f5e120c42af33940e3535fa998ba71dcb174268eb182aa3896bb8418743b97be

Analysis

max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
11/05/2026, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$8/ClownfishVoiceChanger.exe
Size 940KB
Sample260511-n29fcagy8s
SHA256 f5e120c42af33940e3535fa998ba71dcb174268eb182aa3896bb8418743b97be
MD5 4ebd611981c2d6939bfab01111c28a86
SHA1 dd3fe5cfc7cbb4e79f30f49d1ba69465eefc9d93
SHA512 10ceb2cb27aa804f3aed2e02229390e239ab0bf2a5414681c66f23c8136e88d11f0667712bd37cf38bd4e460dfc55d55ab607822323cc5335a143d5cfe7ccf49
SSDEEP 12288:eQDjrYgyp9Hvrjayxfx39vC98aDZx1ZjrVcKibGiBaK+Eacm23XkJ18QsP/uQ1:eiry9Hvr5xfqyUPjrRcGHCk8QsP/uQ1
TLSH
T112254981B1D3D832D0724FB04C76AB91DA3D7D719BB1B8CF23D10AA945A82D1A935F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	APOConfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClownfishVoiceChanger.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\FriendlyName = "ClownfishAPO"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\NumAPOInterfaces = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MinorVersion = "0"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MaxInstances = "4294967295"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\ = "ClownfishAPO"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\Copyright = "Developed in Shark Labs, Sofia, 2016-2026"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\Flags = "15"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MinOutputConnections = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\APOInterface0 = "{FD7F2B29-24D0-4B5C-B177-592C39F9CA10}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MajorVersion = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MinInputConnections = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MaxInputConnections = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MaxOutputConnections = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$8\\ClownfshAPO64.dll"	regsvr32.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	996	APOConfig.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
6100	ClownfishVoiceChanger.exe
6100	ClownfishVoiceChanger.exe
6100	ClownfishVoiceChanger.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
6100	ClownfishVoiceChanger.exe
6100	ClownfishVoiceChanger.exe
6100	ClownfishVoiceChanger.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6100	ClownfishVoiceChanger.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 6100 wrote to memory of 996	6100	ClownfishVoiceChanger.exe	78
PID 996 wrote to memory of 5008	996	APOConfig.exe	80
PID 996 wrote to memory of 4968	996	APOConfig.exe	81
PID 4968 wrote to memory of 5060	4968	cmd.exe	82
PID 5008 wrote to memory of 5072	5008	regsvr32.exe	83
PID 5060 wrote to memory of 5088	5060	net.exe	84
PID 4968 wrote to memory of 1952	4968	cmd.exe	86
PID 1952 wrote to memory of 3136	1952	net.exe	87

C:\Users\Admin\AppData\Local\Temp\$8\ClownfishVoiceChanger.exe
"C:\Users\Admin\AppData\Local\Temp\$8\ClownfishVoiceChanger.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6100
- C:\Users\Admin\AppData\Local\Temp\$8\APOConfig.exe
  "C:\Users\Admin\AppData\Local\Temp\$8\APOConfig.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\$8\ClownfshAPO64.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Users\Admin\AppData\Local\Temp\$8\ClownfshAPO64.dll"
      4⤵
      Modifies registry class
      PID:5072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop Audiosrv /y && net start Audiosrv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4968
  - - C:\Windows\SysWOW64\net.exe
      net stop Audiosrv /y
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5060
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop Audiosrv /y
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5088
  - - C:\Windows\SysWOW64\net.exe
      net start Audiosrv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1952
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start Audiosrv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3136

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004BC
1⤵
PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ClownfishVoiceChanger.ini

Path C:\Users\Admin\Documents\ClownfishVoiceChanger.ini
Size 1KB
SHA256 9997eed85a66c4b7954bf851bfd3815901a23ff66b3018697902ea38828d832a
MD5 cadd7e82d684facb6f1207b97dab36c5
SHA1 3f156906fe7133613afd90c91d97c4902d999d49
SHA512 7c32ba74ac3254535ced497a44158a66fadf39f453c98f78af90c61f64e7a95c0c4ed7888cc7413b924076707d2df97acbfe58fabb5817fd34173bd8b8c1a49e
TLSH
T1C91112590F2C5E852F54F213243EC10833ED3C04F09A70DC9A790A8E1CE56EF6368254
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5008-61-0x0000000001220000-0x000000000129B000-memory.dmp

Download

memory/6100-60-0x00000000013C0000-0x000000000143B000-memory.dmp

Download

memory/6100-63-0x00000000090C0000-0x00000000094FB000-memory.dmp

Download

memory/6100-66-0x0000000071A70000-0x0000000071AAC000-memory.dmp

Download

memory/6100-71-0x00000000090C0000-0x00000000094FB000-memory.dmp

Download

memory/6100-86-0x0000000071A70000-0x0000000071AAC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads