\user\AppData\Local\Temp\ebb9eca0

C:\Users\user\AppData\Local\Temp\f3455394

C:\Users\user\AppData\Local\Temp\f4062f52

C:\Users\user\AppData\Local\Temp\f5e8013d

C:\Users\user\AppData\Local\Temp\f751201f

C:\Users\user\AppData\Local\Temp\f7e11b31

C:\Users\user\AppData\Local\Temp\hdoumnepq

C:\Users\user\AppData\Local\Temp\nmqufdalfa

C:\Users\user\AppData\Local\Temp\yxh

C:\Windows\Tasks\uiQuick.job

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
SoundTune.exe