942aad800fd45a2bcdf737460872f13b9d3ffbcbe0e841ffdd16e304d7eb7649

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
voicewave_installer_20260622.1782149848318b5507780.exe
Size 2.0MB
Sample260701-pgmlhsdy5m
SHA256 942aad800fd45a2bcdf737460872f13b9d3ffbcbe0e841ffdd16e304d7eb7649
MD5 c34c0487985f82f769934b264e4aa9b0
SHA1 3349226c4fab814e14092a28ffec1fe56a281cfa
SHA512 36f9ef56dc5354627e8e31445f49f87c8e9ce2f7bff88f94d6dfea54d334431280ba9bbe7c5434f03555116b9e68849a4609ef566e6e9692932c0f8cb05c1bda
SSDEEP 49152:d/QgXsq73YGNtR3feQYsQVPTGKRo8PChvSfhxpPa/Nn:dBR73YGNtxfeQYsQVPiKbPC4fNyVn
TLSH
T1C195016D4EE2758EC651D87AF7F5A57C489A4E36CC2201C17685204CDF29B83E98AF33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 5 IoCs

pid	Process
7048	EDownloader.exe
4196	InfoForSetup.exe
4580	InfoForSetup.exe
1204	AliyunWrapExe.Exe
6832	InfoForSetup.exe

Loads dropped DLL 4 IoCs

pid	Process
4196	InfoForSetup.exe
4580	InfoForSetup.exe
1204	AliyunWrapExe.Exe
6832	InfoForSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	voicewave_installer_20260622.1782149848318b5507780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AliyunWrapExe.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
7048	EDownloader.exe
7048	EDownloader.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 7048	2044	voicewave_installer_20260622.1782149848318b5507780.exe	90
PID 7048 wrote to memory of 4196	7048	EDownloader.exe	91
PID 7048 wrote to memory of 4580	7048	EDownloader.exe	92
PID 4580 wrote to memory of 1204	4580	InfoForSetup.exe	93
PID 7048 wrote to memory of 6832	7048	EDownloader.exe	94

C:\Users\Admin\AppData\Local\Temp\voicewave_installer_20260622.1782149848318b5507780.exe
"C:\Users\Admin\AppData\Local\Temp\voicewave_installer_20260622.1782149848318b5507780.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\EDownloader.exe
  "C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\EDownloader.exe" EXEDIR=C:\Users\Admin\AppData\Local\Temp ||| EXENAME=voicewave_installer_20260622.1782149848318b5507780.exe ||| DOWNLOAD_VERSION=free ||| PRODUCT_VERSION=1.0.0 ||| INSTALL_TYPE=0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:7048
- - C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
    /Uid "S-1-5-21-1749168396-1890032557-311772428-1000"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4196
- - C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
    /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Pageid\":\"1782149848318b5507780\",\"Timezone\":\"GMT-00:00\"}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\AliyunWrapExe.Exe
      C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\AliyunWrapExe.Exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1204
- - C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
    /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"3\",\"Errorinfo\":\"0\",\"Result\":\"Success\"}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:6832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EDownloader.exe

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\EDownloader.exe
Size 1.2MB
SHA256 6d2d20f4f89b01d146407f5569aa75758ace2a1796457bc1bc3fe13082c9150c
MD5 12aeda75bcb5b9dbd13bd85c0181aca9
SHA1 964d92810d8f42bb16b63a37406a4d9457ca6f27
SHA512 bf53d9b800d0b71c0a5b4305ca0ce661af0af0ab1e4a0c35dbdc6febca219ecf261886831254e592818afa90618a2ce2f8f6050a370ecbcb6a848bc7206434bf
SSDEEP 24576:+0TDvES51nIHFifKcXEp/YV2tlUkLXcYnbqrQBuVvgC3m9Pf:t3bXGllXcYbbBuVvgC3m9Pf
TLSH
T1BC459C60EBD381B2E09704F46DBFB37E99397664031585C7E3D01D2A0E616E2BA3539B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

English.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\English.ini
Size 2KB
SHA256 1e6f09d26ac1f99c4d3c10af77312e903a56240526247540e6335f79c03567b6
MD5 29f27c125dd3a42c9144c13bfd8c798c
SHA1 fa32c4a20144e1c06145cdb126ed714a9399ca38
SHA512 79ca233945a69a3932c744656f3ddc7f986f2a3a28c5c3e1143e02cb25f0857c4b617af8b706236cdd66e83b17aba71b76a7a3bfd60c3df26d691113ea420397
TLSH
T1EF51B68E9A60A23939C2077286E73D52AD31448556A7142DCCDB61C6238FA4C333B157
MD5 SHA1 SHA512 TLSH

Submit Download

InitConfigure.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\InitConfigure.ini
Size 3KB
SHA256 ce2c9d7ddfefb1d9c0cef83649dfc4a76c570562da835cec804e1f3cead0ba21
MD5 334125b792e1a2b158e87241e63fc5ba
SHA1 341ba8f4dd98532b9eb4cf2f26e746ca77f54daf
SHA512 8bb18ee52452ed1f4b7dfefbb76254362777032710ba36f716fdf50defcf19e481dfb2905e9e68a60a029fc47ab6594519c347a73af3268fa5095ddc468457ef
TLSH
T1625174CFDA10821A7DC4026527C96D997EE341EB0B90C664F6FE290E7784D512BDF22B
MD5 SHA1 SHA512 TLSH

Submit Download

LanguageTransfor.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\LanguageTransfor.ini
Size 305B
SHA256 a4433bed3d227249d08d37b84c84a001e443586d5cd2cd63f3fede48d282bae8
MD5 5b9180ca7b92eaf3fc02c35e78e66cbd
SHA1 14a854b2a08a1a4e0eb1f928f85c2e3fe9d18c05
SHA512 12dad07a3136f779774ab8ddab08c6dc2d78d184fe282719179a1be5f5c519e32f86065e8d5cca675345f25c121eba333604ea59de6aa60361d68f4a633db1aa
TLSH
T15AE07214FB17B4A2081C99CD341BC6C183C13CFE12A38B8342E29A881A03EA83A20830
MD5 SHA1 SHA512 TLSH

Submit Download

AliyunConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\AliyunConfig.ini
Size 1KB
SHA256 6a42f729fe4a2ed94581398ad25e55c29b65df9faa0ef38dddf66198b35a365b
MD5 a5bc5ef33e609859a3fb646f9d8d253a
SHA1 7ca2933d59683692e17d223e9aef524efd6902ab
SHA512 2135f14d7045eb544ef9adc555539aafc92c360b4bb7fa7dd1c0f5109bd4fff741244ca6d1ac960598d64231e9c2cac7fb512c280b637db6879feb0f5e098f5f
TLSH
T12F3127273AF910089073BF4AEFE8E5F7CB6A79116949C45A40D1034F49E5A80DE236BB
MD5 SHA1 SHA512 TLSH

Submit Download

AliyunConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\AliyunConfig.ini
Size 1KB
SHA256 1bfd7ea50cb5222eee06b7bc72013736f591dac10f317f04e0ea6308ce7f7b43
MD5 8896e0500662d86fadd5cc9d703b6144
SHA1 36678eeffcc35c9fd9663f3fc1882588615b892e
SHA512 8551f2831fd2071dead547f2e7664673d723d90538dea85e8d45632f63449848a60a8d7a832329e3d0941cc42541f1d8426efad1a80226d5658e1193ea7a6605
TLSH
T10331772739E900089073BF4AEFE8E4F7C76A78112849C85E40D1034F49E5A80EE13ABF
MD5 SHA1 SHA512 TLSH

Submit Download

AliyunWrap.DLL

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\AliyunWrap.DLL
Size 476KB
SHA256 bc2f1685f7157336027d370718dd2428c8a3883450a6191979d22745c3bca7fc
MD5 1ff4ff46834cba11482fb5d0f8c533ab
SHA1 6295fbebf55542839454c1a54c3e00355f020043
SHA512 659604861088c164d53d87bad6bbd24ef01c539d63322da541de29b9d14398c484396b16f627d2fb32b6d9b934e7a4b4a25bcfecadf9d13a7db4d9e97086c583
SSDEEP 12288:LaK0OuDBlYPIj/q9DQsEfExtrlp87pMaIPuboWMlyF0P/:Z9DeuBc/IPu8WMAF0P/
TLSH
T1B8A4BF53AA81C1B3D18A017517B6B77B2E39A7355324D8C3F3D81D785E206E27A3938E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AliyunWrapExe.Exe

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\AliyunWrapExe.Exe
Size 101KB
SHA256 015b2652280118c2c5016fec99fc542e32fd39ddfc9df513fe49677fc9bf6d42
MD5 1b6da142052f6736f7a657149de75bee
SHA1 1affdaa5faaa6844e6f47e5827ff351975be6cd3
SHA512 bf4eeff93839045d71115e7b7b79755b0b871ceca221a3eaedcccb19b9492672f04ee166192809ecdaa1575160bf2516fad5f5062520613dcc1f062577ae3555
SSDEEP 1536:x554a+kMgHZ73LkUluTbDJgX+oLENoN2CraI9WkF1X8OEdlg5BaAUY7BB:CswTbD6LLraInhEdlg5BJUYdB
TLSH
T1FDA36C217980C032D8A714738EBCDA69966CF9311B5599C7B3D80B6E0F61BE0BF31267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 596B
SHA256 b017a524d03defa3cd1c5c91bef43d7dc24e55c3834e939d0bf73c6191fa2852
MD5 eb4a8d0b40d39d7cde2ed296a01c7f46
SHA1 f7199bce656c5d40d9aabf24dffd0d6a346cc577
SHA512 75e02c2483d656313415451b7d727a895ae69ed761dee793bb43f9c4f7280f886589781c041a47cc49b4a8cdf62c99c4fa79ff85e94b00c902f62f01a958a3c5
TLSH
T178F090675AD81059B877622ADFF98936236778C5685CDD4C20E22B0E00E2402E0532FB
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 88B
SHA256 ae89726af2bd0c0218fbf63af20d4464f44dced5156364d817b6e73afc8e9f87
MD5 7f411750d07619f38537e7fd612b8b44
SHA1 cda241a1ce5141288582c8f0ac4850992b427bdc
SHA512 35dad46325060004a66e01e10af6a3ebfd94b6751347b6ec64840c4ec03d81480fc324494ea39dded03bf2f1a1ce352b15ab518d14214c15567af17fb32f16b8
TLSH
T1A6B0027757CD540AFD2A346ACBC8A43F5B47A1AC501F995E60C13647C4D4C5127130F7
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\DataFile.ini
Size 700B
SHA256 0920b5a1dc9673030ff71026f564c3112fe5cc9def95f24e2fbfa29b84805ea7
MD5 c3f1bc0124310724e349f9b8fe6c2bc4
SHA1 6d8901fad76a8fc7f11a3fb95fcab73aea4f9075
SHA512 e33355a18f0ae5d3dac44bf068cfdd489d42899cd7f96919450fe1e628c5e0b1b62e2abcfe80724ed54ec17f2d570b61d64ca5a526ba1fc3e01c18c3fa2afb07
TLSH
T16501D16A6AE81255F5B7662EEFF5C826573B78C54C48C98C10E22E0F04E0A11D5233BB
MD5 SHA1 SHA512 TLSH

Submit Download

InfoForSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\aliyun\InfoForSetup.exe
Size 60KB
SHA256 e23e375713ec4d7372dc3fababfaa612ecced4f207e7bd68ce5571a21499e2bd
MD5 af8a1f5caf9c8411d3eee07007450910
SHA1 5a3c2bd68f6e180920e94319f305f56defb995e0
SHA512 feddc353f9f8ce519f88fe8618c52b30eb6dd9a21391c295b95196183be010bbc03d3b605df72936804fc724b7075bc52af153c0ae477966bb7aac046a9da55e
SSDEEP 768:6Vyp8XwXEXrjOgRXvLH4IE3jDnIoiiBbIADgykhUMId50BLbCYiBwa:6ECwXShvLYIE3nnInie2khc50U7Bn
TLSH
T1E4538C127891C032CC2A44B55D34D7A09F2FA92217A498CB7FDD1ABE4FA17C05B3636A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

downloader.ico

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\downloader.ico
Size 395KB
SHA256 09a774165078362f091ea3988e89f378ea05ea04a9f9bf84f8d1f55fa6cdc1fb
MD5 c1d33eafc115d1af1c829f8558f3321f
SHA1 1dcc5af487b124ae52a11d008faa503478db63bb
SHA512 a2f2e738b3fb20b4fcc9dcfc018b35896fb3a85185631cf12a8c222b61309f6e98f56ce7f63f31077f44d17bacaf1d1b7faf5d451c7a85d2085bb6347f4c501e
SSDEEP 6144:a1A2enY44vSWhqZ0TYg/rTjViwcgLBtmZ3Jemwgvz9EDLGF:aPeYSWhqZCYqrT1cvZ3JQgr9EDaF
TLSH
T11F846E6D5DE2659EC2A1D47AFBF5A43C599B4E33CC1202C17586204CDB29B83D98AF33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.zip

Path C:\Users\Admin\AppData\Local\Temp\downloader_easeus\1.0.0\46free\skin.zip
Size 516KB
SHA256 d76da4d52c3b3878ea338bda8b2eb4c9b71987320257a597b668adb7b37acf18
MD5 2a348faf9af8af1de063521915ddb271
SHA1 3bbfe311222a80997343400f98fada36367c304a
SHA512 ca38cd4b0cf7f2f5f7803cead0bcd20672ac852b77ff22ade97bd20eba5f146d7737ff1d8c393be6512e9b6f7e239af04de21335be5b58c676d2ca3b8afc6403
SSDEEP 12288:4uhpHBQvuPwOo5GKQDiSYYLAVB/qhfKzWyFRajDMy5QA:4IpemPwOiGKQmS630iqyPCPSA
TLSH
T1C4B422E7E7792D77C3E8EE7D10670162A82ADD0A4560F19F8DC860B0ACD67057EDA306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads