f5e120c42af33940e3535fa998ba71dcb174268eb182aa3896bb8418743b97be

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$8/ClownfishVoiceChanger.exe
Size 940KB
Sample260511-n29fcagy8s
SHA256 f5e120c42af33940e3535fa998ba71dcb174268eb182aa3896bb8418743b97be
MD5 4ebd611981c2d6939bfab01111c28a86
SHA1 dd3fe5cfc7cbb4e79f30f49d1ba69465eefc9d93
SHA512 10ceb2cb27aa804f3aed2e02229390e239ab0bf2a5414681c66f23c8136e88d11f0667712bd37cf38bd4e460dfc55d55ab607822323cc5335a143d5cfe7ccf49
SSDEEP 12288:eQDjrYgyp9Hvrjayxfx39vC98aDZx1ZjrVcKibGiBaK+Eacm23XkJ18QsP/uQ1:eiry9Hvr5xfqyUPjrRcGHCk8QsP/uQ1
TLSH
T112254981B1D3D832D0724FB04C76AB91DA3D7D719BB1B8CF23D10AA945A82D1A935F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Control Panel\International\Geo\Nation	ClownfishVoiceChanger.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClownfishVoiceChanger.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	APOConfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Modifies registry class 19 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\Copyright = "Developed in Shark Labs, Sofia, 2016-2026"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MaxInputConnections = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MaxInstances = "4294967295"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\ = "ClownfishAPO"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\FriendlyName = "ClownfishAPO"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\APOInterface0 = "{FD7F2B29-24D0-4B5C-B177-592C39F9CA10}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MinorVersion = "0"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MinInputConnections = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MinOutputConnections = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MajorVersion = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\Flags = "15"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MaxOutputConnections = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\NumAPOInterfaces = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$8\\ClownfshAPO64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}	regsvr32.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3140	APOConfig.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3532	ClownfishVoiceChanger.exe
3532	ClownfishVoiceChanger.exe
3532	ClownfishVoiceChanger.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3532	ClownfishVoiceChanger.exe
3532	ClownfishVoiceChanger.exe
3532	ClownfishVoiceChanger.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3532	ClownfishVoiceChanger.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 3140	3532	ClownfishVoiceChanger.exe	94
PID 3140 wrote to memory of 4180	3140	APOConfig.exe	98
PID 3140 wrote to memory of 1272	3140	APOConfig.exe	99
PID 1272 wrote to memory of 1768	1272	cmd.exe	100
PID 4180 wrote to memory of 2464	4180	regsvr32.exe	101
PID 1768 wrote to memory of 1700	1768	net.exe	102
PID 1272 wrote to memory of 1756	1272	cmd.exe	107
PID 1756 wrote to memory of 3056	1756	net.exe	108

C:\Users\Admin\AppData\Local\Temp\$8\ClownfishVoiceChanger.exe
"C:\Users\Admin\AppData\Local\Temp\$8\ClownfishVoiceChanger.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Users\Admin\AppData\Local\Temp\$8\APOConfig.exe
  "C:\Users\Admin\AppData\Local\Temp\$8\APOConfig.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\$8\ClownfshAPO64.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Users\Admin\AppData\Local\Temp\$8\ClownfshAPO64.dll"
      4⤵
      Modifies registry class
      PID:2464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop Audiosrv /y && net start Audiosrv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\Windows\SysWOW64\net.exe
      net stop Audiosrv /y
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1768
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop Audiosrv /y
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1700
  - - C:\Windows\SysWOW64\net.exe
      net start Audiosrv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1756
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start Audiosrv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3056

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x38c 0x3e4
1⤵
PID:1436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ClownfishVoiceChanger.ini

Path C:\Users\Admin\Documents\ClownfishVoiceChanger.ini
Size 1013B
SHA256 fff26b6c2dc6cd0edef0a328328ad37c186e03af9f78810bc5e0c5234ca663b9
MD5 d03aa3a8a9377d16452d572fcff3d46a
SHA1 e013a5b64b2f664fbd75b0e0880ecba2e7af21a2
SHA512 b4c952b66d64d931118423f3f16c2dad0d1ea896c0a1efc3fd7c94e4f494995e98881936bf7b88881d46c3c6bc13c0a8e38497436dc97c32126e3ccf52341b2a
TLSH
T1E71102590F289E8A2F54F213347EC50933ED3D08F09A74DCDA6A0A8E1CE52EF6364254
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3532-62-0x00000000722D0000-0x0000000072309000-memory.dmp

Download

memory/3532-66-0x00000000722D0000-0x0000000072309000-memory.dmp