General
- Target VoiceModCrack.exe
- Size 14.0MB
- Sample260817-l3q92sysaz
- SHA256 bd3aa66b5ef3cb22f71d5b6d70a3d01ac19a55b455237ed4625bf50bfa966edb
- MD5 307cdc5ea6a2bf90ea20337bf2637e0b
- SHA1 49796055972b7417dc891bd7ae661abbe9f5d442
- SHA512 ccc62284b30886f7aeaca2f0075655652643b44dcc1b4cf81985b55ee8176c6f3dd5bd81b8b68cb20cbfc1c0d9c38413adf1f3f9a1160560416c04534de2b6a3
- SSDEEP 12288:x4elWlzK/aQf2I8kr1TSCC5SGd2qMrI75xAxvl2N:+el7RRJSd2qMrI7vAx9
- TLSH T1F8E6FA1F6BB49D01D541163F82BA273C973260E36212AB47370AFA615D84BEFDD2C2D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VoiceModCrack.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
VoiceModCrack.exe
Resource
win11ltsc2024-20260709-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target VoiceModCrack.exe
- Size 14.0MB
- SHA256 bd3aa66b5ef3cb22f71d5b6d70a3d01ac19a55b455237ed4625bf50bfa966edb
- MD5 307cdc5ea6a2bf90ea20337bf2637e0b
- SHA1 49796055972b7417dc891bd7ae661abbe9f5d442
- SHA512 ccc62284b30886f7aeaca2f0075655652643b44dcc1b4cf81985b55ee8176c6f3dd5bd81b8b68cb20cbfc1c0d9c38413adf1f3f9a1160560416c04534de2b6a3
- SSDEEP 12288:x4elWlzK/aQf2I8kr1TSCC5SGd2qMrI75xAxvl2N:+el7RRJSd2qMrI7vAx9
- TLSH T1F8E6FA1F6BB49D01D541163F82BA273C973260E36212AB47370AFA615D84BEFDD2C2D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1