c22a67afeae83ce55fcae93b9e4bd414be1e71d575cd6615cd4c9e857a2c7dba

Analysis

user interaction
yes
max time kernel
44s
max time network
45s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/07/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RevoicePro.exe
Size 40.5MB
Sample260705-e6154ahv71
SHA256 c22a67afeae83ce55fcae93b9e4bd414be1e71d575cd6615cd4c9e857a2c7dba
MD5 b02bcb2fd9f5346a245f50c8eab7323c
SHA1 656fe09e83016f078fd78e179e43d66ae9e4a065
SHA512 13ddc95c2fd40f5c2fa1769dd7da41debc20d9b18f66d29dbb7cb54ac4b682e84628dea826c209957eee7e5dac736ed745f6b38820a738d7040296bc55554055
SSDEEP 393216:+uuEoSQHCgAzNdR7J9f7XBXycRsBnDI8ZtCzpWlExq7pBnc/t:gSQHCpPRt9f7XBXV8be1qd
TLSH
T11A97AF46B1D801D9F07AF07A419AA707F631382143245AFBB2ADC6A51FBB7D07E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware defense_evasion spyware trojan

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	RevoicePro.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	RevoicePro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	RevoicePro.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Main	RevoicePro.exe

Modifies registry class 40 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\csetz\PDRFCB82CEB5541E2C7407AC7860DBC37A2ACB94364B6BFEBADD1AE5894AC33E159659 = "㈷㉅㌷䌱䉂䐷㤵㍆䈳㍄䘵ㄱ㈱䕂㌱䙆㑁䔱〶䐳䘲㐱ㄶ〰〷㜷㈲䑄䉄㤵㌷䉆㤵㤳㘵ㅆ㤹㑄〵䉆い㔳䔱㥃䌷㤴䔶㠷㙁㔵䉄㌸䌶䄱䘱ㄹあ㐴㝆㥁㕁㝄㜳ㄶㄴ㕄䈶㜱㌰㥁㜱㕂䌰䔲䑂䙃䑃㌷䐸㔹䈲㕂䐲䔲䘸㝂㘲ㅆ㘵䌳䘳㔳㠱㐱䍄㐹䘱䄷〵䍆㡆䘹䈹㘲い䐳䈴㠱㠹㕅〱㍆"	RevoicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document\shell\printto\ddeexec	RevoicePro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\csetz\ESHFCE82CEB5541E2C7407AC7860DBC37A2ACB94364B6BFEBADD1AE5894AC33E159659 = "㜶㕂䅆㜰㐱䍃ぅ䘱䔵ㅅ〹䌷〰㤴䘹㠴㍃䌳䄶㜵ㄷ㌷ㄲ㘷㝅ㄸ㈹い䌳㑃䄸䙄ㄷ䄸㐸㜷㈹㜱䉄㜱㉁㕃㐰㔸㐹㤲䌴㘹㤱䔶ㄶ㜴〹㤹㡃㔹㙅あ㥃䄵㕂䍄〲㤸㡅㘹ㄹ\u3130䄲い㐰㜰㌵㥂㌴ぅ䈲ㄴ㘹〶ぅ䘰䑃䉃㑆䍁䄱䔰㉄〳䘱㔵䈶䈵㈱䘳㝄䈰㝄㕂䔴䕂㍃㙅㤱䐶䈱㠰㔴\u3130䙆ㄱ"	RevoicePro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\csetz\BFAS1F82CEB5541E2C7407AC7860DBC37A2ACB94364B6BFEBADD1AE5894AC33E159659 = "䈱䍆䔸䌸㕁㑄㥁㉁㤷䐶䈹㜹䅅䈵㥃㍂㝃䐱ㄴ䘵㐳㈳䐴㈶䅆㜹㈶䅃㝁㍃ㅃ㜳䕅䄴㙂䑄䘷䐹䐷㐴䌷㕁㘵㑄〹䈷㙅䅆㉂㠶䐶㜰〵㐷㤴㌱㤶㙁ㅃ䅂㘳䈵䉁㡅ㄸ䌵䈷㝄㐴㡁䔳䌹㌰㤷㕃㠷㠷㐲ㄸ䕁㈴㈳䑃〱㔰㐱䕃䙄䔷㝅䑄䔸䔰㈸㜷䄹䐱䌳䑄㠵㔳䔲㜱䑃㌴㜹㈴䌳㐹㈰㔵㜵"	RevoicePro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\csetz\KWLNTP82CEB5541E2C7407AC7860DBC37A2ACB94364B6BFEBADD1AE5894AC33E159659 = "㌲䅃䕅㠵䘲䍅䍅䅄㤷䘱㘰㡆㐴䈸㠵䕃ㄲㄹ㠷㜲㍃ㄹ㝅ㅅ㍄䉃䌸䌸䔴䈵㘹㤴㤶䈷㠷㐵\u3130㠳ㄹ㔱㤶㡃㑄ㅃ㜸㍁ㅄ䘶㜹䉄㐷㔸う㕃㙄䘷㜶㘱㐶䈴䔴㈶㠵㌹䐲㈸㙃㡆㘶㡆㑁㡂㌰㐳㍄㠶䄱㉁㌲㌱う䅆㕅㌱䑆〰ㄵ㡆䔶㔴䍆䉅䅆㠲㥅㌴㥅㈷㈱㘸㔳㔸〰㈳㝁㤸㈴㘵䈸䄷〸䄱"	RevoicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document\shell\open\ddeexec\ = "[open(\"%1\")]"	RevoicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document\shell\print\command	RevoicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rvp\ = "RevoicePro.Document"	RevoicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document\shell\print\ddeexec\ = "[print(\"%1\")]"	RevoicePro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\csetz\FAWBNS82CEB5541E2C7407AC7860DBC37A2ACB94364B6BFEBADD1AE5894AC33E159659 = "㜴㍅䌷㜲㐲ㄲ䄲䔷䈸䍆䐳䍆㡆〱䍄㑄㐹䕆〱䅃㝃䔲㤹〰㌰〵㠳㤲㜰䙆䑃䑃㡂䌶䈴䘷㌵䄵ㅄ㘰䉄䘸㔱㈶䉅䈶㝃㜹㜸㥁㘳䙂ㄲ㥅㍁㘰ㅆ䔳㜳㤱㥂㤲䅆㘶䕄㡂㤲㙃䄷䔹㉁㤰䐷䑅㜳㥃㝃䄷㘶㐷㌲䑅㤳䐶䐲㍁䕂ㄸ㌲䅄㈷䔳㔵〰䌸䑄䈳䘹㌱䄵㈰䐰㘳㠷㙂㔳䌳䄶㜲ㅆ䑃㕅"	RevoicePro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\csetz\OEAYCM82CEB5541E2C7407AC7860DBC37A2ACB94364B6BFEBADD1AE5894AC33E159659 = "㈹䘳㡅㌴㜱䄰ㄳ㌹㈷䍅䑃䈴ぃ㔴䕃䕆㌳㑄㤱䘴㝆㐵䉄ㅆ㠶䈵㌹㑆㌶䌱㝂㌹䔶㡆䔳䌹㐶䕂㜲㔵㌱㕁㘴䄰䈱䔵䕁䔹㈲㜰㔸䄵䐹㥃䘸䑆䍃㘰〶㠸䈴㌲䄶䙅䍄㈴㠹㐶㌹㘱㑅䄵㑃㙂䅂䑂䔵㌹䘰㕃㝅䕃ㅅ㜳䙆㕄㉁〹ぅ㑄〹䈱㝆ㄳ䈸䘲䉃䔳㍆䔷㝃㙅㌶㜴㙃䕆㐶㔶䌵䅄䔲㌸"	RevoicePro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\csetz\HDPB1A82CEB5541E2C7407AC7860DBC37A2ACB94364B6BFEBADD1AE5894AC33E159659 = "㥄㜰㤸〳㙅䐳䉄㘲㌰㌳㕁〴䉂㌹䄰䄳㌹㌵㙆䔳㜳㡅㙁㍁〵䍂䔹䍅㔱㜰ㄱ㠹㘸㠶䉄䅃㕁㔵㤶㠱䌴㈳㙁㝆㜷䈶䕁㔱㙆㌸㜷䕃䄸䐳䐹䕅䘸㑃㘴㡆ㅆ䑂㝆䉂㌶㘴䈷㔷㙄㝄㕅ぅ㔷䘴䈷〱㌰㝄䐳䘹㌲䅃㥆㥅㜸䐹䐴䌵㔹㉄䉂䌹〳㥂䄶䈹㜷㝂㠵䍃㘲䈸䘴㤵㔲㔵㜹㝁䑆䉅㤷䈳㙆䐷䌷䅆〷䔴䅄䐶㡁䙁䈷㥂䐷㥃䌷㘱䘲㠵㔰䕆ㅆㄹ㜳㉆〸䐴ㄵ〵䅃䔱ㅃ䅃㥅䄲䙂㌶㈲㉄㠹䅄䅆䌹㤷㜸㠳㝂㥅㌸㤴㝄㌳䄰䅄䈱㍁㤰㡁㔷䘷䕂䔱䘴ㅁ䌰䘱㍂〶䔹㠳㔹ぃ䉂㜷䍂䈳䉄㙃㐶䌳㐰䌵㕁ぃ㘶㙆䐲㘹䍁䈵䔶㑁䌶㤵㌲㝅㘹䍁\u3130䌴㐳䄶㥆䔶䅄㑅ㅅ㥁㠸ㄷ㐵ㅂㅂ㔷㙃䈹䘲い䑂䉆䙅㉅〳䅄䔱㝆㙆㠵㝃䍄㔹㌰䔹㔴䕁㜸䈰䍁䑆㠷㐳䌵\u3130䉅䌱䌰㘰㥅䐷㉅ㅆ䌴䙁ㄸ㐳㈳䘷㘱䉄䐸䄵㈵㡂〰䈸㍂䌳㍃㈷䌴㠲㈷㑄ㅂ㡂䄴㥃䉄䙅䄸㔹䐸㑆䔸〷䍅㌸㔹㥄㍂䘸䑆㠴㙃䐱䘳㌱㌱䉃㕆㡂䍂㠴㐱䘳ぅ㈹ㅄㄱ䙃㠵㘳㠰䍄㉄䈹䌲䈳䈸䙃㠸䘰䉁㘵䘰䅁㉁ㄶう䐵䐷䔰㍅䐷㤲䍁䈸㘰〸㍁䈳㝄㌷䈷㍁㍅㥁䕂㡅〵䕅䉁㍂ぁ㔷䍅䅅"	RevoicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document	RevoicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document\DefaultIcon	RevoicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\REVOIC~1.EXE,1"	RevoicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document\shell\print\ddeexec	RevoicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document\shell\print	RevoicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\REVOIC~1.EXE /ddenoshow"	RevoicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rvp\ShellNew\NullFile	RevoicePro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\csetz\KOPGHT82CEB5541E2C7407AC7860DBC37A2ACB94364B6BFEBADD1AE5894AC33E159659 = "䕄䕆㐹ㅃ㔷䑂䔰㔱䔱ぁ〴䘶㉄㝅㠰䐴䄴㕂㡅㤲〳㜱㐸䌹㝄䙂㡅ㅁ〶㘰㠰䙃䌰䍄㌵㐲ㄵ㝁㑁㍆ㅄ㘴ㅃ㙃㜱䕃㤴㈹䄸ㄱ䉃䙅㉁㠱〸䄰㑁㙄㥄䔰㔱䔵䌴䑅㜹㡁ㄱ䌸㡆ㅅ䉅〱䌱䔱䌱㔰㕃ㅅ㙆䄱䔲〴ㄴ㔸㜸㈴〱㠹㑄㌷䐰䉄㐶㔱㑂䅆〳㑃㠴㤰㤵㘵䐷䑁䐵㔳㝃䐴㕁㠵䔶䈳"	RevoicePro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\csetz\ZGWLSM82CEB5541E2C7407AC7860DBC37A2ACB94364B6BFEBADD1AE5894AC33E159659 = "㡃䐹㘹㥁㥁㘲䕄ㄶ㈰㈴ㄲ㤶ㅂ㑄㘱䐵㍆㐷䈲䄵㑅䍃㘲㐲䑄ㅅ䐹䌴㑃䕅䌸㍆〸㘶㐲㡅䘳㝅䑆㜲䌲䌵㔷㕂㍁㔰㘴㥅㥆㕁䘲㌰㤷ㄱ㈱ㄶ㡄〵㐱䙄㑁㜰䙄䘴䐵㐵㝃䌸䈰䙂㑃㈳㐲䅄䘰䌳䌵㑆㈵㈴㍂䐴㜲㍆ㅅ㌸䈹㑃㜲〶䔲㍁䈵䐸㘸〷䑄䈹㘲㜴㉅㈸㤸䕅㥃㔶䌷う䄹䐹䉅䑆"	RevoicePro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\csetz\HUDXJK82CEB5541E2C7407AC7860DBC37A2ACB94364B6BFEBADD1AE5894AC33E159659 = "䄱㔹䐷㠷䘰ㄸ䘰䈲㠱䉃ㄶㄳ㝅㠸㥆㑅㠴䙆㐹㠵㜵㐲〰䌰㉅㌷䈴㍃䔵䉅㕆㍁䑄ㄳㄴ㙁䌰㘴㤹㌰㑆㌹㐶ぅ㐹䔲䘷〹㌱䈴䈹㈶㡄㈹㕅䕄㈰㐳䉃㝁䙂㕄䔹〹㌲㘵䉆㔲䑆㉁㈹〲䉁ㄹ䈸㐹䕅䐰ㄵぅ㔸㙄あう䔲䈲䐹䔴䉃㔸㘶〳㘴䘲㌳㜳㝂㉃䐸䔲㈴ㅁ㍄䑃㌳䌰㔵ㄱ㝃㍄㘰䐸"	RevoicePro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\csetz\BFQTYS82CEB5541E2C7407AC7860DBC37A2ACB94364B6BFEBADD1AE5894AC33E159659 = "䌶㔸㈲䄶䕄䔳䌷㈹䘷䘴䉂㔷䘳䅅䘰䘹䔸㌴㝄㡆㙁䘸㐹㈱㜹䈸㝅㡆ㄵ㍄㠶䐴㤷䐹ㄱ䌱ㅅ䉅〲㥆䘶㥂㘰㝆㌱㔹䄹ㅅ㜶ぅ㔷䔲㜵䉁㠰䑁䌶㑃㝆㡂㐱䐰㙆㝂䄳䈸㈹㘰ぁ䌷㘹䔹㈶㥆䔶䐲㘴㝆䐶ㄶ㑂㐲㘷䐵ㄴ㍄㈷ㅃ䘰䔵㐱㈵䙅㔲䌲䘰㐱㈹䑁㡅䔰䅅㤷㑄㠴䙂㐴䐱䘹䄰䕅㤰"	RevoicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document\AppUserModelID = "SynchroArts.RevoicePro.2.0"	RevoicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	RevoicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document\shell\open\command	RevoicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document\shell\open\ddeexec	RevoicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document\shell	RevoicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document\shell\printto	RevoicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document\shell\open	RevoicePro.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\csetz	RevoicePro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\csetz\ADUPVS82CEB5541E2C7407AC7860DBC37A2ACB94364B6BFEBADD1AE5894AC33E159659 = "〲㘷ぃ䙅䔲ㅃ㍁㌹㤱䌵䘹䈶䍄㍂䉁㔴㥅㡆㕄㙅㑃䕃䄴䍄䕁䘰䘸㥁㉁䈹㉆㕁㘷㤶䄰㌳㤱㜸䔹䕄㤲䐷䈷䕁䕄㙅㡁㙅㘲䐵䑅㑁㡁䘲㥃䐳ㅆ㘹䅆㌹㈴〰㕃䘲䙄㤸䔵䍅㡁ㄲ㔰㑂㌰䕃㍁䙅㤲ㄷ䘸㜸㉆㜱㥁䕆䙄㜹㔳㘷䄱㙁㍃㌰㈵㈷䘷䕁䔴䈴䘱㍅㘹䉃㥆㜲〰㝆䍄䕁〱㠱䕆䈱"	RevoicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rvp	RevoicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rvp\ShellNew	RevoicePro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\csetz\AWBHCT82CEB5541E2C7407AC7860DBC37A2ACB94364B6BFEBADD1AE5894AC33E159659 = "㌳䅆㝃䈶㍆㔰㠲䙃ㅅ㜸䌵あ〲㝃㈴㌲䙁㈵ㅄ㔰㥂ㄱ㉅ㄶい㕂䔹㍂ㄸぁ㌳䘸䄵㍅㜱㙆䙆㡁㤲䉃ㅃ㈱䄶㙃㑁ㄲ㠲䌲䅅䕅䄱㝂䄵䐱㘳㠴㝅ㅂ䈲ㅁ䉆ㅃ䍆ㄲ㕅䑆䔷㙃ぁ㙆䍂䈸㈰㌰ㅅ䈲㍆㥄㑁あ㘲䘴〴䈶㐷㉄㤹㐰㐹㙂㝂㔵㜸㉆㠴䐰㡄䔰㙁䐸䐸䌰㌹ㄱ〱䐶䍃㕂䄰䐰㠱㈶"	RevoicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document\ = "RevoicePro.Document"	RevoicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\REVOIC~1.EXE /dde"	RevoicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document\shell\printto\command	RevoicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\REVOIC~1.EXE /ddenoshow"	RevoicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RevoicePro.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\REVOIC~1.EXE,0"	RevoicePro.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F	RevoicePro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 5c0000000100000004000000000800000b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	RevoicePro.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
844	RevoicePro.exe
844	RevoicePro.exe
844	RevoicePro.exe
844	RevoicePro.exe
844	RevoicePro.exe

