Analysis
- max time kernel
134s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
04/06/2024, 12:49
General
- Target VoicemodSetup.exe
- Size 22.2MB
- Sample240604-p2pllsgh59
- SHA256 afd7452c34570e409fc0c2bc8a22fb7429a3cc8f48e85fe6a154656ec020330d
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 10 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Downloads MZ/PE file
- Drops file in System32 directory 17 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 12 IoCs
- Executes dropped EXE 10 IoCs
- Loads dropped DLL 10 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VoicemodSetup.exe"C:\Users\Admin\AppData\Local\Temp\VoicemodSetup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-CUK70.tmp\VoicemodSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-CUK70.tmp\VoicemodSetup.tmp" /SL5="$70180,22991991,87040,C:\Users\Admin\AppData\Local\Temp\VoicemodSetup.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-PLGI7.tmp\vc_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\is-PLGI7.tmp\vc_redist.x64.exe" /quiet /norestart3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{48ABE979-E765-4AC5-94D8-5B3C6689A3B1}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{48ABE979-E765-4AC5-94D8-5B3C6689A3B1}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-PLGI7.tmp\vc_redist.x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /quiet /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-PLGI7.tmp\vc_redist.x86.exe"C:\Users\Admin\AppData\Local\Temp\is-PLGI7.tmp\vc_redist.x86.exe" /quiet /norestart3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{98102E2B-B02D-4A13-8072-55B1E8A9E8AB}\.cr\vc_redist.x86.exe"C:\Windows\Temp\{98102E2B-B02D-4A13-8072-55B1E8A9E8AB}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-PLGI7.tmp\vc_redist.x86.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692 /quiet /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Program Files\Voicemod Desktop\driver\SaveDefaultDevices.exe"C:\Program Files\Voicemod Desktop\driver\SaveDefaultDevices.exe" defaultdevices.txt3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\Voicemod Desktop\driver\setupDrv.bat""3⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "devcon.exe dp_enum"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Voicemod Desktop\driver\devcon.exedevcon.exe dp_enum5⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
-
C:\Program Files\Voicemod Desktop\driver\devcon.exedevcon install vmdrv.inf *VMDriver4⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Voicemod Desktop\driver\devcon.exedevcon update vmdrv.inf *VMDriver4⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe"C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-alien-vocoder*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-android-background*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-android-vocoder*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-aphonic-vocoder*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-beach*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-capella*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-reggae*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-rock*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cave*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cop-chase*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cop-radio*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-fear-background*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-fear-background-in*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-franky-background*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-franky-vocoder*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-ghost-background*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-ghost-vocoder*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-harmony-vocoder*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-hurry-up-in*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-hurry-up-loop*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-bee*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-growl*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-leopard*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-tiger*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-magic-chords-vocoder*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-party-time-background*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-party-time-vocoder*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-possessed-background*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-robot-background*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-robot-vocoder*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-romantic-paris*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-romantic-ulala*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-santa-background*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-sleepyhead*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-spacemen-background*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-speechifier-ovation-background*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-speechifier-protest-background*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-spirit-background*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-spirit-vocoder*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-storyteller-action-background*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-storyteller-drama-background*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-storyteller-happy-background*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-student-hall*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-student-playtime*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-sword-background*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-underwater*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-1*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-2*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-3*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-4*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-1*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-2*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-3*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-4*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-zombie-background*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-zombie-vocoder*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-zombie-vocoder2*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cooltune-vocoder*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-punk-vocoder*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx01*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx02*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx03*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx04*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx05*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx06*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx07*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx08*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx09*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx10*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx11*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx12*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx13*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx14*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx15*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar1*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar2*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar3*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar4*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar5*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar6*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky1*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky2*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky3*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky4*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky5*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-exo*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-gameover-amb*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-outofrange*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-blocks-vocoder1*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-blocks-vocoder2*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-blocks-vocoder3*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-titan-background-part1*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-titan-background-part2*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx16*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx17*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx18*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx19*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx20*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-bass*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-octava*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-quinta*.wav4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-tercera*.wav4⤵
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1ee0a298-e1e4-c641-92a1-e3e7cc1b522e}\vmdrv.inf" "9" "499a51a03" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\program files\voicemod desktop\driver"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca11e5016dc2:VOICEMOD_Driver:11.18.35.982:*vmdriver," "499a51a03" "0000000000000178"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca11e5016dc2:VOICEMOD_Driver:11.18.35.982:*vmdriver," "499a51a03" "0000000000000148"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x530 0x50c1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
VoicemodDesktop.exe
VoicemodDesktop.exe.config
SaveDefaultDevices.exe
defaultdevices.txt
devcon.exe
setupDrv.bat
uninstalldriver.bat
vmdrv.inf
Fleck.dll
Hardcodet.Wpf.TaskbarNotification.dll
Newtonsoft.Json.dll
RawInputProcessor.dll
SharpDX.RawInput.dll
SharpDX.dll
SimpleConverter.dll
VoicemodControls.dll
VoicemodLogger.dll
VoicemodSDKDotNET.dll
VoicemodShockets.dll
sdk-custom-fx01_44100.wav
sdk-custom-fx01.dat
sdk-walkie-terror-1.dat
VoicemodSDK.dll
VoicemodSetup.tmp
idp.dll
vc_redist.x64.exe
vc_redist.x86.exe
vmdrv.sys
2kkk3oug.newcfg
uman0mze.newcfg
user.config
user.config
vc_redist.x64.exe
license.rtf
logo.png
wixstdba.dll
vc_redist.x86.exe
license.rtf
vmdrv.cat
memory/2348-433-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/2348-232-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/2348-410-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/2348-20-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/2348-13-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/2348-7-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/2692-421-0x000001EB85570000-0x000001EB8557A000-memory.dmp
memory/2692-463-0x000001EB9E3C0000-0x000001EB9E3CC000-memory.dmp
memory/2692-470-0x000001EBA3300000-0x000001EBA330E000-memory.dmp
memory/2692-471-0x000001EBA39B0000-0x000001EBA39F0000-memory.dmp
memory/2692-468-0x000001EB9FB30000-0x000001EB9FB38000-memory.dmp
memory/2692-475-0x000001EBA3320000-0x000001EBA332A000-memory.dmp
memory/2692-467-0x000001EB9FB40000-0x000001EBA11A4000-memory.dmp
memory/2692-479-0x000001EBA39A0000-0x000001EBA39A8000-memory.dmp
memory/2692-481-0x000001EBA3A10000-0x000001EBA3A22000-memory.dmp
memory/2692-461-0x000001EB9E380000-0x000001EB9E392000-memory.dmp
memory/2692-483-0x000001EBA3AA0000-0x000001EBA3AC2000-memory.dmp
memory/2692-469-0x000001EBA3930000-0x000001EBA3968000-memory.dmp
memory/2692-415-0x000001EB83580000-0x000001EB83852000-memory.dmp
memory/2692-621-0x000001EBA3A90000-0x000001EBA3A98000-memory.dmp
memory/2692-419-0x000001EB9DF10000-0x000001EB9DFB6000-memory.dmp
memory/2692-618-0x000001EBA5CE0000-0x000001EBA5D28000-memory.dmp
memory/2692-616-0x000001EBA3A50000-0x000001EBA3A5C000-memory.dmp
memory/2692-417-0x000001EB85560000-0x000001EB8556A000-memory.dmp
memory/2692-619-0x000001EBA3A60000-0x000001EBA3A6A000-memory.dmp
memory/2692-620-0x000001EBA3A80000-0x000001EBA3A88000-memory.dmp
memory/4888-0-0x0000000000400000-0x000000000041C000-memory.dmp
memory/4888-434-0x0000000000400000-0x000000000041C000-memory.dmp
memory/4888-12-0x0000000000400000-0x000000000041C000-memory.dmp
memory/4888-2-0x0000000000401000-0x000000000040C000-memory.dmp