d50ad141854cca0a356de2c38f533ae4e87bb9379d96f656f12fb75c94024cc8

Analysis

max time kernel
1484s
max time network
1503s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
02/07/2024, 01:36

Target
Voicemod Pro 2.6.0.7 (x64) Multilingual [PeskTop.com].rar
Size 67.3MB
Sample240702-b1fqes1gra
SHA256 d50ad141854cca0a356de2c38f533ae4e87bb9379d96f656f12fb75c94024cc8
MD5 2248fe5369f657ca0b0f0ce3b4ab5a38
SHA1 9b4bb1effbba647c2de42c8f9b111ebffccdb7ca
SHA512 7a1f865bfb82c5f8b9404ba83d75e161a9853ebc4087004c733ecdb35306ef27af11e0811f84b00b2208ed305f3753203baa18f5212c5c9a6b8a4e85f0725b2b
SSDEEP 1572864:hSN6XCY6x7zzkWr1g5DxqgesWOWf/tOyL4trXEOwL:Ewp6dzzkr9QZsWMrXu
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
400	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Voicemod Pro 2.6.0.7 (x64) Multilingual [PeskTop.com].rar"
1⤵
- Modifies registry class
PID:852

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact