Overview

overview

8

Static

static

3

DDMF Virtu....2.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    195s
  • max time network
    191s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 15:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DDMF Virtual Audio Stream v2.0.2.exe
  • Size 5.5MB
  • Sample260803-tec2hsvtat
  • SHA256 f725820f963e1dcb40efa3bc16fc01de2180ef9a6f5a9c89f52e651d8a210ee5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutioninstaller

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 19 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DDMF Virtual Audio Stream v2.0.2.exe
    "C:\Users\Admin\AppData\Local\Temp\DDMF Virtual Audio Stream v2.0.2.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4356
    • C:\Users\Admin\AppData\Local\Temp\is-29YSVVXWZB.tmp\DDMF Virtual Audio Stream v2.0.2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-29YSVVXWZB.tmp\DDMF Virtual Audio Stream v2.0.2.tmp" /SL5="$400B8,4309912,887296,C:\Users\Admin\AppData\Local\Temp\DDMF Virtual Audio Stream v2.0.2.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1592
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\DDMF\Virtual Audio Stream\Audio\tools\instrmv.cmd" remove"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4656
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ver
          4⤵
          • Executes a command shell one-liner
          PID:4648
        • C:\Program Files\DDMF\Virtual Audio Stream\Audio\wdmdrvmgr\x64\wdmdrvmgr.exe
          "C:\Program Files\DDMF\Virtual Audio Stream\Audio\wdmdrvmgr\x64\wdmdrvmgr" -q -e -r "DDMF_VAS_b6cfa287"
          4⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          PID:3464
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\DDMF\Virtual Audio Stream\Audio\tools\instrmv.cmd" install"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4616
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ver
          4⤵
          • Executes a command shell one-liner
          PID:4584
        • C:\Program Files\DDMF\Virtual Audio Stream\Audio\wdmdrvmgr\x64\wdmdrvmgr.exe
          "C:\Program Files\DDMF\Virtual Audio Stream\Audio\wdmdrvmgr\x64\wdmdrvmgr" -q -e -h "Root\DDMF_VAS_b6cfa287\0000" -i "DDMF_VAS_b6cfa287" "C:\Program Files\DDMF\Virtual Audio Stream\Audio\driver\DDMF_VAS_b6cfa287.inf"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:940
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{8ceeac2b-4023-6240-9d6e-1e447d2bbcfc}\ddmf_vas_b6cfa287.inf" "9" "4c66c8827" "0000000000000188" "WinSta0\Default" "00000000000000DC" "208" "c:\program files\ddmf\virtual audio stream\audio\driver"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:292
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "2" "11" "ROOT\DDMF_VAS_B6CFA287\0000" "C:\Windows\System32\DriverStore\FileRepository\ddmf_vas_b6cfa287.inf_amd64_ba6603a056961eac\ddmf_vas_b6cfa287.inf" "oem1.inf:7d98a439c52b5b47:DevInst:2.0.2.1950:ddmf_vas_b6cfa287," "4c66c8827" "0000000000000188" "68cf"
    1⤵
    • Drops file in Drivers directory
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:5124
  • C:\Program Files\DDMF\Virtual Audio Stream\EffectRack.exe
    "C:\Program Files\DDMF\Virtual Audio Stream\EffectRack.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3752
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x00000000000004F4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1776
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
    1⤵
      PID:4160
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
      • System Location Discovery: System Language Discovery
      PID:3996
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\mmsys.cpl
      1⤵
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2620

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          DDMF_VAS_b6cfa287.inf
          • Path C:\Program Files\DDMF\Virtual Audio Stream\Audio\driver\DDMF_VAS_b6cfa287.inf
          • Size 1KB
          • SHA256 81289d829478da1eef21737573433551ae2f6f430c71b39fa27d7abb993f14fc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          instrmv.cmd
          • Path C:\Program Files\DDMF\Virtual Audio Stream\Audio\tools\instrmv.cmd
          • Size 1KB
          • SHA256 1a3a8c19a85054302004ae1d3928bb8fbbd3f0b64fcdd37f3b7c9f4f7bdc00cc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wdmdrvmgr.exe
          • Path C:\Program Files\DDMF\Virtual Audio Stream\Audio\wdmdrvmgr\x64\wdmdrvmgr.exe
          • Size 33KB
          • SHA256 21f73ab0c5473ea5ea90603a81dbc489b0c519716b3d7975b76247fcd6ded33e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          EffectRack.exe
          • Path C:\Program Files\DDMF\Virtual Audio Stream\EffectRack.exe
          • Size 5.5MB
          • SHA256 ee0edd88dde4ef8ace7c1f036bdd071771cf696d8747b2fdba57f70cc9984135
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DDMF Virtual Audio Stream v2.0.2.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-29YSVVXWZB.tmp\DDMF Virtual Audio Stream v2.0.2.tmp
          • Size 4.8MB
          • SHA256 4969f5f823d261ac50b96f39fa2f884f95e9c8d7225940546a594084c1113717
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          EffectRack64.settings
          • Path C:\Users\Admin\AppData\Roaming\EffectRack64\EffectRack64.settings
          • Size 327B
          • SHA256 0fa9d8a5fadbbd45c2523fa11c3f2d1973d877a8cb63b8833beb6835a7c8d829
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          EffectRack64.settings
          • Path C:\Users\Admin\AppData\Roaming\EffectRack64\EffectRack64.settings
          • Size 114B
          • SHA256 a17608659bd7e6ae7008318b709db77507a75f59bc600cdeb59b75648bbd3531
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ddmf_vas_b6cfa287.inf_amd64_ba6603a056961eac.ini
          • Path C:\Windows\System32\DriverStore\FileRepository\ddmf_vas_b6cfa287.inf_amd64_ba6603a056961eac.ini
          • Size 460B
          • SHA256 6c5bd7d89cc98135a94108ee24efb870b7ffca8f823e2ed907224026cb391013
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DDMF_VAS_b6cfa287.sys
          • Path \??\c:\PROGRA~1\ddmf\VIRTUA~1\audio\driver\x64\DDMF_VAS_b6cfa287.sys
          • Size 73KB
          • SHA256 37f8889b6802f8409220baace101e822861f84caece2dce90c5d01118ebe6f68
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DDMF_VAS_b6cfa287.cat
          • Path \??\c:\program files\ddmf\virtual audio stream\audio\driver\DDMF_VAS_b6cfa287.cat
          • Size 13KB
          • SHA256 4643e4d624a83a31bd6752f28831b2a4ad6b630229955dd1252760486fc2d447
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1592-68-0x0000000002C00000-0x0000000002C01000-memory.dmp
          Download

          memory/1592-67-0x00000000004E0000-0x00000000009D6000-memory.dmp
          Download

          memory/1592-71-0x00000000004E0000-0x00000000009D6000-memory.dmp
          Download

          memory/1592-6-0x0000000002C00000-0x0000000002C01000-memory.dmp
          Download

          memory/4356-0-0x0000000000310000-0x00000000003F8000-memory.dmp
          Download

          memory/4356-66-0x0000000000310000-0x00000000003F8000-memory.dmp
          Download

          memory/4356-72-0x0000000000310000-0x00000000003F8000-memory.dmp
          Download