Overview

overview

7

Static

static

3

MakeMusic ...ck.rar

windows11-21h2-x64

7

Downloaded...et.txt

windows11-21h2-x64

3

MakeMusic ...ck.zip

windows11-21h2-x64

1

Finale.exe

windows11-21h2-x64

1

MakeMusic ...et.url

windows11-21h2-x64

1

MakeMusic ...Me.txt

windows11-21h2-x64

3

MakeMusic ...ts.exe

windows11-21h2-x64

6

Torrent Do...to.txt

windows11-21h2-x64

3

[1337x] To...to.txt

windows11-21h2-x64

3

[TGx]Downl...o .txt

windows11-21h2-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    232s
  • max time network
    223s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    31/05/2026, 00:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MakeMusic Finale 27.4.0.108 + Crack/Setup/Finale Setup with Fonts.exe
  • Size 282.5MB
  • Sample260531-apd7saft8t
  • SHA256 3c039960a6f29e4b95a524db2c2bfca6c3bd930bfc6028421940f95d9faf3fb6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoveryinstallerransomware

Malware Config

Signatures

  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\MakeMusic Finale 27.4.0.108 + Crack\Setup\Finale Setup with Fonts.exe
    "C:\Users\Admin\AppData\Local\Temp\MakeMusic Finale 27.4.0.108 + Crack\Setup\Finale Setup with Fonts.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5228
    • C:\Users\Admin\AppData\Local\Temp\is-HGUN6.tmp\Finale Setup with Fonts.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-HGUN6.tmp\Finale Setup with Fonts.tmp" /SL5="$6029A,295784471,119296,C:\Users\Admin\AppData\Local\Temp\MakeMusic Finale 27.4.0.108 + Crack\Setup\Finale Setup with Fonts.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5036
      • C:\Users\Admin\AppData\Local\Temp\is-TF3D4.tmp\VS2019\vcredist_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-TF3D4.tmp\VS2019\vcredist_x64.exe" /passive "/norestart"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3648
        • C:\Windows\Temp\{A11E1CC6-DFAF-4F4F-8EAD-60EAA4162832}\.cr\vcredist_x64.exe
          "C:\Windows\Temp\{A11E1CC6-DFAF-4F4F-8EAD-60EAA4162832}\.cr\vcredist_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-TF3D4.tmp\VS2019\vcredist_x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=572 /passive "/norestart"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:408
      • C:\Windows\system32\msiexec.exe
        "msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\is-TF3D4.tmp\FinaleDemo.msi" /l*v "C:\Users\Admin\AppData\Local\Temp\FinaleDemoInstaller.log"
        3⤵
        • Badlisted process makes network request
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2020
      • C:\Windows\system32\msiexec.exe
        "msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\is-TF3D4.tmp\MMFonts.msi" /qn /l*v "C:\Users\Admin\AppData\Local\Temp\MMFonts.log"
        3⤵
          PID:2968
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4208
      • C:\Windows\system32\srtasks.exe
        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5400
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 3B0EC6773A70947CD4A3C7F9735EC109
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:5620
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 41F32094EDA05DA661E642E621D7CC78
        2⤵
        • Loads dropped DLL
        PID:5584
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding D180718BBB14A3884B6D477E76843C0E E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4368
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding D7A58D035D93C3D0894BDDD645021D1F C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2260
        • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
          "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Program Files\MakeMusic\Finale\27\Finale Read Me.rtf" /o ""
          3⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of SetWindowsHookEx
          PID:4464
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 66D45027D78DBFE170C6098E6569227F
        2⤵
          PID:4616
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:648

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e598331.rbs
            • Path C:\Config.Msi\e598331.rbs
            • Size 692KB
            • SHA256 664e4c368c2541de3bccc3d34525e419dfb955723bf6a738d59def935e68e594
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e598336.rbs
            • Path C:\Config.Msi\e598336.rbs
            • Size 15KB
            • SHA256 b800aeb9787f8b6cd22f07c86146627c53a378e05a0dcbd2456287a628b6b7f2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Finale Read Me.rtf
            • Path C:\Program Files\MakeMusic\Finale\27\Finale Read Me.rtf
            • Size 30KB
            • SHA256 cda88deeea5d4432f390fc2440488cf8185528c9082a324d8103ec4a7d06bb9b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Finale.exe
            • Path C:\Program Files\MakeMusic\Finale\27\Finale.exe
            • Size 35.0MB
            • SHA256 474f72ae636a4c145a8004f57eadc16c742e7d9d4935249c0c9c640fc351b594
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            67F6625BC22310D5C99DDE12020DBD90
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\67F6625BC22310D5C99DDE12020DBD90
            • Size 584B
            • SHA256 6d473796c6f906f567e4837a54161097d0bbc0f662ade87705e46237d7c1160c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            A815CA7E166CE953ABEDC732BA1EC33B_9231D1C65C49C5E2A9375123952BC8A7
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A815CA7E166CE953ABEDC732BA1EC33B_9231D1C65C49C5E2A9375123952BC8A7
            • Size 2KB
            • SHA256 72cf0a46f3dd933d874d129b93284f1ed0081834446be1f8b2b30299b385ec51
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            67F6625BC22310D5C99DDE12020DBD90
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\67F6625BC22310D5C99DDE12020DBD90
            • Size 230B
            • SHA256 c1b0b008fcee7011b91b1384f1994fe16623485444580330a4a25f98bfd9bb06
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            A815CA7E166CE953ABEDC732BA1EC33B_9231D1C65C49C5E2A9375123952BC8A7
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A815CA7E166CE953ABEDC732BA1EC33B_9231D1C65C49C5E2A9375123952BC8A7
            • Size 458B
            • SHA256 08800c55618c30b03cf832c0815905b54896b5ecdfec51809ced77f42cce1d80
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            FinaleDemoInstaller.log
            • Path C:\Users\Admin\AppData\Local\Temp\FinaleDemoInstaller.log
            • Size 231KB
            • SHA256 ceaa042b230b0e80b5a3bf45542c7dee355396d16c7ebf26a7e0134cc5191b2f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MMFonts.log
            • Path C:\Users\Admin\AppData\Local\Temp\MMFonts.log
            • Size 3KB
            • SHA256 3258140b6e5e8b4d716ffe0cb1993f3cf2daf9e2cee7d11209c48e15c3ca4a2d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            sist02.xsl
            • Path C:\Users\Admin\AppData\Local\Temp\TCD211C.tmp\sist02.xsl
            • Size 245KB
            • SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Finale Setup with Fonts.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\is-HGUN6.tmp\Finale Setup with Fonts.tmp
            • Size 1.1MB
            • SHA256 cf0018affdd0b7921f922f1741ad229ec52c8a7d6c2b19889a149e0cc24aa839
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MMFonts.msi
            • Path C:\Users\Admin\AppData\Local\Temp\is-TF3D4.tmp\MMFonts.msi
            • Size 2.6MB
            • SHA256 397ec1fe11f5d7db4fcf551d37c985c01e83f5f6c84368d483ea3a26d16ac989
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcredist_x64.exe
            • Path C:\Users\Admin\AppData\Local\Temp\is-TF3D4.tmp\VS2019\vcredist_x64.exe
            • Size 14.4MB
            • SHA256 ee84fed2552e018e854d4cd2496df4dd516f30733a27901167b8a9882119e57c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            index.dat
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
            • Size 454B
            • SHA256 96bb59a860bb802397b8880ea7b169938037c5f44f85b72ba20476c7f8e014e5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            fb3b0dbfee58fac8.customDestinations-ms
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
            • Size 3KB
            • SHA256 f1a7044ba4ed5ae397b3fd95e5a373f74ef98bd2111b64d1f2b0c91f6a173a90
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            fb3b0dbfee58fac8.customDestinations-ms
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
            • Size 4KB
            • SHA256 951599d03700326e097edafc5868d52cb5068b56ab54681f2c4c7e8cddf679a0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI9581.tmp
            • Path C:\Windows\Installer\MSI9581.tmp
            • Size 199KB
            • SHA256 539e276326a9ee7604395aaaf84759aa6676c4471fe9be590cb8d273ea995e9b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI993B.tmp
            • Path C:\Windows\Installer\MSI993B.tmp
            • Size 111KB
            • SHA256 aedcc8f795d1fe5a2ee7a18b473da1360160557b2859a9e67057f19c3c496df1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            logo.png
            • Path C:\Windows\Temp\{8792A211-66AD-4E9F-B0E1-5B5ED4F75EBB}\.ba\logo.png
            • Size 1KB
            • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{8792A211-66AD-4E9F-B0E1-5B5ED4F75EBB}\.ba\wixstdba.dll
            • Size 191KB
            • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcredist_x64.exe
            • Path C:\Windows\Temp\{A11E1CC6-DFAF-4F4F-8EAD-60EAA4162832}\.cr\vcredist_x64.exe
            • Size 639KB
            • SHA256 cc9f58876ab54bd75e819dff07708bc7e3a3991dc3e96c9285af5965f266adb2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 24.6MB
            • SHA256 ed5f88828af822a2aca427ee2ec307d402982717908ee1e60e4230095f1fb205
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            {a53dead0-a474-48ea-885a-d6ece2ab1694}_OnDiskSnapshotProp
            • Path \??\Volume{67a68b58-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a53dead0-a474-48ea-885a-d6ece2ab1694}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 717baae09d79f5b5bf69638d0e5d75493e96d590eaebb580074c5921fea902a6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/4464-2110-0x00007FFCD9290000-0x00007FFCD92A0000-memory.dmp
            Download

