Analysis
- user interaction
yes - max time kernel
173s - max time network
176s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 06:32
General
- Target Voicemod Pro v1.2.6.8 (x64)/VoicemodSetup.exe
- Size 22.2MB
- Sample260810-ha293ashka
- SHA256 afd7452c34570e409fc0c2bc8a22fb7429a3cc8f48e85fe6a154656ec020330d
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 10 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- ConfuserEx .NET packer 4 IoCs
Detects ConfuserEx .NET packer.
- Drops file in System32 directory 18 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 9 IoCs
- Executes dropped EXE 11 IoCs
- Loads dropped DLL 10 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Voicemod Pro v1.2.6.8 (x64)\VoicemodSetup.exe"C:\Users\Admin\AppData\Local\Temp\Voicemod Pro v1.2.6.8 (x64)\VoicemodSetup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-KDNU9.tmp\VoicemodSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-KDNU9.tmp\VoicemodSetup.tmp" /SL5="$4009E,22991991,87040,C:\Users\Admin\AppData\Local\Temp\Voicemod Pro v1.2.6.8 (x64)\VoicemodSetup.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-837J9.tmp\vc_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\is-837J9.tmp\vc_redist.x64.exe" /quiet /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{D8D436E0-D26C-4336-8537-07C18E22888B}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{D8D436E0-D26C-4336-8537-07C18E22888B}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-837J9.tmp\vc_redist.x64.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /quiet /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-837J9.tmp\vc_redist.x86.exe"C:\Users\Admin\AppData\Local\Temp\is-837J9.tmp\vc_redist.x86.exe" /quiet /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{A455D4E4-5319-4A68-89F0-4B2A5E8C214D}\.cr\vc_redist.x86.exe"C:\Windows\Temp\{A455D4E4-5319-4A68-89F0-4B2A5E8C214D}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-837J9.tmp\vc_redist.x86.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /quiet /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Voicemod Desktop\driver\SaveDefaultDevices.exe"C:\Program Files\Voicemod Desktop\driver\SaveDefaultDevices.exe" defaultdevices.txt3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\Voicemod Desktop\driver\setupDrv.bat""3⤵
- Drops file in Program Files directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "devcon.exe dp_enum"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Voicemod Desktop\driver\devcon.exedevcon.exe dp_enum5⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
-
C:\Program Files\Voicemod Desktop\driver\devcon.exedevcon install vmdrv.inf *VMDriver4⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Voicemod Desktop\driver\devcon.exedevcon update vmdrv.inf *VMDriver4⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe"C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe"C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-alien-vocoder*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-android-background*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-android-vocoder*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-aphonic-vocoder*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-beach*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-capella*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-reggae*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-rock*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cave*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cop-chase*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cop-radio*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-fear-background*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-fear-background-in*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-franky-background*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-franky-vocoder*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-ghost-background*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-ghost-vocoder*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-harmony-vocoder*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-hurry-up-in*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-hurry-up-loop*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-bee*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-growl*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-leopard*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-tiger*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-magic-chords-vocoder*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-party-time-background*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-party-time-vocoder*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-possessed-background*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-robot-background*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-robot-vocoder*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-romantic-paris*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-romantic-ulala*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-santa-background*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-sleepyhead*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-spacemen-background*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-speechifier-ovation-background*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-speechifier-protest-background*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-spirit-background*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-spirit-vocoder*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-storyteller-action-background*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-storyteller-drama-background*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-storyteller-happy-background*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-student-hall*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-student-playtime*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-sword-background*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-underwater*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-1*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-2*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-3*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-4*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-1*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-2*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-3*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-4*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-zombie-background*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-zombie-vocoder*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-zombie-vocoder2*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cooltune-vocoder*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-punk-vocoder*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx01*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx02*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx03*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx04*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx05*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx06*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx07*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx08*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx09*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx10*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx11*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx12*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx13*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx14*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx15*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar1*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar2*.wav2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar3*.wav2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar4*.wav2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar5*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar6*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky1*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky2*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky3*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky4*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky5*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-exo*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-gameover-amb*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-outofrange*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-blocks-vocoder1*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-blocks-vocoder2*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-blocks-vocoder3*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-titan-background-part1*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-titan-background-part2*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx16*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx17*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx18*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx19*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx20*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-bass*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-octava*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-quinta*.wav2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-tercera*.wav2⤵
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{025c41a7-c9a2-c849-8176-6c53131cb8a5}\vmdrv.inf" "9" "499a51a03" "00000000000000EC" "WinSta0\Default" "0000000000000184" "208" "c:\program files\voicemod desktop\driver"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\System32\DriverStore\FileRepository\vmdrv.inf_amd64_7465985b33436c3c\vmdrv.inf" "oem1.inf:ed86ca11e5016dc2:VOICEMOD_Driver:11.18.35.982:*vmdriver," "499a51a03" "00000000000000EC" "ef73"1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\System32\DriverStore\FileRepository\vmdrv.inf_amd64_7465985b33436c3c\vmdrv.inf" "oem1.inf:ed86ca11e5016dc2:VOICEMOD_Driver:11.18.35.982:*vmdriver," "499a51a03" "0000000000000194" "ef73"1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E41⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VoicemodDesktop.exe
VoicemodDesktop.exe.config
SaveDefaultDevices.exe
devcon.exe
setupDrv.bat
uninstalldriver.bat
vmdrv.inf
Fleck.dll
Hardcodet.Wpf.TaskbarNotification.dll
Newtonsoft.Json.dll
RawInputProcessor.dll
SharpDX.RawInput.dll
SharpDX.dll
SimpleConverter.dll
VoicemodControls.dll
VoicemodLogger.dll
VoicemodSDKDotNET.dll
VoicemodShockets.dll
sdk-custom-fx01_44100.wav
sdk-custom-fx01.dat
sdk-walkie-terror-1.dat
DA3B6E45325D5FFF28CF6BAD6065C907_51A881270F6155CF26F60F8639C44CB6
DA3B6E45325D5FFF28CF6BAD6065C907_51A881270F6155CF26F60F8639C44CB6
VoicemodSDK.dll
idp.dll
vc_redist.x64.exe
vc_redist.x86.exe
VoicemodSetup.tmp
1zyyaok5.newcfg
user.config
user.config
user.config
vmdrv.inf_amd64_7465985b33436c3c.ini
vc_redist.x86.exe
license.rtf
logo.png
wixstdba.dll
vc_redist.x64.exe
license.rtf
vmdrv.sys
vmdrv.cat
memory/1140-364-0x000001E043290000-0x000001E043298000-memory.dmp
memory/1140-219-0x000001E027020000-0x000001E0272F2000-memory.dmp
memory/1140-500-0x000001E043DC0000-0x000001E043E08000-memory.dmp
memory/1140-502-0x000001E043740000-0x000001E043748000-memory.dmp
memory/1140-273-0x000001E042400000-0x000001E0424A6000-memory.dmp
memory/1140-275-0x000001E0418A0000-0x000001E0418AA000-memory.dmp
memory/1140-346-0x000001E042840000-0x000001E042852000-memory.dmp
memory/1140-271-0x000001E041890000-0x000001E04189A000-memory.dmp
memory/1140-348-0x000001E042880000-0x000001E04288C000-memory.dmp
memory/1140-368-0x000001E043770000-0x000001E043792000-memory.dmp
memory/1140-352-0x000001E043F00000-0x000001E045564000-memory.dmp
memory/1140-355-0x000001E042830000-0x000001E04283E000-memory.dmp
memory/1140-354-0x000001E0431C0000-0x000001E0431FE000-memory.dmp
memory/1140-353-0x000001E042820000-0x000001E042828000-memory.dmp
memory/1140-356-0x000001E043200000-0x000001E043240000-memory.dmp
memory/1140-503-0x000001E043750000-0x000001E043758000-memory.dmp
memory/1140-501-0x000001E043320000-0x000001E04332A000-memory.dmp
memory/1140-360-0x000001E042870000-0x000001E04287A000-memory.dmp
memory/1140-498-0x000001E043310000-0x000001E04331C000-memory.dmp
memory/1140-366-0x000001E0432C0000-0x000001E0432D2000-memory.dmp
memory/4148-311-0x0000000000400000-0x000000000041C000-memory.dmp
memory/4148-0-0x0000000000400000-0x000000000041C000-memory.dmp
memory/4148-12-0x0000000000400000-0x000000000041C000-memory.dmp
memory/6008-14-0x00000000007E0000-0x00000000007E1000-memory.dmp
memory/6008-20-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/6008-18-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/6008-16-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/6008-26-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/6008-28-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/6008-13-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/6008-308-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/6008-116-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/6008-310-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/6008-22-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/6008-24-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/6008-6-0x00000000007E0000-0x00000000007E1000-memory.dmp