Overview
overview
8Static
static
3Voice.ai-D...11.exe
windows7-x64
7Voice.ai-D...11.exe
windows10-2004-x64
8$PLUGINSDIR/INetC.dll
windows7-x64
3$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3Analysis
- max time kernel
125s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240221-en - resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system - submitted
24/02/2024, 14:35
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/INetC.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe
- Size 476KB
- Sample240224-ryb78afc6v
- SHA256 23ecba0be777d9b7a5683d0939d9ae17c4427c46e51ff959e91785d83c60efd1
- MD5 b8162dccc95c2ed40a3fd946dd127242
- SHA1 27899142d055dcce7ad3288028c8e3187421275c
- SHA512 51eef114974531407df6e04af725855293db7e5bdd2e311af5b14dcbef70de9759ae00fa1c17bb72351697fb8d8cf163a1072e957430d33ca90dffeadf0eefbb
- SSDEEP 3072:AkBGWOsTIJgIDU5A/cto68pMABlZQ2wpFD0ravSGKBUGYDxJ0y5t8:A1ssjn5Mp2w7g+VKvSA
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\Control Panel\International\Geo\Nation vc2019.exe - Executes dropped EXE 4 IoCs
pid Process 924 VoiceAI-Installer.exe 3796 vc2019.exe 968 vc2019.exe 1592 VC_redist.x64.exe - Loads dropped DLL 12 IoCs
pid Process 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 924 VoiceAI-Installer.exe 924 VoiceAI-Installer.exe 968 vc2019.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Voice.ai\locales\ar.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\lv.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\sk.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\VoiceAIDriver\VoiceAIDriver.cat VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\AudioConverter.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\libmp3lame.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\version VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\libgcrypt.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\el.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\es-419.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\snapshot_blob.bin VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\BsSndRpt.exe VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\libsndfile-1.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\devcon.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\de.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\fa.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\hr.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\nl.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\installer.log Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe File created C:\Program Files\Voice.ai\chrome_elf.dll VoiceAI-Installer.exe File opened for modification C:\Program Files\Voice.ai\gcrypt.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\onnxruntime.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\libsamplerate-0.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\tools\vc2019.exe VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\gu.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\ro.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\zh-CN.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\icudtl.dat VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\VoiceAI-Installer.exe Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe File created C:\Program Files\Voice.ai\opensource\libsamplerate.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\pl.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\pt-BR.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\meta Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe File created C:\Program Files\Voice.ai\locales\ko.pak VoiceAI-Installer.exe File opened for modification C:\Program Files\Voice.ai\AudioPX.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\sw.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\ru.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\resources.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\libGLESv2.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\libcotp.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\it.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\mr.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\CefSharp.WinForms.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\libEGL.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\naudio.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\newtonsoft.json.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\fil.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\VoiceAIDriver\VoiceAIDriver.inf VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\he.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\sv.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\te.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\uk.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\VoiceAI.exe VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\tools\net452.exe VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\bn.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\fi.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\hostpolicy.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\fr.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\id.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\pt-PT.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\nb.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\ta.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\BugSplatRc.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\cudart64_110.dll VoiceAI-Installer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 4 IoCs
resource yara_rule behavioral2/files/0x000600000002321f-60.dat nsis_installer_1 behavioral2/files/0x000600000002321f-60.dat nsis_installer_2 behavioral2/files/0x000600000002321f-61.dat nsis_installer_1 behavioral2/files/0x000600000002321f-61.dat nsis_installer_2 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 55 IoCs
pid Process 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 4704 taskmgr.exe Token: SeSystemProfilePrivilege 4704 taskmgr.exe Token: SeCreateGlobalPrivilege 4704 taskmgr.exe Token: 33 4704 taskmgr.exe Token: SeIncBasePriorityPrivilege 4704 taskmgr.exe Token: SeBackupPrivilege 3556 vssvc.exe Token: SeRestorePrivilege 3556 vssvc.exe Token: SeAuditPrivilege 3556 vssvc.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 776 wrote to memory of 924 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 96 PID 776 wrote to memory of 924 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 96 PID 776 wrote to memory of 924 776 Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe 96 PID 924 wrote to memory of 3796 924 VoiceAI-Installer.exe 98 PID 924 wrote to memory of 3796 924 VoiceAI-Installer.exe 98 PID 924 wrote to memory of 3796 924 VoiceAI-Installer.exe 98 PID 3796 wrote to memory of 968 3796 vc2019.exe 99 PID 3796 wrote to memory of 968 3796 vc2019.exe 99 PID 3796 wrote to memory of 968 3796 vc2019.exe 99 PID 968 wrote to memory of 1592 968 vc2019.exe 100 PID 968 wrote to memory of 1592 968 vc2019.exe 100 PID 968 wrote to memory of 1592 968 vc2019.exe 100 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe"C:\Users\Admin\AppData\Local\Temp\Voice.ai-Downloader-alphaver-9b69c1da713349ccb07cbe0431d0c911.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Program Files\Voice.ai\VoiceAI-Installer.exe"C:\Program Files\Voice.ai\VoiceAI-Installer.exe" /path "C:\Program Files\Voice.ai"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Program Files\Voice.ai\tools\vc2019.exe"C:\Program Files\Voice.ai\tools\vc2019.exe" /q /norestart3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\Temp\{7ECB4033-EA17-46F0-A510-1AEAB77B5D4A}\.cr\vc2019.exe"C:\Windows\Temp\{7ECB4033-EA17-46F0-A510-1AEAB77B5D4A}\.cr\vc2019.exe" -burn.clean.room="C:\Program Files\Voice.ai\tools\vc2019.exe" -burn.filehandle.attached=692 -burn.filehandle.self=696 /q /norestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\Temp\{AFAE14E5-45E0-41A9-A78B-48054BEDF7E5}\.be\VC_redist.x64.exe"C:\Windows\Temp\{AFAE14E5-45E0-41A9-A78B-48054BEDF7E5}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{2BA4B533-B069-4B42-9AEE-B2953BB11970} {232185D4-8F0A-4780-AD8C-35095CC4D867} 9685⤵
- Executes dropped EXE
PID:1592 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={2aaf1df0-eb13-4099-9992-962bb4e596d1} -burn.filehandle.self=1124 -burn.embedded BurnPipe.{01B670CB-DA1F-4DD5-BD51-62E95931054E} {9FF85AEF-5670-4E2D-89D4-C6DADF34FF58} 15926⤵PID:4724
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={2aaf1df0-eb13-4099-9992-962bb4e596d1} -burn.filehandle.self=1124 -burn.embedded BurnPipe.{01B670CB-DA1F-4DD5-BD51-62E95931054E} {9FF85AEF-5670-4E2D-89D4-C6DADF34FF58} 15927⤵PID:4800
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{D6452426-55DD-40DF-B951-104497262315} {6DE66216-9AFF-4561-822B-F8818070152E} 48008⤵PID:2260
-
-
-
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4704
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:404
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3556
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵PID:4388
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵PID:3168
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:2736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e597059.rbs
- Size 19KB
- SHA256 fee132fc193d214dd1453e93576a7d440ff27e6dc5cc0ae28946a10fc08da3df
- MD5 8c1827ac5505b26407311089e7d90eef
- SHA1 120ca20430e1207d9ab598268e26e6ca9f6f44d4
- SHA512 a6fd3932bc870bf6a683beb4912b43112329a4c8e312925bd90bbcdab8948c122c8dca0bfca403811e9c6ea37d29c9eedc9a2b15033ba9c35ea0b784fb95495c
- SSDEEP 192:dhR31kRO15dXcFUADIc1L+W+y4+agPuYz7:dhR36ROTeC81L/c0z7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Config.Msi\e597065.rbs
- Size 19KB
- SHA256 0f3a56060ba47252899ec32987e2703be17b6b48db410dbab3929e63cb0dbe4d
- MD5 64dde234f3d9ad7241d22f656b3df434
- SHA1 58223018c03aeca789d7a0adcd74daf22faaa390
- SHA512 558295895a2d900def2fdabeb8b442036c6e24121e842e59806ed9cd4a8feb6175325a054bbe47861cdcd4918e9f82dd2925d8f16fc888e63fc2353a4a8d27d3
- SSDEEP 192:aafQ9ft++0vxm/A37yhMZgyLecCtVIftVuigUEFZr32lVpO7:aIQ9ft+Zvxm/A37Ctt6tUjrv7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Config.Msi\e59706c.rbs
- Size 21KB
- SHA256 84322e00ca916ed8e1094dde946d818d4a35448d1e11657ad2bc053f38319e05
- MD5 633898315026752b540526a436eb41c8
- SHA1 10bc6cd99f60b282d60b2678b6e8cb8f1425c5c2
- SHA512 bb835b1a5c90bb2a35fa79b0df1c33cac1a0983cf4d5d7e0436726f0d33f06eba88d2b162e5e3504511df98dea40b3bf03b0ce57c85e5b8d9ba1ffb2576294cb
- SSDEEP 384:a7RQGRPnAKxNAUhUC7xJjrMNYPVIbS/wimtMk/k9OnfkP:aVp/AKhCsN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Config.Msi\e59707b.rbs
- Size 21KB
- SHA256 8b7a6ebe5108d4a4069c2ee30cc1813a9a3c85eeca557c83d9d1cc0af9c886eb
- MD5 41988c058ae15778274b0c45407f31c8
- SHA1 d8d24bc5d8b7d8ef5216e38d0cda971f1b50f359
- SHA512 e6db3b2d6176dac05cff8579909717a7118552b05518a4c600cb260e6aacced33bfd0b928f0ef9d9615b95c12fe50d22abb556a1a61fedeceab1d4653563732c
- SSDEEP 384:a9xKHCbTOnDlpDgfCj448JLdOsalckU72eC6pAOoMD505EfIIVQ:a9xKHCbTOnDlpDgfCURJLdBAOoCOmfIr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Voice.ai\VoiceAI-Installer.exe
- Size 16.9MB
- SHA256 d1b589b6bfa79daee66b65bae2989d9a580161ed78e909683a795385c0da75fb
- MD5 f9efed34565e526d1b83e852a6a9f898
- SHA1 4cb9c26f08099ba2cbdd7b6cf32078eb8c13331a
- SHA512 fa20030fdc3c57542b8e7849007a46cb27a625ad3f209715f8999afcc42102bebe77cf8e03412b111b19621c79de86455de419f53dfb4a0c068c66c63fc26500
- SSDEEP 393216:3Ptb5faADM2+2QUCVIXf4OHmafgL4hNDOxgB87:3Pt1M2+26VeZfA4jS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Voice.ai\VoiceAI-Installer.exe
- Size 17.4MB
- SHA256 27993bbf879ab77275301b5240ca266c138de33de094eb9f1cc763116d778cb9
- MD5 62c7eb0d4b5b3b3d336654eda381d5d4
- SHA1 cf6ee2b55647e9ff2bcbd9f6ba65bfb0509aa9c8
- SHA512 bf74341c9adf5256874bbcfc3e81e769885d703cb8ea42631fa876e19f699b70b0c146a4bba6062a48fbe64b60de78c084666104414a3f607b2609b6e47ed35d
- SSDEEP 393216:3Ptb5faADM2+2QUCVIXf4OHmafgL4hNDOxgB8Z7:3Pt1M2+26VeZfA4js
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Voice.ai\meta
- Size 65B
- SHA256 986b736d7a1b4c5e21b66c4bd5a5aca34e1f1a382fe07f550e49ab3ad1763a83
- MD5 a2bc530e7e396f0c92550949d81f8cb7
- SHA1 1ff5f294713f85f185c6f90273c22528acdf8407
- SHA512 88a2aa8b11667762d52e9757a0e0a462e6af0903d37c5b97592754d22fa6d41ea4b6513c030ddf235ec3c848b6855c3489ffe17cb2e1538b1bf514ea8dc0386e
- MD5 SHA1 SHA512
- Path C:\Program Files\Voice.ai\tools\vc2019.exe
- Size 4.1MB
- SHA256 701a1f9d4d44dac80338c9e55d01b3855786abf2c7cdebc173d1d11c5ac19ecc
- MD5 b736e6e9bcea56979e9995acaca51d69
- SHA1 84eaa9f558dbc0c331d2dc8a43cddf14b1e5c3dd
- SHA512 209a0f4ab0f420b0bd75128849ad899c79d2e0330865c9f8f8621d4dc2e1e88f51708ae40e13929f5d240a0a19fc381c3fe93aac05365ea9d277714292c0944e
- SSDEEP 98304:mRjYXJcN4JFpWcEP90ERA8vH6o/EzAOUYUZ349:mRjYJFpWcQ0ER7SoNOr9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Voice.ai\tools\vc2019.exe
- Size 4.3MB
- SHA256 e32ce16a9f6212f9f4d7e5ce5f0d12282631ffe38533a27bd9504231dbbba0d9
- MD5 eab7450327285b85e70209f7d17a0918
- SHA1 26b6e2965f915ffd5e9c708cec8a6bf9cd16bcb7
- SHA512 13794e56c2229e1032de55f4407dbef5b3a7ba29e9de98d01c505f2026fc405c94699d14cfa17bf2cee317d7fa0ad83021e3cbce5265782d71526bedcde3c2cf
- SSDEEP 98304:mRjYXJcN4JFpWcEP90ERA8vH6o/EzAOUYUZ34lECU:mRjYJFpWcQ0ER7SoNOrlEJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
- Size 1KB
- SHA256 64b7ec2ba62b8c6d7ce3e103ab4c7c91006d070bf0f3678c1b595756d93a31b4
- MD5 6ecd6be766a5f6f3f0534cf22b43ca57
- SHA1 291ef022f6a5303f1e77777ce85d481b20837759
- SHA512 76a29b7f96588b99151db26de8d029331a3e48fe8997cee9603c747e7ca791c4468390550533a0c034feea1bac615a2da703476944b0a857bea4452a8ef73e31
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
- Size 724B
- SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
- MD5 8202a1cd02e7d69597995cabbe881a12
- SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
- SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
- Size 410B
- SHA256 87e6529701e17c77e757a7814deb1b7db16156bc8f848e4cc060d21e0c6940b9
- MD5 f7264eef0ab50b7341fc36372ced7fe1
- SHA1 dc97d47c38389905011668961372bb2cfe80dc36
- SHA512 df1c1b904629a6eb877e4546242010b236c6d56f5753eaa263e3fc4c63902fdd0496c3dd21644c166ad99b3caf42cbba06b2c36e1311c33f107fb0e53041cada
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
- Size 392B
- SHA256 4f0dcf804119198e567652b203a3045c469fd3188c5d4a9f38a2ce0a3440ee10
- MD5 3a0f0138e49f95a95129b09c534ffa19
- SHA1 f093011f89ad0d74c91db67221cde621c62634a2
- SHA512 2d4d83d78e9ce7b31ab14c6a4956bf18017b288a8be1e5d0da59ba4a04660c57d81b674d6df30cf91bbc76690e75de60b0ee97a3080e02db7ba81eae1d22d33d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9IZAIS87\user-event[1].json
- Size 16B
- SHA256 c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
- MD5 7363e85fe9edee6f053a4b319588c086
- SHA1 a15e2127145548437173fc17f3e980e3f3dee2d0
- SHA512 a2fd24056e3ec2f1628f89eb2f1b36a9fc2437ae58d34190630fe065df2bbedaf9bd8aee5f8949a002070052ca68cc6c0167214dd55df289783cff682b808d85
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240224143808_000_vcRuntimeMinimum_x64.log
- Size 2KB
- SHA256 101e98ff6c52701d069fecc7de8f2cccdbe0c65b0a47a77873cb48f7903ae06e
- MD5 74fd31f1260d49692f4ad8fce7cd2536
- SHA1 97b3d3ae7a39b0e5d8d2e3f46baf1e2ce9aefffd
- SHA512 21f75c955eb33d6c5ac754f00c9065fb3f06a100b0bed1b9d7a9b686776d9afeee657ec8f9261baf3def89539b5c0f3adb43dc89199bf6a5be0bc358385cf4c1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240224143808_001_vcRuntimeAdditional_x64.log
- Size 2KB
- SHA256 c491c08f8e4d0e6d00e9852c460a1139b6947a4889b05ee45bee45dd20e0313b
- MD5 b80a27bb913f4dd72a24087c1dab3a2a
- SHA1 90b81cc9cd564a115e9a50a3261dc1270d7f7046
- SHA512 5aaf6de4953204773402a87530bd88bcc5645a5ee43ccf6dbd086c9940e1e4ab6d2a9332ae412eb3e20f13338b8be2916b7515724de9ddaee0dbd0777f58eb54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsy3653.tmp\INetC.dll
- Size 21KB
- SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
- MD5 2b342079303895c50af8040a91f30f71
- SHA1 b11335e1cb8356d9c337cb89fe81d669a69de17e
- SHA512 550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
- SSDEEP 384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsy3653.tmp\System.dll
- Size 12KB
- SHA256 c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
- MD5 792b6f86e296d3904285b2bf67ccd7e0
- SHA1 966b16f84697552747e0ddd19a4ba8ab5083af31
- SHA512 97edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c
- SSDEEP 192:rFiQJ771Jt17C8F1A5xjGNNvgFOiLb7lrT/L93:X71Jt48F2eNvgFF/L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsy3653.tmp\nsProcess.dll
- Size 4KB
- SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
- MD5 05450face243b3a7472407b999b03a72
- SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
- SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\{7ECB4033-EA17-46F0-A510-1AEAB77B5D4A}\.cr\vc2019.exe
- Size 635KB
- SHA256 21503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79
- MD5 9bd591625766a7330708b2c6380dc1d7
- SHA1 18018a3d12278187a8dc26eae538a799511bbdfc
- SHA512 58c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5
- SSDEEP 12288:UnMwHskY7gjcjhVIEhqgM7bWvcsi6aVcvIymacGU40vy3W/ceKSHMsiFyY6XN:SMysZgjS1hqgSC/izkfbctjymk4HM5yJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\{AFAE14E5-45E0-41A9-A78B-48054BEDF7E5}\.ba\logo.png
- Size 1KB
- SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
- MD5 d6bd210f227442b3362493d046cea233
- SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
- SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\{AFAE14E5-45E0-41A9-A78B-48054BEDF7E5}\.ba\wixstdba.dll
- Size 191KB
- SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
- MD5 eab9caf4277829abdf6223ec1efa0edd
- SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
- SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
- SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\{AFAE14E5-45E0-41A9-A78B-48054BEDF7E5}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
- Size 1.7MB
- SHA256 2b3a171d1a0495ca376d798533a66e1ac8ce28f27199e98d8e14a42e70f9d459
- MD5 f3bbf4483186891b92e4c66d702ac76a
- SHA1 35e0a5142953df2137d47a76ba9c83df5f2eec6a
- SHA512 db1c708ddab9cc4041ad61c8e3586a5e9f2f366ba192a71078bb8e7327472d59d162ecba13aabed104ad9f4ffe7af354ad58322f611159fe539ea1240b1acf6a
- SSDEEP 49152:Nu9bq/2bCt8XE+JpzGIPmXRnrM0wHKkuBNDUD8Ly:NOm2zJeVAqkKDA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\{AFAE14E5-45E0-41A9-A78B-48054BEDF7E5}\cab5046A8AB272BF37297BB7928664C9503
- Size 879KB
- SHA256 c80addc870825e9a1aa9281e105e583973ec2846bbd74f1e97cb60911ba7a2e1
- MD5 8e288dd0b5e0468ed8ae01ee566e77e8
- SHA1 fbd11237ae3300a2202444d339601d1ac6bbf310
- SHA512 facc72bdcdd5de47c0d18ecb5288962b04d9e4924a9a07ee807a3bf0eaa77eac05f086906b680bcf97c3bad5fab0038b47c0e09cd2bbec1d0709eba015bc1c04
- SSDEEP 12288:PG+HKEJ5XRhGDViuMoLxufctI9J4DZzI8+vc7Pk/HN68ge3eSqXMADKM0j3qO8/g:kEJ5XIt6c8CeJIk1BPeZXD63EX2Aj4Np
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\{AFAE14E5-45E0-41A9-A78B-48054BEDF7E5}\vcRuntimeAdditional_x64
- Size 180KB
- SHA256 f8745f3523ea73806d591fa4e666e86c30c7e5240a07211a0c11a7633d16c4f0
- MD5 e6df9f55e20905f77b136844a3844dd6
- SHA1 b7c1fb12bda508a62fdd9ffa9e870cae50605aaa
- SHA512 7c71c2b9a7d3d768d1686cb037362efb9e38c50b652bfaeb22cf86c6c47a85962f9893cbf5e2f86880c9c8fc8bc0278edeb47088813e022ef05d7db15efc0713
- SSDEEP 3072:xdviOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJd5Qyv:rvipBaTDo1j//SZhmy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\{AFAE14E5-45E0-41A9-A78B-48054BEDF7E5}\vcRuntimeMinimum_x64
- Size 180KB
- SHA256 5d0416e45819d555ad27e5efc1aeeb465cbb8e2937b3221852bea0f7d9c3a954
- MD5 143a2b9f1c0ebc3421b52e9adcb4db2e
- SHA1 06e01b8cc855fd9a31f99b430f8c8745e706c677
- SHA512 7e17309cdaa856bd1bf17535e0f65db585226262a1c9ffcaadb19eb0822a578ad9036487870b97fc86b7167848f69d495aa51c380ba9890a71f8f9a94061fa05
- SSDEEP 3072:sviOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJd:svipBaTDo1j//SZh
- MD5 SHA1 SHA512 SSDEEP