Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/08/2026, 12:58
General
- Target Voicemod Pro v1.2.6.8 (x64)/VoicemodSetup.exe
- Size 22.2MB
- Sample260822-p7jmjsfb25
- SHA256 afd7452c34570e409fc0c2bc8a22fb7429a3cc8f48e85fe6a154656ec020330d
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 10 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- ConfuserEx .NET packer 4 IoCs
Detects ConfuserEx .NET packer.
- Drops file in System32 directory 17 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 12 IoCs
- Executes dropped EXE 11 IoCs
- Loads dropped DLL 10 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Modifies registry class 1 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: LoadsDriver 6 IoCs
- Suspicious use of AdjustPrivilegeToken 27 IoCs
- Suspicious use of FindShellTrayWindow 59 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Voicemod Pro v1.2.6.8 (x64)\VoicemodSetup.exe"C:\Users\Admin\AppData\Local\Temp\Voicemod Pro v1.2.6.8 (x64)\VoicemodSetup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-ORT74.tmp\VoicemodSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-ORT74.tmp\VoicemodSetup.tmp" /SL5="$4025A,22991991,87040,C:\Users\Admin\AppData\Local\Temp\Voicemod Pro v1.2.6.8 (x64)\VoicemodSetup.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-33DPO.tmp\vc_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\is-33DPO.tmp\vc_redist.x64.exe" /quiet /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{E5A5BB3D-DDD6-48A5-AA81-B6A5EC44F05B}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{E5A5BB3D-DDD6-48A5-AA81-B6A5EC44F05B}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-33DPO.tmp\vc_redist.x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692 /quiet /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-33DPO.tmp\vc_redist.x86.exe"C:\Users\Admin\AppData\Local\Temp\is-33DPO.tmp\vc_redist.x86.exe" /quiet /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{AF04F138-A5CF-4CA3-AD68-D2693445FD60}\.cr\vc_redist.x86.exe"C:\Windows\Temp\{AF04F138-A5CF-4CA3-AD68-D2693445FD60}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-33DPO.tmp\vc_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=692 /quiet /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Voicemod Desktop\driver\SaveDefaultDevices.exe"C:\Program Files\Voicemod Desktop\driver\SaveDefaultDevices.exe" defaultdevices.txt3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\Voicemod Desktop\driver\setupDrv.bat""3⤵
- Drops file in Program Files directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "devcon.exe dp_enum"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Voicemod Desktop\driver\devcon.exedevcon.exe dp_enum5⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
-
C:\Program Files\Voicemod Desktop\driver\devcon.exedevcon install vmdrv.inf *VMDriver4⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Voicemod Desktop\driver\devcon.exedevcon update vmdrv.inf *VMDriver4⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe"C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3292 -s 17484⤵
-
-
-
-
C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe"C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-alien-vocoder*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-android-background*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-android-vocoder*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-aphonic-vocoder*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-beach*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-capella*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-reggae*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-rock*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cave*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cop-chase*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cop-radio*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-fear-background*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-fear-background-in*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-franky-background*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-franky-vocoder*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-ghost-background*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-ghost-vocoder*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-harmony-vocoder*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-hurry-up-in*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-hurry-up-loop*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-bee*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-growl*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-leopard*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-tiger*.wav2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-magic-chords-vocoder*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-party-time-background*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-party-time-vocoder*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-possessed-background*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-robot-background*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-robot-vocoder*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-romantic-paris*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-romantic-ulala*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-santa-background*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-sleepyhead*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-spacemen-background*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-speechifier-ovation-background*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-speechifier-protest-background*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-spirit-background*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-spirit-vocoder*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-storyteller-action-background*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-storyteller-drama-background*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-storyteller-happy-background*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-student-hall*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-student-playtime*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-sword-background*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-underwater*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-1*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-2*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-3*.wav2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-4*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-1*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-2*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-3*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-4*.wav2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-zombie-background*.wav2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-zombie-vocoder*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-zombie-vocoder2*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cooltune-vocoder*.wav2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-punk-vocoder*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx01*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx02*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx03*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx04*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx05*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx06*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx07*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx08*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx09*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx10*.wav2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx11*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx12*.wav2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx13*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx14*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx15*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar1*.wav2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar2*.wav2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar3*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar4*.wav2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar5*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar6*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky1*.wav2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky2*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky3*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky4*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky5*.wav2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-exo*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-gameover-amb*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-outofrange*.wav2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-blocks-vocoder1*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-blocks-vocoder2*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-blocks-vocoder3*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-titan-background-part1*.wav2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-titan-background-part2*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx16*.wav2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx17*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx18*.wav2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx19*.wav2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx20*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-bass*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-octava*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-quinta*.wav2⤵
-
-
C:\Windows\system32\cmd.execmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-tercera*.wav2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\control.exe"C:\Windows\System32\control.exe" "C:\Windows\System32\mmsys.cpl",2⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\System32\mmsys.cpl",3⤵
- Suspicious behavior: GetForegroundWindowSpam
-
-
-
C:\Windows\System32\control.exe"C:\Windows\System32\control.exe" "C:\Windows\System32\mmsys.cpl",2⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\System32\mmsys.cpl",3⤵
- Suspicious behavior: GetForegroundWindowSpam
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{08ac2527-77dd-aa4d-a3ac-dc10cf8cb52c}\vmdrv.inf" "9" "499a51a03" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\program files\voicemod desktop\driver"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca11e5016dc2:VOICEMOD_Driver:11.18.35.982:*vmdriver," "499a51a03" "0000000000000148"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca11e5016dc2:VOICEMOD_Driver:11.18.35.982:*vmdriver," "499a51a03" "00000000000000E8"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\6b63557deaed4893a16a59ef4d501609 /t 2928 /p 4601⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x548 0x52c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
VoicemodDesktop.exe
VoicemodDesktop.exe.config
SaveDefaultDevices.exe
devcon.exe
setupDrv.bat
uninstalldriver.bat
vmdrv.inf
Fleck.dll
Hardcodet.Wpf.TaskbarNotification.dll
Newtonsoft.Json.dll
RawInputProcessor.dll
SharpDX.RawInput.dll
SharpDX.dll
SimpleConverter.dll
VoicemodControls.dll
VoicemodLogger.dll
VoicemodSDKDotNET.dll
VoicemodShockets.dll
sdk-custom-fx01_44100.wav
sdk-custom-fx01.dat
sdk-walkie-terror-1.dat
8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
DA3B6E45325D5FFF28CF6BAD6065C907_51A881270F6155CF26F60F8639C44CB6
8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
DA3B6E45325D5FFF28CF6BAD6065C907_51A881270F6155CF26F60F8639C44CB6
VoicemodDesktop.exe.log
VoicemodSDK.dll
idp.dll
vc_redist.x64.exe
vc_redist.x86.exe
VoicemodSetup.tmp
vmdrv.sys
ltp4cjtu.newcfg
user.config
user.config
zwlkoig3.newcfg
license.rtf
license.rtf
logo.png
wixstdba.dll
vc_redist.x86.exe
vc_redist.x64.exe
vmdrv.cat
memory/460-202-0x000001D30C440000-0x000001D30C712000-memory.dmp
memory/460-308-0x000001D3295B0000-0x000001D32AC14000-memory.dmp
memory/460-313-0x000001D3288F0000-0x000001D328930000-memory.dmp
memory/460-319-0x000001D328870000-0x000001D32887A000-memory.dmp
memory/460-311-0x000001D3288B0000-0x000001D3288E8000-memory.dmp
memory/460-331-0x000001D328040000-0x000001D328052000-memory.dmp
memory/460-312-0x000001D327E10000-0x000001D327E1E000-memory.dmp
memory/460-329-0x000001D328010000-0x000001D328018000-memory.dmp
memory/460-556-0x000001D3280C0000-0x000001D3280C8000-memory.dmp
memory/460-554-0x000001D328090000-0x000001D32809A000-memory.dmp
memory/460-339-0x000001D3280D0000-0x000001D3280F2000-memory.dmp
memory/460-296-0x000001D326D30000-0x000001D326D42000-memory.dmp
memory/460-298-0x000001D327E30000-0x000001D327E3C000-memory.dmp
memory/460-216-0x000001D327A20000-0x000001D327AC6000-memory.dmp
memory/460-551-0x000001D328080000-0x000001D32808C000-memory.dmp
memory/460-234-0x000001D30E300000-0x000001D30E30A000-memory.dmp
memory/460-211-0x000001D30E2F0000-0x000001D30E2FA000-memory.dmp
memory/460-310-0x000001D326D20000-0x000001D326D28000-memory.dmp
memory/460-553-0x000001D328930000-0x000001D328978000-memory.dmp
memory/460-555-0x000001D3280B0000-0x000001D3280B8000-memory.dmp
memory/4460-0-0x0000000000400000-0x000000000041C000-memory.dmp
memory/4460-489-0x0000000000400000-0x000000000041C000-memory.dmp
memory/4460-11-0x0000000000400000-0x000000000041C000-memory.dmp
memory/4700-17-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/4700-487-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/4700-19-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/4700-15-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/4700-30-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/4700-467-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/4700-12-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/4700-307-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/4700-13-0x0000000000540000-0x0000000000541000-memory.dmp
memory/4700-5-0x0000000000540000-0x0000000000541000-memory.dmp