2ec319eeabd3ec839cc82f28dcb6e86e6f2d5c6e09a4ac1b444e80fe4413aca5

Analysis

max time kernel
900s
max time network
613s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
voicewave_installer_20260714.17840894148733b5550674.exe
Size 3.6MB
Sample260715-e1bm9abw3n
SHA256 2ec319eeabd3ec839cc82f28dcb6e86e6f2d5c6e09a4ac1b444e80fe4413aca5
MD5 2e192fbc97db5f2644cb74624550bb1b
SHA1 af0331038b1d263941b1602cd726807b4522a4d1
SHA512 453c2a77007b2d9052acf42817c25443a6ad2126e956e18c1025132213f45cb5fa439a819135d812bc117159690de833e9620b9889e7f3f9bc0d086730d099a2
SSDEEP 98304:TA4HXq5Y68xio+Q3Wf8q6rVfV9WxSKFG8ZCv4:XHxiQ3s8qUxV9WxAmCA
TLSH
T1E406231AAE63DC8FCF626C34B5520C1D1A3D5ABFD0124AD317BE1E384C693827AA7553
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 5 IoCs

pid	Process
1516	EDownloader.exe
4896	InfoForSetup.exe
4948	InfoForSetup.exe
752	AliyunWrapExe.Exe
360	InfoForSetup.exe

Loads dropped DLL 8 IoCs

pid	Process
1516	EDownloader.exe
1516	EDownloader.exe
1516	EDownloader.exe
1516	EDownloader.exe
4896	InfoForSetup.exe
4948	InfoForSetup.exe
752	AliyunWrapExe.Exe
360	InfoForSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AliyunWrapExe.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	voicewave_installer_20260714.17840894148733b5550674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1516	EDownloader.exe
1516	EDownloader.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 1516	3852	voicewave_installer_20260714.17840894148733b5550674.exe	87
PID 1516 wrote to memory of 4896	1516	EDownloader.exe	88
PID 1516 wrote to memory of 4948	1516	EDownloader.exe	89
PID 4948 wrote to memory of 752	4948	InfoForSetup.exe	90
PID 1516 wrote to memory of 360	1516	EDownloader.exe	91

C:\Users\Admin\AppData\Local\Temp\voicewave_installer_20260714.17840894148733b5550674.exe
"C:\Users\Admin\AppData\Local\Temp\voicewave_installer_20260714.17840894148733b5550674.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\EDownloader.exe
  "C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\EDownloader.exe" EXEDIR=C:\Users\Admin\AppData\Local\Temp ||| EXENAME=voicewave_installer_20260714.17840894148733b5550674.exe ||| DOWNLOAD_VERSION=free ||| PRODUCT_VERSION=1.0.0 ||| INSTALL_TYPE=0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
    /Uid "S-1-5-21-1875162379-3804078649-638427191-1000"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4896
- - C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
    /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Pageid\":\"17840894148733b5550674\",\"Timezone\":\"GMT-00:00\"}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\AliyunWrapExe.Exe
      C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\AliyunWrapExe.Exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:752
- - C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
    /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"9\",\"Errorinfo\":\"0\",\"Result\":\"Success\"}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5728

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EDownloader.exe

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\EDownloader.exe
Size 3.4MB
SHA256 09fc252661481ea65e23c90babdb7801be6b77dc5db3095cf726372d0d80ff0a
MD5 83aaf734d620f4a1b4aab6d5f0cf6819
SHA1 e6e2d128d260c9a52e0ee3cb32023ddb9d1b9d66
SHA512 22c34ed55fa0149f72bf2ad4751eef52897bb5dd4f300cc5d0cbadc566c33b7907114cca567ad12edd58c1aef811014bbbe81599ccb9e28a2af8007347e92df1
SSDEEP 98304:H+gzEdPtI8TzKPrqSUiyk++U3AfqkQHLtrBUnKR:eVbNSokU3Oqko5rBU4
TLSH
T108F5E12176A28037F5B304B59D7F6B6ED46CBE32072494D7A3C40E2D0A71AD27A32767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\VCRUNTIME140.dll
Size 78KB
SHA256 44aca93d4a046252c60f0cbbe5259d9509b912aa07e5379b2cdbe842700c7e9c
MD5 b8f25e1833429fd8f529c5fdd2a4f3b4
SHA1 7ae7ca5e695e6cdb590022a0602879bc2f56a65a
SHA512 077007237e7ddfd280dd08f145a0f3c775c461bbf61574cbefc4f7c29ba6308c16b52da94dc8f78345fec1cdac25f5e604b890669124a7e38e205e54a68729e7
SSDEEP 1536:JbiyVUrqIQsn1xtg6RxkkBGCGHDWbWzaecbGaBLL+/o8:liyLyt/xcRjWazaecbGCu/o8
TLSH
T1A9737D4335E082B5D9AF05F4D8BAA70A9A7DF8500FF26EE76B944949DF60AC09770307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AliyunConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\AliyunConfig.ini
Size 1KB
SHA256 b3596e7f9751baa7d3f885db51f568def5d889ee13219812277a74cfea2be305
MD5 d8741ba894087a5d685e241c0e45780a
SHA1 b99533ff6d77ed29b0556c8ae7926e81b159b3d4
SHA512 2c556d60c003570dcb428e3387bf68c65e96fb6f6badf415432f649126861e3afc04464333ae4345edf1a683bdf50da4bcf13af043ac2dfd92ef29065deea4e3
TLSH
T113316B273AF910089073BF4AEFE8E5F7D76A78116949C85A40D1034F49D5680DE13ABF
MD5 SHA1 SHA512 TLSH

Submit Download

AliyunWrap.DLL

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\AliyunWrap.DLL
Size 482KB
SHA256 544b2bf4ccdaeaf6ce8f3e0d4faa98281ad17f65fc2defaec915d16d320dbda6
MD5 90a1760397db7be8a7a82b82cfb72d2c
SHA1 774f0a6c25a61b0e3c2c80fc4bc5830d4c77db55
SHA512 29439377953068d75902c205f2db5f40b0bc9925e6761082dcd0da722ed1301df8d1dbe93f8f0e301322a4e6c680139f0c21e0974387d3c20a00c6ca947b9ec4
SSDEEP 12288:laK0OuDBlYPIj/q9DQsEfExtrlp87pMaIPuboWMlyF0Pas:39DeuBc/IPu8WMAF0Pas
TLSH
T1FEB4BF53AA80C1B3D18A017516B6B77B2E39A7355364D8C3F3D81D785E207E27A3938E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AliyunWrapExe.Exe

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\AliyunWrapExe.Exe
Size 107KB
SHA256 2cc207dd14110192c642536432166a1ec77ee4aae071d206707425b7fc969cd3
MD5 f9a22315670147c91e2e044403f8e791
SHA1 a0407ef0c23fc82c831b2e2fef48048e98c17e56
SHA512 865f71d0ddc09506fea34aaf481f79469c7fbcb523dcf4f6967a4f55ad4d17907e1294c21f5e7dae96844d54a5e16174579b11256c8836ab3c17403f9a259d7f
SSDEEP 1536:M554a+kMgHZ73LkUluTbDJgX+oLENoN2CraI9WkF1X8OEdlg5BaAU+/I0:vswTbD6LLraInhEdlg5BJU+/I0
TLSH
T107B37D217980C032E8A714738DFCDA699A6CF9311B5598C7B3C84A6E0F617E1BF35267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\DataFile.ini
Size 1KB
SHA256 a56d02b2639006be6acb3dbbcd09a07e62daf1a259ef482fe53d3917039d1941
MD5 dedf95af2127d0486d8f85ec2bebbc61
SHA1 3ee3d185ad1990e8dfc9770889608e8ff77c930b
SHA512 d0915d9eedfd1a99cf5c44d441599982dd4395bd1a4e8c1629395af1d71431ce2481312a4ce0798b4a292417b5e560aa6e5d9331a5f1c20870155c62951a7942
TLSH
T1E221C06A6AE8215AF5B3662EEFF4C936533B78C54C48C94C14E22F1E04E5901E4533FB
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\DataFile.ini
Size 598B
SHA256 a1d61fdf9985289c43d7c286398003fb13e082bbc4d8f35b7920921c1bbd2d39
MD5 193fcc3d25b622c9e2481e2e03db2533
SHA1 6a6c29057a45f3784876ccc4fd03f799144c977d
SHA512 f9d0d16e1d2d8fecfa8f2f77d0b8e18a99d7cb1020f8b359df2a2bd8654b06f5436d554b029d9edb14a7c00a4140ff34dcf5632502956e2a09a120ad3d37a09b
TLSH
T141F0B4775AEC205AB8B3266ADFF88877532778C5185CD94C64E12B0E00F1002D0532FF
MD5 SHA1 SHA512 TLSH

Submit Download

InfoForSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
Size 65KB
SHA256 b7e0bb05d2b6673dae04d3a008b516e3c2803e6d388dcae3405b94e7f7ddcf3f
MD5 f20f89694c7ff9e0c84d8b55ddabcb5b
SHA1 1ac86fa7877c09e9132958171260c12ef289fbfb
SHA512 3d27047339e6c70876778a90bdde84dd758be397dcc1453f26d4dffc4d6eec378b58eb88ef88c0eba24fb8c43099e8d50d8dbeb26dada81f1a3216d27d039ca8
SSDEEP 768:AVyp8XwXEXrjOgRXvLH4IE3jDnIoiiBbIADgykhUMId50BLbVTkK/Ws5ALH:AECwXShvLYIE3nnInie2khc50H/a
TLSH
T12F638E127890C033CC5A88B55868D7A09F6FAA6217E494C77FDD16BD4FA13C06F3936A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\cacert.pem
Size 232KB
SHA256 5a03d0cf132b66659edcf43c087c4cb1b3647f341ace02dd84c693c804a0a5dd
MD5 3548d8825b94ecf3cb6fc617e32e8989
SHA1 54edbb080d5505f03dff5bbf71efa31794d0e064
SHA512 fc5a5d81a9d052701ddcbf62437a7c64813d22a842468fbaa530ff3a5541cbbf2270b885974627c468d6af217806e39ea20802e7a3b79ee76e9700fef56fa024
SSDEEP 3072:VhGvwW6Jj7ITWYv0yoVH283rz9WqIAsjjg4DsUQS88UP4TFf3xVOVkCC554jMN/V:f5W+j8chWf8xyvp5iIzB9Nxza/MT+K
TLSH
T18434BF9BCF526C5918D3E094C9AB025DD81E4263DDDB78A32D0A3801DF89B3E66FD48D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.log

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\installer.log
Size 1KB
SHA256 3bbe8b144f405063a5a9d2b9cae4647766ade9a7eed92b43a78f142edd60389a
MD5 ffcc4d21a422044798fc533d2f015136
SHA1 97415eddf552c3d8913267c8e1b59a6aa2624914
SHA512 4952c524a4eee68aedcfdc1ee6a86accb50df0d9212c25ff67c795abc0cb042078c2c7440977e7e63221c98d9aced721965ca755d7a012713e245a8e127cc332
TLSH
T1FD41AD6F8EE0D29BAD71055117E81AC356D7A342985445D4BFF0DE0EBC6B0312BD9A83
MD5 SHA1 SHA512 TLSH

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\libcurl.dll
Size 359KB
SHA256 683bb7b131576fe7bc8efbd3c5b00b9ca5fd91b763774f51f4fb71a746cd896a
MD5 2fc4f35490fa25908c2963a0fa586cb7
SHA1 ba80bfe3ef6eb07f060100f231491de63001d35e
SHA512 fb23525ac35f66cad45dc505f40553b1a1556752b18ff2259f11515a33546b5d6f2c44d9a2e7dc3f2d7336e656ade9ec9291434c5e038bbddb696c055d89dc7d
SSDEEP 6144:lj9yPDdfoOVjXiNATUHtpt71vYSriO77CjZh9mXoSsXzimTt0V9nFEzl+/y:lj92GTLRrii7Cth0AXd0V9FEhCy
TLSH
T13C745BA2FC018032F6D21175E6FA9FB76C6C5125271AD0D3EAD044A49D749E3B23EB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\zlib1.dll
Size 84KB
SHA256 b4ad7ba65fededaa11befbfcbd688a1da96031c88e2324075b42e5057f04c6b8
MD5 089c6e80c5d506ca980f4fe2f6747dde
SHA1 f59e5441c43b008ff49a67cdc9960d33be5425f7
SHA512 dec10d21a229557624b47e9d2e3e011dba592bf9e31d67cd25b6237ba23cf6661ec4475559d06be6a0447260d142856bafbc57cc3cabb96654762dc03feec4f8
SSDEEP 1536:F2lVj7uRxDXVJ3DD7fGcg/hiOrN/GyrZlIOsIOI/QxVDIJ/D:FQVjSHTXbg/hjdZviI/QxVDIJ/D
TLSH
T19783AE82FAD053A2D9F6007490F7877D9A3670214B97ECDBE38DB66849113D1AB362CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resource.ini

Path C:\Users\Admin\AppData\Local\Temp\resource.ini
Size 237B
SHA256 324e0e753b7f5d69d52a89a085329e9dac9b4a33b1bd34cad8cb81530d00cfa2
MD5 b452f9529880ca4668ce2f603ab147f6
SHA1 5fb906044b5e01e482b7ca6739a27ca317b3bdae
SHA512 0965f455912e62ba2c40134d48dbfc631f383db7b71033743c8f06533ab7b338e8947478002da3fa92390f15eed0d90d251aa6b8ed7d49e33a30563aa392bf46
TLSH
T1A9D0A7BBCB4A00FFCE0083C839002F97F703491A4423CD1098A01A08F02281AE8878E7
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads