34ee59c4cb8b4deddfcca8422ab2456cb72df8ad3797bcb8e9d6fc55a7265545

Sharing

Copy URL Twitter E-mail

General

Target
VoiceChanger32(1.87).exe
Size 1.2MB
Sample260723-cmwp6avths
SHA256 34ee59c4cb8b4deddfcca8422ab2456cb72df8ad3797bcb8e9d6fc55a7265545
MD5 d05c4c2c1aee2d55efa53d2ddedc39a6
SHA1 4043d947bf77bf9c6d30bfe21277931786da7fd4
SHA512 49b0f0f18f446c3a1c307d2a7e4c3662b0507f6c16f42b4fb850bc427a89e7128bf892ce2c342fa1c138194faa0708a332258ecc24042ae3a4aa5d261533e708
SSDEEP 24576:XY6WozeyJyEKK25pxffEZHadEvCRqwgoipKmzXOS7Cm+g3:ok3JytLfEZazBop9OoCng3
TLSH
T19D45230DBA70AE60EA76073185F04A33EACDF59816FCD65B93F4065D7CE7381AA4A314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  VoiceChanger32(1.87).exe
- Size 1.2MB
- SHA256 34ee59c4cb8b4deddfcca8422ab2456cb72df8ad3797bcb8e9d6fc55a7265545
- MD5 d05c4c2c1aee2d55efa53d2ddedc39a6
- SHA1 4043d947bf77bf9c6d30bfe21277931786da7fd4
- SHA512 49b0f0f18f446c3a1c307d2a7e4c3662b0507f6c16f42b4fb850bc427a89e7128bf892ce2c342fa1c138194faa0708a332258ecc24042ae3a4aa5d261533e708
- SSDEEP 24576:XY6WozeyJyEKK25pxffEZHadEvCRqwgoipKmzXOS7Cm+g3:ok3JytLfEZazBop9OoCng3
- TLSH
  T19D45230DBA70AE60EA76073185F04A33EACDF59816FCD65B93F4065D7CE7381AA4A314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  $8/APOConfig.exe
- Size 172KB
- SHA256 899e9634dba4bc62ccf5f84ecf4406384c4dbd2bc1be929989b3d5f78e0a0024
- MD5 2ed588d5f7957db1d430dd2fba5b6bbb
- SHA1 02d5c02f36c1c16b03f7c7f3a4c9881730609632
- SHA512 76dadd0235e620c23208f3b0864af4d65a81d95a4ecba3b89cb3f002cfa89c901154d1bdc8ceb1e430330f2ed7018aa7c6a8639754117b1f9e8959572c8a643a
- SSDEEP 3072:9gYH3dcenCHnJquZxslbwauvVNHpVboqnPk7ZHgB9U0aqYgJa5YjGylthfcZQfOS:9gidceywuZ0waoNXboq81Hg3baq6Athd
- TLSH
  T1A1047C21B6D0C473F5A2193459F8D6748A6EF8321E314DAB73944BAA1E306D1E634F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral3 behavioral4
- Target
  $8/AudioChanger.exe
- Size 129KB
- SHA256 ae6d7917d9185d9eb143d653932dd1e484edda77afef16078d9af6a9a2129b28
- MD5 95aafe530c0d51be5f251435fa110404
- SHA1 64877c7bf27b76a8466ba328df4552a7a9c7ebd0
- SHA512 f3a6d0ac61866c0fd970646b099f848b33caafdb981068b2963d7044d22dce102c47ea4d1c1ddbaf58776e50162377237516c67d6b9610648055e5d07536bbbb
- SSDEEP 3072:X/Fwez8wITvsbbyRTqHypN7O/M25tUJWsehn2BWzfIkKa37ac891fSe:XFzIroyp7y/MFJSzLr+D
- TLSH
  T1D7D38D1179C2C472E976293148A4DBB18E7DF9740F609EDBB388167A5F302C05A39E6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $8/ClownfishVoiceChanger.exe
- Size 818KB
- SHA256 4a71bf0a214ad2f82c98c57a53e7c3c4c6c69d9d250066b2f83e3aaac489d81b
- MD5 4bffef2e86a9bf70c093f19fab684cde
- SHA1 b715e9758b477b83e343aa695d2a705c8957f6ea
- SHA512 3946eb6589e508842da542819668d8bb45c292dc2c051f4327cc56a6f4482a769f072a695dfebd77d833f43d93261c03b988d60a300606f332b9112de56e5f3f
- SSDEEP 24576:Uo9vpZvxz7tIABHQjafLxgqFSJz2UuVAwgxpA:ddpB9tOQxgySNluVAwgxpA
- TLSH
  T131055B407193C826E1725BB1A836ABD1AF3DBD709FB1A4CF13D4059B48606E5A872F37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral7 behavioral8
- Target
  $8/ClownfshAPO32.dll
- Size 313KB
- SHA256 1e8f70d4bcb36306588c3c3264a51757e5b54ccf4a6f2021dcc2db704f2034a1
- MD5 9de8fe437e087f9eb03f0cd23e41bc69
- SHA1 b952b514af4bfce4587f9022172113b547f8aaba
- SHA512 9a1862576dd28bac7ac6de2abf99bcbff41f7bc6e3d715db2a5c9b947127763b52cd87c8333b27765a1174290b66ad7cafb895a2667b4a8f28ab7130f8d62b8b
- SSDEEP 6144:vQmWcqBe0Cyx9uIPrGbUFSwKveAO8fzsX4m9V5CIjRpKsVpSw3IO4JU:I2/0hx9uIPrG7SKzsXblUCjKy
- TLSH
  T18064CF01B4D1C472C57E10311669F6A76A3D36300BA8C9FF2BB44D7E8E386C19EB7966
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral10 behavioral9
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 14KB
- SHA256 0fe15b023e21b7054fabb3d47b6084d60f8e474d8f9ca3a0a25dcb2097d6f0b8
- MD5 586270250a1acce8126a0877fd5bb981
- SHA1 9f5645b37b3af04004697639855da5c99a41aca1
- SHA512 a1994b91337385ab153860a013912f9cacdf9c233395868bf8eedfbe6dd13841619a8048c1d8407ee4b77c466fd8f31fc5cac2c779a2ef58c3a2a02caeded055
- SSDEEP 192:/BZa4DYIcJ4nS1ejJThugw4LBs4TJjdjqJVQXS3p16ZGntrefncWCV:JZ8IcJ4nSkJlums4TJJjsVh3pwZs/
- TLSH
  T15852F79EF117F6F6D4CB46B045E2FF3B443E29028836A8B4DF50EA207D1789E6529047
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/LockedList.dll
- Size 28KB
- SHA256 671570118024c9132f12999e198cebc87b3bf1846695553bf478c5a42efec226
- MD5 2ee096682cc84f5fd44fb5291c00596c
- SHA1 8dccebf054abe13e5b324dfdfbe6605553971396
- SHA512 1ffdc3a5256b8eb62aff82c6429dcdf582009a908d43ab30d3fad84770b012be59c972323b6ae2b8d7ea2ae29d8ab3a99913205a0b33582e95dc813c31507d3d
- SSDEEP 768:Mne3kAZoxbRX66y11T9vBD3fNUHeBuf6qW:MnnTZyX9vBDvNU+UZ
- TLSH
  T107D2194457E000F7F7BE1AB079A92B0A5ABEF91868F195AB4F3754CA1D61112F628343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH
  T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18