Overview

overview

8

Static

static

1

fxsound_setup.exe

windows10-2004-x64

8

fxsound_setup.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    141s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 07:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fxsound_setup.exe
  • Size 69.2MB
  • Sample260629-hypc4shv8n
  • SHA256 d97f1d58d36a1cc5748749b12c691c537342c0a3ccdce125e6cefefb1287e2e1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 20 IoCs
  • Drops file in Program Files directory 57 IoCs
  • Drops file in Windows directory 26 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 53 IoCs
  • Modifies registry class 26 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\fxsound_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\fxsound_setup.exe"
    1⤵
    • Enumerates connected drives
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\FxSound LLC\FxSound 1.2.6.0\install\fxsound.x64.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\fxsound_setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1782476251 " AI_EUIMSI=""
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:1432
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1228
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 2D4D010A9D7617EEAAF9A05AB91649C4 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2760
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:5480
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding D08A663D595B5B27AF35C7F6A5B4FDCE
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1924
        • C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe
          "C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe" remove *DFX12
          3⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          PID:428
        • C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe
          "C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe" check
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5592
        • C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe
          "C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe" install "C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.inf"
          3⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          PID:5616
        • C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe
          "C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe" getguid
          3⤵
          • Executes dropped EXE
          PID:264
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2492
    • C:\PROGRA~1\FXSOUN~1\FxSound\FxSound.exe
      C:\PROGRA~1\FXSOUN~1\FxSound\FxSound.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:5144
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{34fe3217-78c4-ed48-b88c-541314b80557}\fxvad.inf" "9" "4143399a7" "0000000000000170" "WinSta0\Default" "0000000000000184" "208" "c:\program files\fxsound llc\fxsound\drivers\win10\x64"
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:3696
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\System32\DriverStore\FileRepository\fxvad.inf_amd64_a75d87b3871a94a9\fxvad.inf" "oem1.inf:ed86ca115cc2c934:DFX_Device:14.1.0.0:root\fxvad," "4143399a7" "0000000000000170" "cd03"
      1⤵
      • Drops file in Drivers directory
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      PID:2132
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3672
      • C:\Program Files\FxSound LLC\FxSound\FxSound.exe
        "C:\Program Files\FxSound LLC\FxSound\FxSound.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:5388

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e595618.rbs
            • Path C:\Config.Msi\e595618.rbs
            • Size 18KB
            • SHA256 31334e6e926f4a9c39907d34a3089cc78f1e1d9bf19a28896f4a3f37bd4f6ecc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DfxInstall.dll
            • Path C:\Program Files\FxSound LLC\FxSound\Apps\DfxInstall.dll
            • Size 125KB
            • SHA256 f7aa2cb8b18d5cae94ab151dfe744d09fb0c59654bfa0696ed01fa42c68f9dfc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DfxSetupDrv.exe
            • Path C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe
            • Size 65KB
            • SHA256 204474b72a3c8f1faf68a8916bdf3c4d594e98506f3b1bedd9208a88be293531
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fxdevcon64.exe
            • Path C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe
            • Size 263KB
            • SHA256 8fa948e4d39f2862382336400e79c9dc0b83295ab988ee1baba3ecb9e485f55b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fxvad.inf
            • Path C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.inf
            • Size 5KB
            • SHA256 ba175cfddd91b87bdda3f1df2a70249e1742e846b843381eb0438b70f91a110a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FxSound.exe
            • Path C:\Program Files\FxSound LLC\FxSound\FxSound.exe
            • Size 3.5MB
            • SHA256 fd80d20eb35b62b0298ac9988c91b416b17923edff854f00ef20f9aef7cbecd5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.ini
            • Path C:\Program Files\FxSound LLC\FxSound\updater.ini
            • Size 365B
            • SHA256 dbe97eeb4e80312a5e21b43cd76ab454d0b2bb61d7fc288706d43727893cadf3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater.ini
            • Path C:\Program Files\FxSound LLC\FxSound\updater.ini
            • Size 484B
            • SHA256 510264ef1808541825e440bb4b891ff6f39510d29164c8f0e5b2dc14c91d906f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater.ini
            • Path C:\Program Files\FxSound LLC\FxSound\updater.ini
            • Size 408B
            • SHA256 6d43496b797c05f76204b8eae64819583883975668ec63bdb161971b36349333
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            FxSound.settings
            • Path C:\ProgramData\FxSound\FxSound.settings
            • Size 415B
            • SHA256 4347a99e0a128052bc3a99811b9aab78a2e51abb147e705d13d844a300f79e4f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MSI8E2.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSI8E2.tmp
            • Size 1019KB
            • SHA256 15c35c5abf7bab8d1375f5622e31da14fd027ae1046b8a6ddfd74263fa34eda6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI90e4e.LOG
            • Path C:\Users\Admin\AppData\Local\Temp\MSI90e4e.LOG
            • Size 23KB
            • SHA256 bd7a5aed476cf4207d019ddec370003dbff59636cd01102c7194fb9714dfb33f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSIBF2.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSIBF2.tmp
            • Size 917KB
            • SHA256 0fa9b28d3bb8e455ad61735f5259d5d9b8f65bcefa44f83f69db8a4ca451e5bd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fxsound.x64.msi
            • Path C:\Users\Admin\AppData\Roaming\FxSound LLC\FxSound 1.2.6.0\install\fxsound.x64.msi
            • Size 2.9MB
            • SHA256 a94592a6bb9626291c36400b74731c3e3632be4fdaf511315cc989654f4a698b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FxSound.settings
            • Path C:\Users\Admin\AppData\Roaming\FxSound\FxSound.settings
            • Size 354B
            • SHA256 e2bab9dc56948e1537f691ce6243a7230a91141786781d64a25101246214bf98
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            fxsound.log
            • Path C:\Users\Admin\AppData\Roaming\FxSound\fxsound.log
            • Size 282B
            • SHA256 27e1e97b98cc48c6e62e5d3091b0e607e5d6f54549268d9865c6b22a7e03c47d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            fxvad.inf_amd64_a75d87b3871a94a9.ini
            • Path C:\Windows\System32\DriverStore\FileRepository\fxvad.inf_amd64_a75d87b3871a94a9.ini
            • Size 416B
            • SHA256 76fff63f2551e716be50974ecf207dd6a9521375a69a588b40466ac84eac32e7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 26.1MB
            • SHA256 57f67dbb52c2d91fc33d8651bf542581cbe5339d240557a29c1dddf59b7181a4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            {bc6c0ceb-fe2a-4ce7-858a-24f362182b2c}_OnDiskSnapshotProp
            • Path \??\Volume{2e4f07ee-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{bc6c0ceb-fe2a-4ce7-858a-24f362182b2c}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 31f5015041ffc63a47a9dc0fe6b5fd85239399357a7cec9eb7819f3f77610dd5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fxvad.sys
            • Path \??\c:\PROGRA~1\FXSOUN~1\fxsound\drivers\win10\x64\fxvad.sys
            • Size 319KB
            • SHA256 425629b6309000013e8cd1a9b827bee365d21c9f743873aadd0c3bc96a999d2a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fxvadNTAMD64.cat
            • Path \??\c:\program files\fxsound llc\fxsound\drivers\win10\x64\fxvadNTAMD64.cat
            • Size 10KB
            • SHA256 25c8dae186155d20f74feedefb4f84161e4215925b8fd0c898f68f3e50ebcd7d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1228-37-0x000001F863A90000-0x000001F864434000-memory.dmp
            Download