9e1dd2a58061382da6d17b05d1b97f56063046538952de052aa0a523623c4d43

Analysis

max time kernel
58s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ClownfishVoiceChanger.exe
Size 985KB
Sample260809-ry6rtssyft
SHA256 9e1dd2a58061382da6d17b05d1b97f56063046538952de052aa0a523623c4d43
MD5 c5f5ce5a750f79fb8c20157dbd71833a
SHA1 7a8a06a183ba6465bb02984516beee6fdf5c3b85
SHA512 e3fa60275dd6e19098b3d814eb21e8c3106ab6a6f7d2a74a4deb9bd2aaf7f3501869ed62d05565cfdb2244e65e10316fc90f0d550aa77a14f6f9177c66640d37
SSDEEP 12288:LaSsnEVp1pFJq9hRIL8NOvsE6IVEXYD01b6aOffk5NI/r:Oqxp/IRILRkE6IV7Y4OST
TLSH
T13A255B1C6EE502B9E1F2C770C9A16506EA717C85873D99DF03C1C2994E729FACA39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2428	ClownfishVoiceChanger.exe
2428	ClownfishVoiceChanger.exe
2428	ClownfishVoiceChanger.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2428	ClownfishVoiceChanger.exe
2428	ClownfishVoiceChanger.exe
2428	ClownfishVoiceChanger.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2428	ClownfishVoiceChanger.exe

C:\Users\Admin\AppData\Local\Temp\ClownfishVoiceChanger.exe
"C:\Users\Admin\AppData\Local\Temp\ClownfishVoiceChanger.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2428

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3a4 0x324
1⤵
PID:2504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ClownfishVoiceChanger.ini

Path C:\Users\Admin\Documents\ClownfishVoiceChanger.ini
Size 1013B
SHA256 fff26b6c2dc6cd0edef0a328328ad37c186e03af9f78810bc5e0c5234ca663b9
MD5 d03aa3a8a9377d16452d572fcff3d46a
SHA1 e013a5b64b2f664fbd75b0e0880ecba2e7af21a2
SHA512 b4c952b66d64d931118423f3f16c2dad0d1ea896c0a1efc3fd7c94e4f494995e98881936bf7b88881d46c3c6bc13c0a8e38497436dc97c32126e3ccf52341b2a
TLSH
T1E71102590F289E8A2F54F213347EC50933ED3D08F09A74DCDA6A0A8E1CE52EF6364254
MD5 SHA1 SHA512 TLSH

Submit Download