            memory/4464-2111-0x00007FFCD6880000-0x00007FFCD6890000-memory.dmp
            Download

            memory/4464-2405-0x00007FFCD9290000-0x00007FFCD92A0000-memory.dmp
            Download

            memory/4464-2407-0x00007FFCD9290000-0x00007FFCD92A0000-memory.dmp
            Download

            memory/4464-2406-0x00007FFCD9290000-0x00007FFCD92A0000-memory.dmp
            Download

            memory/4464-2404-0x00007FFCD9290000-0x00007FFCD92A0000-memory.dmp
            Download

            memory/4464-2115-0x00007FFCD6880000-0x00007FFCD6890000-memory.dmp
            Download

            memory/4464-2105-0x00007FFCD9290000-0x00007FFCD92A0000-memory.dmp
            Download

            memory/4464-2107-0x00007FFCD9290000-0x00007FFCD92A0000-memory.dmp
            Download

            memory/4464-2106-0x00007FFCD9290000-0x00007FFCD92A0000-memory.dmp
            Download

            memory/4464-2108-0x00007FFCD9290000-0x00007FFCD92A0000-memory.dmp
            Download

            memory/5036-80-0x0000000000400000-0x000000000052C000-memory.dmp
            Download

            memory/5036-2261-0x0000000000400000-0x000000000052C000-memory.dmp
            Download

            memory/5036-106-0x0000000000400000-0x000000000052C000-memory.dmp
            Download

            memory/5036-20-0x0000000000400000-0x000000000052C000-memory.dmp
            Download

            memory/5036-88-0x0000000000400000-0x000000000052C000-memory.dmp
            Download

            memory/5036-14-0x0000000000400000-0x000000000052C000-memory.dmp
            Download

            memory/5036-11-0x0000000000400000-0x000000000052C000-memory.dmp
            Download

            memory/5036-1798-0x0000000000400000-0x000000000052C000-memory.dmp
            Download

            memory/5036-93-0x0000000000400000-0x000000000052C000-memory.dmp
            Download

            memory/5036-12-0x00000000023F0000-0x00000000023F1000-memory.dmp
            Download

            memory/5036-90-0x0000000000400000-0x000000000052C000-memory.dmp
            Download

            memory/5036-5-0x00000000023F0000-0x00000000023F1000-memory.dmp
            Download

            memory/5036-2099-0x0000000000400000-0x000000000052C000-memory.dmp
            Download

            memory/5228-10-0x0000000000400000-0x0000000000428000-memory.dmp
            Download

            memory/5228-2262-0x0000000000400000-0x0000000000428000-memory.dmp
            Download

            memory/5228-0-0x0000000000400000-0x0000000000428000-memory.dmp
            Download