9e1dd2a58061382da6d17b05d1b97f56063046538952de052aa0a523623c4d43

Analysis

max time kernel
60s
max time network
60s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ClownfishVoiceChanger.exe
Size 985KB
Sample260809-ry6rtssyft
SHA256 9e1dd2a58061382da6d17b05d1b97f56063046538952de052aa0a523623c4d43
MD5 c5f5ce5a750f79fb8c20157dbd71833a
SHA1 7a8a06a183ba6465bb02984516beee6fdf5c3b85
SHA512 e3fa60275dd6e19098b3d814eb21e8c3106ab6a6f7d2a74a4deb9bd2aaf7f3501869ed62d05565cfdb2244e65e10316fc90f0d550aa77a14f6f9177c66640d37
SSDEEP 12288:LaSsnEVp1pFJq9hRIL8NOvsE6IVEXYD01b6aOffk5NI/r:Oqxp/IRILRkE6IV7Y4OST
TLSH
T13A255B1C6EE502B9E1F2C770C9A16506EA717C85873D99DF03C1C2994E729FACA39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4676	ClownfishVoiceChanger.exe
4676	ClownfishVoiceChanger.exe
4676	ClownfishVoiceChanger.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4676	ClownfishVoiceChanger.exe
4676	ClownfishVoiceChanger.exe
4676	ClownfishVoiceChanger.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4676	ClownfishVoiceChanger.exe

C:\Users\Admin\AppData\Local\Temp\ClownfishVoiceChanger.exe
"C:\Users\Admin\AppData\Local\Temp\ClownfishVoiceChanger.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4676

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004F0
1⤵
PID:3756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ClownfishVoiceChanger.ini

Path C:\Users\Admin\Documents\ClownfishVoiceChanger.ini
Size 1KB
SHA256 9997eed85a66c4b7954bf851bfd3815901a23ff66b3018697902ea38828d832a
MD5 cadd7e82d684facb6f1207b97dab36c5
SHA1 3f156906fe7133613afd90c91d97c4902d999d49
SHA512 7c32ba74ac3254535ced497a44158a66fadf39f453c98f78af90c61f64e7a95c0c4ed7888cc7413b924076707d2df97acbfe58fabb5817fd34173bd8b8c1a49e
TLSH
T1C91112590F2C5E852F54F213243EC10833ED3C04F09A70DC9A790A8E1CE56EF6368254
MD5 SHA1 SHA512 TLSH

Submit Download