2ec319eeabd3ec839cc82f28dcb6e86e6f2d5c6e09a4ac1b444e80fe4413aca5

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
voicewave_installer_20260929.17907209202007b4768732.exe
Size 3.6MB
Sample260929-2eet4swdkc
SHA256 2ec319eeabd3ec839cc82f28dcb6e86e6f2d5c6e09a4ac1b444e80fe4413aca5
MD5 2e192fbc97db5f2644cb74624550bb1b
SHA1 af0331038b1d263941b1602cd726807b4522a4d1
SHA512 453c2a77007b2d9052acf42817c25443a6ad2126e956e18c1025132213f45cb5fa439a819135d812bc117159690de833e9620b9889e7f3f9bc0d086730d099a2
SSDEEP 98304:TA4HXq5Y68xio+Q3Wf8q6rVfV9WxSKFG8ZCv4:XHxiQ3s8qUxV9WxAmCA
TLSH
T1E406231AAE63DC8FCF626C34B5520C1D1A3D5ABFD0124AD317BE1E384C693827AA7553
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 5 IoCs

pid	Process
5128	EDownloader.exe
3552	InfoForSetup.exe
3900	InfoForSetup.exe
3932	AliyunWrapExe.Exe
2460	InfoForSetup.exe

Loads dropped DLL 7 IoCs

pid	Process
5128	EDownloader.exe
5128	EDownloader.exe
5128	EDownloader.exe
3552	InfoForSetup.exe
3900	InfoForSetup.exe
3932	AliyunWrapExe.Exe
2460	InfoForSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	EDownloader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	EDownloader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AliyunWrapExe.Exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AliyunWrapExe.Exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	voicewave_installer_20260929.17907209202007b4768732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AliyunWrapExe.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfoForSetup.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5128	EDownloader.exe
5128	EDownloader.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5976 wrote to memory of 5128	5976	voicewave_installer_20260929.17907209202007b4768732.exe	90
PID 5128 wrote to memory of 3552	5128	EDownloader.exe	91
PID 5128 wrote to memory of 3900	5128	EDownloader.exe	92
PID 3900 wrote to memory of 3932	3900	InfoForSetup.exe	93
PID 5128 wrote to memory of 2460	5128	EDownloader.exe	94

C:\Users\Admin\AppData\Local\Temp\voicewave_installer_20260929.17907209202007b4768732.exe
"C:\Users\Admin\AppData\Local\Temp\voicewave_installer_20260929.17907209202007b4768732.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\EDownloader.exe
  "C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\EDownloader.exe" EXEDIR=C:\Users\Admin\AppData\Local\Temp ||| EXENAME=voicewave_installer_20260929.17907209202007b4768732.exe ||| DOWNLOAD_VERSION=free ||| PRODUCT_VERSION=1.0.0 ||| INSTALL_TYPE=0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5128
- - C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
    /Uid "S-1-5-21-1404337215-1550464601-2805570857-1000"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3552
- - C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
    /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Pageid\":\"17907209202007b4768732\",\"Timezone\":\"GMT-00:00\"}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\AliyunWrapExe.Exe
      C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\AliyunWrapExe.Exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:3932
- - C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
    /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"3\",\"Errorinfo\":\"0\",\"Result\":\"Success\"}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EDownloader.exe

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\EDownloader.exe
Size 3.4MB
SHA256 09fc252661481ea65e23c90babdb7801be6b77dc5db3095cf726372d0d80ff0a
MD5 83aaf734d620f4a1b4aab6d5f0cf6819
SHA1 e6e2d128d260c9a52e0ee3cb32023ddb9d1b9d66
SHA512 22c34ed55fa0149f72bf2ad4751eef52897bb5dd4f300cc5d0cbadc566c33b7907114cca567ad12edd58c1aef811014bbbe81599ccb9e28a2af8007347e92df1
SSDEEP 98304:H+gzEdPtI8TzKPrqSUiyk++U3AfqkQHLtrBUnKR:eVbNSokU3Oqko5rBU4
TLSH
T108F5E12176A28037F5B304B59D7F6B6ED46CBE32072494D7A3C40E2D0A71AD27A32767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AliyunConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\AliyunConfig.ini
Size 1KB
SHA256 ae215cc6498d53261a1b54a1542b2d165a4078f7b391405523dfe322f1a6f283
MD5 e4ab353efb5cd18c49437a7a2a45cae5
SHA1 465002aec8138e677cfb55d5df86133e8069c8f7
SHA512 3abd993850725b6258f67258e8082ef96a69d5238e7b0317820a9e9950995b6b104eab79c83aab305ae58dfd3f97900d707ad001f9a5752b8fa9ac30db5febf0
TLSH
T1ED31392735F910089073BF4AEFE8E5F7D76A79116949C85A40D2034F49E5680DE13ABF
MD5 SHA1 SHA512 TLSH

Submit Download

AliyunWrap.DLL

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\AliyunWrap.DLL
Size 482KB
SHA256 544b2bf4ccdaeaf6ce8f3e0d4faa98281ad17f65fc2defaec915d16d320dbda6
MD5 90a1760397db7be8a7a82b82cfb72d2c
SHA1 774f0a6c25a61b0e3c2c80fc4bc5830d4c77db55
SHA512 29439377953068d75902c205f2db5f40b0bc9925e6761082dcd0da722ed1301df8d1dbe93f8f0e301322a4e6c680139f0c21e0974387d3c20a00c6ca947b9ec4
SSDEEP 12288:laK0OuDBlYPIj/q9DQsEfExtrlp87pMaIPuboWMlyF0Pas:39DeuBc/IPu8WMAF0Pas
TLSH
T1FEB4BF53AA80C1B3D18A017516B6B77B2E39A7355364D8C3F3D81D785E207E27A3938E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AliyunWrapExe.Exe

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\AliyunWrapExe.Exe
Size 107KB
SHA256 2cc207dd14110192c642536432166a1ec77ee4aae071d206707425b7fc969cd3
MD5 f9a22315670147c91e2e044403f8e791
SHA1 a0407ef0c23fc82c831b2e2fef48048e98c17e56
SHA512 865f71d0ddc09506fea34aaf481f79469c7fbcb523dcf4f6967a4f55ad4d17907e1294c21f5e7dae96844d54a5e16174579b11256c8836ab3c17403f9a259d7f
SSDEEP 1536:M554a+kMgHZ73LkUluTbDJgX+oLENoN2CraI9WkF1X8OEdlg5BaAU+/I0:vswTbD6LLraInhEdlg5BJU+/I0
TLSH
T107B37D217980C032E8A714738DFCDA699A6CF9311B5598C7B3C84A6E0F617E1BF35267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\DataFile.ini
Size 700B
SHA256 c347ebc81d0f60013f8cc9bb106720214b2c45095f4de9affeb4c18218ee8deb
MD5 1c3efc90ade88515bc0ce2078ce11b83
SHA1 af9337c3ec1cbba0dc6aa400e3937735d250cc15
SHA512 f7dd2f961beda6b5c47c0aba5d834fd346b3a084dcd478ffccead2c79e468fa09b5c90b4cdd2ad0a21cdd032290114b21d78d2820c7ed5b48bf0c397ef6317f9
TLSH
T1BC01D16A6AE91255F5B3652EEFF5C926573B78C54C48C58C10E22F0F04E0A10D5623BB
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\DataFile.ini
Size 598B
SHA256 f34a73841c5eb7ab823480b6e9ddefae445feea6a661e904f9ce365f5e078b21
MD5 43b72a781f0e8844d56053c4b7a3d19d
SHA1 28580a7d7b14f58f443cfad86e1136a1df02750b
SHA512 a60fb3c9107adafdcc51167fec625e44fa02aa50ca929635bf771bb2122577e26dc6c6dad6544d792f1acf624867f707196846da1d6cef230070814cd04780e1
TLSH
T1C8F0906B9AD91059F8B36216DFF8C93713277CC5189CE94C20E12B0E44E4001E0932FB
MD5 SHA1 SHA512 TLSH

Submit Download

DataFile.ini

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\DataFile.ini
Size 88B
SHA256 ae89726af2bd0c0218fbf63af20d4464f44dced5156364d817b6e73afc8e9f87
MD5 7f411750d07619f38537e7fd612b8b44
SHA1 cda241a1ce5141288582c8f0ac4850992b427bdc
SHA512 35dad46325060004a66e01e10af6a3ebfd94b6751347b6ec64840c4ec03d81480fc324494ea39dded03bf2f1a1ce352b15ab518d14214c15567af17fb32f16b8
TLSH
T1A6B0027757CD540AFD2A346ACBC8A43F5B47A1AC501F995E60C13647C4D4C5127130F7
MD5 SHA1 SHA512 TLSH

Submit Download

InfoForSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\InfoForSetup.exe
Size 65KB
SHA256 b7e0bb05d2b6673dae04d3a008b516e3c2803e6d388dcae3405b94e7f7ddcf3f
MD5 f20f89694c7ff9e0c84d8b55ddabcb5b
SHA1 1ac86fa7877c09e9132958171260c12ef289fbfb
SHA512 3d27047339e6c70876778a90bdde84dd758be397dcc1453f26d4dffc4d6eec378b58eb88ef88c0eba24fb8c43099e8d50d8dbeb26dada81f1a3216d27d039ca8
SSDEEP 768:AVyp8XwXEXrjOgRXvLH4IE3jDnIoiiBbIADgykhUMId50BLbVTkK/Ws5ALH:AECwXShvLYIE3nnInie2khc50H/a
TLSH
T12F638E127890C033CC5A88B55868D7A09F6FAA6217E494C77FDD16BD4FA13C06F3936A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempInfo.web

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\aliyun\tempInfo.web
Size 1B
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
MD5 SHA1 SHA512

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\cacert.pem
Size 232KB
SHA256 5a03d0cf132b66659edcf43c087c4cb1b3647f341ace02dd84c693c804a0a5dd
MD5 3548d8825b94ecf3cb6fc617e32e8989
SHA1 54edbb080d5505f03dff5bbf71efa31794d0e064
SHA512 fc5a5d81a9d052701ddcbf62437a7c64813d22a842468fbaa530ff3a5541cbbf2270b885974627c468d6af217806e39ea20802e7a3b79ee76e9700fef56fa024
SSDEEP 3072:VhGvwW6Jj7ITWYv0yoVH283rz9WqIAsjjg4DsUQS88UP4TFf3xVOVkCC554jMN/V:f5W+j8chWf8xyvp5iIzB9Nxza/MT+K
TLSH
T18434BF9BCF526C5918D3E094C9AB025DD81E4263DDDB78A32D0A3801DF89B3E66FD48D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\libcurl.dll
Size 359KB
SHA256 683bb7b131576fe7bc8efbd3c5b00b9ca5fd91b763774f51f4fb71a746cd896a
MD5 2fc4f35490fa25908c2963a0fa586cb7
SHA1 ba80bfe3ef6eb07f060100f231491de63001d35e
SHA512 fb23525ac35f66cad45dc505f40553b1a1556752b18ff2259f11515a33546b5d6f2c44d9a2e7dc3f2d7336e656ade9ec9291434c5e038bbddb696c055d89dc7d
SSDEEP 6144:lj9yPDdfoOVjXiNATUHtpt71vYSriO77CjZh9mXoSsXzimTt0V9nFEzl+/y:lj92GTLRrii7Cth0AXd0V9FEhCy
TLSH
T13C745BA2FC018032F6D21175E6FA9FB76C6C5125271AD0D3EAD044A49D749E3B23EB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\vcruntime140.dll
Size 78KB
SHA256 44aca93d4a046252c60f0cbbe5259d9509b912aa07e5379b2cdbe842700c7e9c
MD5 b8f25e1833429fd8f529c5fdd2a4f3b4
SHA1 7ae7ca5e695e6cdb590022a0602879bc2f56a65a
SHA512 077007237e7ddfd280dd08f145a0f3c775c461bbf61574cbefc4f7c29ba6308c16b52da94dc8f78345fec1cdac25f5e604b890669124a7e38e205e54a68729e7
SSDEEP 1536:JbiyVUrqIQsn1xtg6RxkkBGCGHDWbWzaecbGaBLL+/o8:liyLyt/xcRjWazaecbGCu/o8
TLSH
T1A9737D4335E082B5D9AF05F4D8BAA70A9A7DF8500FF26EE76B944949DF60AC09770307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\evw_setup\1.0.0\46free\zlib1.dll
Size 84KB
SHA256 b4ad7ba65fededaa11befbfcbd688a1da96031c88e2324075b42e5057f04c6b8
MD5 089c6e80c5d506ca980f4fe2f6747dde
SHA1 f59e5441c43b008ff49a67cdc9960d33be5425f7
SHA512 dec10d21a229557624b47e9d2e3e011dba592bf9e31d67cd25b6237ba23cf6661ec4475559d06be6a0447260d142856bafbc57cc3cabb96654762dc03feec4f8
SSDEEP 1536:F2lVj7uRxDXVJ3DD7fGcg/hiOrN/GyrZlIOsIOI/QxVDIJ/D:FQVjSHTXbg/hjdZviI/QxVDIJ/D
TLSH
T19783AE82FAD053A2D9F6007490F7877D9A3670214B97ECDBE38DB66849113D1AB362CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resource.ini

Path C:\Users\Admin\AppData\Local\Temp\resource.ini
Size 237B
SHA256 324e0e753b7f5d69d52a89a085329e9dac9b4a33b1bd34cad8cb81530d00cfa2
MD5 b452f9529880ca4668ce2f603ab147f6
SHA1 5fb906044b5e01e482b7ca6739a27ca317b3bdae
SHA512 0965f455912e62ba2c40134d48dbfc631f383db7b71033743c8f06533ab7b338e8947478002da3fa92390f15eed0d90d251aa6b8ed7d49e33a30563aa392bf46
TLSH
T1A9D0A7BBCB4A00FFCE0083C839002F97F703491A4423CD1098A01A08F02281AE8878E7
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads