Overview
overview
4Static
static
3voicewave_...75.exe
windows10-2004-x64
4voicewave_...75.exe
windows11-21h2-x64
4$TEMP/down...ic.ini
windows10-2004-x64
1$TEMP/down...ic.ini
windows11-21h2-x64
3$TEMP/down...se.ini
windows10-2004-x64
1$TEMP/down...se.ini
windows11-21h2-x64
3$TEMP/down...ad.ini
windows10-2004-x64
1$TEMP/down...ad.ini
windows11-21h2-x64
3$TEMP/down...er.exe
windows10-2004-x64
3$TEMP/down...er.exe
windows11-21h2-x64
3$TEMP/down...ch.ini
windows10-2004-x64
1$TEMP/down...ch.ini
windows11-21h2-x64
3$TEMP/down...an.ini
windows10-2004-x64
1$TEMP/down...an.ini
windows11-21h2-x64
3$TEMP/down...re.ini
windows10-2004-x64
1$TEMP/down...re.ini
windows11-21h2-x64
3$TEMP/down...an.ini
windows10-2004-x64
1$TEMP/down...an.ini
windows11-21h2-x64
3$TEMP/down...se.ini
windows10-2004-x64
1$TEMP/down...se.ini
windows11-21h2-x64
3$TEMP/down...an.ini
windows10-2004-x64
1$TEMP/down...an.ini
windows11-21h2-x64
3$TEMP/down...or.ini
windows10-2004-x64
1$TEMP/down...or.ini
windows11-21h2-x64
3$TEMP/down...se.ini
windows10-2004-x64
1$TEMP/down...se.ini
windows11-21h2-x64
3$TEMP/down...sh.ini
windows10-2004-x64
1$TEMP/down...sh.ini
windows11-21h2-x64
3$TEMP/down...sh.ini
windows10-2004-x64
1$TEMP/down...sh.ini
windows11-21h2-x64
3$TEMP/down...ig.ini
windows10-2004-x64
1$TEMP/down...ig.ini
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 04:48
Static task
static1
Behavioral task
behavioral1
Sample
voicewave_installer_20260414.17762284925202b5140975.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral2
Sample
voicewave_installer_20260414.17762284925202b5140975.exe
Resource
win11-20260130-en
Behavioral task
behavioral3
Sample
$TEMP/downloader_easeus/1.0.0/46free/Arabic.ini
Resource
win10v2004-20260130-en
Behavioral task
behavioral4
Sample
$TEMP/downloader_easeus/1.0.0/46free/Arabic.ini
Resource
win11-20260130-en
Behavioral task
behavioral5
Sample
$TEMP/downloader_easeus/1.0.0/46free/Chinese.ini
Resource
win10v2004-20260130-en
Behavioral task
behavioral6
Sample
$TEMP/downloader_easeus/1.0.0/46free/Chinese.ini
Resource
win11-20260130-en
Behavioral task
behavioral7
Sample
$TEMP/downloader_easeus/1.0.0/46free/ChineseTrad.ini
Resource
win10v2004-20260130-en
Behavioral task
behavioral8
Sample
$TEMP/downloader_easeus/1.0.0/46free/ChineseTrad.ini
Resource
win11-20260130-en
Behavioral task
behavioral9
Sample
$TEMP/downloader_easeus/1.0.0/46free/EDownloader.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral10
Sample
$TEMP/downloader_easeus/1.0.0/46free/EDownloader.exe
Resource
win11-20260130-en
Behavioral task
behavioral11
Sample
$TEMP/downloader_easeus/1.0.0/46free/French.ini
Resource
win10v2004-20260130-en
Behavioral task
behavioral12
Sample
$TEMP/downloader_easeus/1.0.0/46free/French.ini
Resource
win11-20260130-en
Behavioral task
behavioral13
Sample
$TEMP/downloader_easeus/1.0.0/46free/German.ini
Resource
win10v2004-20260130-en
Behavioral task
behavioral14
Sample
$TEMP/downloader_easeus/1.0.0/46free/German.ini
Resource
win11-20260130-en
Behavioral task
behavioral15
Sample
$TEMP/downloader_easeus/1.0.0/46free/InitConfigure.ini
Resource
win10v2004-20260130-en
Behavioral task
behavioral16
Sample
$TEMP/downloader_easeus/1.0.0/46free/InitConfigure.ini
Resource
win11-20260130-en
Behavioral task
behavioral17
Sample
$TEMP/downloader_easeus/1.0.0/46free/Italian.ini
Resource
win10v2004-20260130-en
Behavioral task
behavioral18
Sample
$TEMP/downloader_easeus/1.0.0/46free/Italian.ini
Resource
win11-20260130-en
Behavioral task
behavioral19
Sample
$TEMP/downloader_easeus/1.0.0/46free/Japanese.ini
Resource
win10v2004-20260130-en
Behavioral task
behavioral20
Sample
$TEMP/downloader_easeus/1.0.0/46free/Japanese.ini
Resource
win11-20260130-en
Behavioral task
behavioral21
Sample
$TEMP/downloader_easeus/1.0.0/46free/Korean.ini
Resource
win10v2004-20260130-en
Behavioral task
behavioral22
Sample
$TEMP/downloader_easeus/1.0.0/46free/Korean.ini
Resource
win11-20260130-en
Behavioral task
behavioral23
Sample
$TEMP/downloader_easeus/1.0.0/46free/LanguageTransfor.ini
Resource
win10v2004-20260130-en
Behavioral task
behavioral24
Sample
$TEMP/downloader_easeus/1.0.0/46free/LanguageTransfor.ini
Resource
win11-20260130-en
Behavioral task
behavioral25
Sample
$TEMP/downloader_easeus/1.0.0/46free/Portuguese.ini
Resource
win10v2004-20260130-en
Behavioral task
behavioral26
Sample
$TEMP/downloader_easeus/1.0.0/46free/Portuguese.ini
Resource
win11-20260130-en
Behavioral task
behavioral27
Sample
$TEMP/downloader_easeus/1.0.0/46free/Spanish.ini
Resource
win10v2004-20260130-en
Behavioral task
behavioral28
Sample
$TEMP/downloader_easeus/1.0.0/46free/Spanish.ini
Resource
win11-20260130-en
Behavioral task
behavioral29
Sample
$TEMP/downloader_easeus/1.0.0/46free/Turkish.ini
Resource
win10v2004-20260130-en
Behavioral task
behavioral30
Sample
$TEMP/downloader_easeus/1.0.0/46free/Turkish.ini
Resource
win11-20260130-en
Behavioral task
behavioral31
Sample
$TEMP/downloader_easeus/1.0.0/46free/aliyun/AliyunConfig.ini
Resource
win10v2004-20260130-en
Behavioral task
behavioral32
Sample
$TEMP/downloader_easeus/1.0.0/46free/aliyun/AliyunConfig.ini
Resource
win11-20260130-en
General
- Target $TEMP/downloader_easeus/1.0.0/46free/Portuguese.ini
- Size 2KB
- Sample260415-ffd4baat3s
- SHA256 d8d06021018d4c88ef181202b888ba18e29912788e31e8b9f791c7a0f54f8375
- MD5 2c4973da07c2c9f28c28c09b82a26623
- SHA1 456b6eafd31be96db2655ddd149ecec43ad28fa3
- SHA512 cc331672e0baeb17f6dbce9da5323ad3dfa93da828a1dfa722cb840ec1179f4411811895fce46dd793d6383e63c2dbb80af100fb5d880550b9567a0b53dd0f2b
- TLSH T13551A59A2D88517E7786073657636E43EDA10C8A099FC614C9FB0ECB22CB98C7737903
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings OpenWith.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1876 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\46free\Portuguese.ini1⤵
- Modifies registry class
PID:3676
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1876