C:\Users\Admin\AppData\Local\Temp\RevoicePro.exe
"C:\Users\Admin\AppData\Local\Temp\RevoicePro.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RVP_Host_1

Path C:\ProgramData\boost_interprocess\16000000\RVP_Host_1
Size 528KB
SHA256 7978a772ed4b9841d2257e9efc6d0eeab56758ab27df96522201ac202ec4041b
MD5 b52aaebacc4daa74bd56a91f06934893
SHA1 41cf3d8a567f425b2bedec8d6b5ae188a382560c
SHA512 e1f362040efc6e761a2d582795b71edfccbbb513c000bda18c81cea6658610c4bcb42acbdb636e2a85a4710684fcd024e57a76e8d3951d0b08dc539bc19a255d
SSDEEP 3:0l1l/dlPt:c
MD5 SHA1 SHA512 SSDEEP

Submit Download

__SAL_RVP_INTERPROCESS_MONITOR_DIR4__

Path C:\ProgramData\boost_interprocess\16000000\__SAL_RVP_INTERPROCESS_MONITOR_DIR4__
Size 17KB
SHA256 3271f2621be33b614f82561121ed31776373b65591fa3c78cf891135fe517dd4
MD5 534040150bfcc3b65ea7cbc8571b1559
SHA1 071355f7acad8dbcf185962e452923eb1384b5b1
SHA512 40fd381f04220466802a10689f780ea80627c1229ddadf71412c05e1c3d163453e71744854a3b644dce2574b2eb2951f80644791be7c1aaab91bd2c2b6922a47
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/844-0-0x0000000140000000-0x00000001428A5000-memory.dmp

Download

memory/844-853-0x000000000AC50000-0x000000000B133000-memory.dmp

Download

memory/844-1173-0x000000000AC50000-0x000000000B133000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads