Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 22:49

General

  • Target
    audacity-win-3.7.8-64bit.exe
  • Size 19.5MB
  • Sample260804-2rnmsazwat
  • SHA256 4a6d77f023c0209a396fcf2f3c7c04e240b6ba9897b3231a6ed18e14c10caa16
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

  • Modifies registry class 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\audacity-win-3.7.8-64bit.exe
    "C:\Users\Admin\AppData\Local\Temp\audacity-win-3.7.8-64bit.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4204
    • C:\Users\Admin\AppData\Local\Temp\is-W4J6AM65YD.tmp\audacity-win-3.7.8-64bit.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-W4J6AM65YD.tmp\audacity-win-3.7.8-64bit.tmp" /SL5="$4010C,18914073,1017856,C:\Users\Admin\AppData\Local\Temp\audacity-win-3.7.8-64bit.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3224
      • C:\Program Files\Audacity\audacity.exe
        "C:\Program Files\Audacity\audacity.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3484
        • C:\Program Files\Audacity\crashpad_handler.exe
          "C:\Program Files\Audacity\crashpad_handler.exe" "--crashreporter-path=C:\Program Files\Audacity\crashreporter.exe" --crashreporter-argument=-u=https://sentry.audacityteam.org/api/2/minidump/?sentry_key=37e6948db02f43ac856bf7edcbe9731d "--crashreporter-argument=-a=version=\"3.7.8\",sentry[release]=\"[email protected]\"" --database=C:\Users\Admin\AppData\Local\audacity\crashreports\ --metrics-dir=C:\Users\Admin\AppData\Local\audacity\crashreports\ --initial-client-data=0x2e8,0x2ec,0x2f0,0x2c4,0x2f4,0x7ffb2a15fe98,0x7ffb2a15feb0,0x7ffb2a15fec8
          4⤵
          • Executes dropped EXE
          PID:1552
        • C:\Program Files\Audacity\audacity.exe
          "C:\Program Files\Audacity\audacity.exe" --host 50479
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:6024
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004D0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2572

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Audacity.exe

        • Path C:\Program Files\Audacity\Audacity.exe
        • Size 14.9MB
        • SHA256 10bc7436ffc0dfb99aed8c1c1df9521434b8af28f9470dbf2e5e3dddea6196a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-Q6Y7ZXV6PF.tmp

        • Path C:\Program Files\Audacity\Languages\es\is-Q6Y7ZXV6PF.tmp
        • Size 345KB
        • SHA256 04733111a8e484461bdcd4a163b16b7337a207382fc58ff224697e2bac0ab46e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-2WZP1HL67W.tmp

        • Path C:\Program Files\Audacity\Languages\tr\is-2WZP1HL67W.tmp
        • Size 336KB
        • SHA256 60a3e5698e024d79161138aa9554166d70cd258e59fa5651fecd6fe825dad843
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-audacity-application-logic.dll

        • Path C:\Program Files\Audacity\lib-audacity-application-logic.dll
        • Size 85KB
        • SHA256 8a4606ce0412382880608c137d57ac82fa82ea9d41c21734e702a3b0e91e6c9c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-builtin-effects.dll

        • Path C:\Program Files\Audacity\lib-builtin-effects.dll
        • Size 1.3MB
        • SHA256 c9edfb5476df480469d9703a4735ba5044742bb31787b6324be760f5e4b81081
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-crashpad-configurer.dll

        • Path C:\Program Files\Audacity\lib-crashpad-configurer.dll
        • Size 475KB
        • SHA256 23e2b93cbb0e00659b94e9d74d5849a2cfff379ab3093768c6ef890c42221dc3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-dynamic-range-processor.dll

        • Path C:\Program Files\Audacity\lib-dynamic-range-processor.dll
        • Size 394KB
        • SHA256 c6ae36af71efbc4c20f94c0a5cd5fe32680df06ac2e1f4cbeede8c5416734ac6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-file-formats.dll

        • Path C:\Program Files\Audacity\lib-file-formats.dll
        • Size 58KB
        • SHA256 b6893c906974a9fc2f33c3e41f8588493046c9def595cd3441716d4a562e9d02
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-graphics.dll

        • Path C:\Program Files\Audacity\lib-graphics.dll
        • Size 65KB
        • SHA256 670228e4b023d21ea4e3176bf45d4bc3f36e5bebf1fa50280f41c27006732122
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-import-export.dll

        • Path C:\Program Files\Audacity\lib-import-export.dll
        • Size 522KB
        • SHA256 4e0ac8d9e7259016abde8c3a1bae06abefdf3041674fcc8eb6d89059aa2752fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-ladspa.dll

        • Path C:\Program Files\Audacity\lib-ladspa.dll
        • Size 134KB
        • SHA256 ee8b3d17babf02b79703d3b3b9cc2a09c1ec28fe12c8bf76624be3a2198f851a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-lv2.dll

        • Path C:\Program Files\Audacity\lib-lv2.dll
        • Size 658KB
        • SHA256 0d913cfa940783cb03d1336ec171b408e807da672ab62f3b3248afbe3b9ad7e2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-menus.dll

        • Path C:\Program Files\Audacity\lib-menus.dll
        • Size 435KB
        • SHA256 92f4a774ba5f3af05ae71e6c5afb382ed1ddb845583ff0168e62499cb954718f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-music-information-retrieval.dll

        • Path C:\Program Files\Audacity\lib-music-information-retrieval.dll
        • Size 413KB
        • SHA256 b947b2231cc8fa1a990d6c641ff054826d511eaf0afb51a76758c9ff88b7f55f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-network-manager.dll

        • Path C:\Program Files\Audacity\lib-network-manager.dll
        • Size 427KB
        • SHA256 6dd8d7c66f85bb24ccc70e7f224887684aa8a79daf3c5c8c2306958e9135277a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-nyquist-effects.dll

        • Path C:\Program Files\Audacity\lib-nyquist-effects.dll
        • Size 1.4MB
        • SHA256 6968ac8bcfc2fec917353238bf5cb908d3e13a1e71bc9e6a764bdacdeda87ae8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-preference-pages.dll

        • Path C:\Program Files\Audacity\lib-preference-pages.dll
        • Size 116KB
        • SHA256 f0d3bb738744fa6f2ceb39345f269715fca40965bb8f8b2b7e65924244faffdc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-project-file-io.dll

        • Path C:\Program Files\Audacity\lib-project-file-io.dll
        • Size 627KB
        • SHA256 c7cef891e721b0d1cfe8706f28513b7049961f28156095028da9b972ace43aa9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-shuttlegui.dll

        • Path C:\Program Files\Audacity\lib-shuttlegui.dll
        • Size 548KB
        • SHA256 ab33d4d6708f9e3b2263ac63740b19cb2ffa998cdbc6f78e8f10792ee3b25ad6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-tags.dll

        • Path C:\Program Files\Audacity\lib-tags.dll
        • Size 103KB
        • SHA256 8001c882cd7061ceddea0c9cc3baf46aa1d9bd87a76484c089c45d16377a3621
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-theme-resources.dll

        • Path C:\Program Files\Audacity\lib-theme-resources.dll
        • Size 2.3MB
        • SHA256 6071ffb19bacd2a0f20cdc933f68c90c26c9742d6d36024fc109f7888d6888f1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-theme.dll

        • Path C:\Program Files\Audacity\lib-theme.dll
        • Size 573KB
        • SHA256 401d043a6cfc58d16dd0d8b6af91d95bfbb02a6f583d9722c8f1186d290a2e09
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-url-schemes.dll

        • Path C:\Program Files\Audacity\lib-url-schemes.dll
        • Size 82KB
        • SHA256 3bbc72238c1bc59cbfbcf249ac933472f13808a9c981ac127d4b87834900b423
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-uuid.dll

        • Path C:\Program Files\Audacity\lib-uuid.dll
        • Size 240KB
        • SHA256 69f029bc0fb92e2a8ceec757fabe98f8b74608d269c03e7a936d9ffe04821ba0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-viewport.dll

        • Path C:\Program Files\Audacity\lib-viewport.dll
        • Size 122KB
        • SHA256 031b48e4ca6b7d0bc58adee91a68ed0d94be70998c2fc4835c6828930d3dad80
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-vst.dll

        • Path C:\Program Files\Audacity\lib-vst.dll
        • Size 394KB
        • SHA256 4968cc1862a0e149562376b305097b89a3d92b7bad32d35fce99fa2ee0a11142
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-vst3.dll

        • Path C:\Program Files\Audacity\lib-vst3.dll
        • Size 689KB
        • SHA256 ee1a726b6a23f6f21f43ceed6f51634c6eb7e10f8efe079a581fbb8eee39eae7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-wave-track-fft.dll

        • Path C:\Program Files\Audacity\lib-wave-track-fft.dll
        • Size 46KB
        • SHA256 9a87499d36e5af6c442b9f158c4f70b05e9908d1f958cc2f707dda40dbb4c9c5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-wave-track-paint.dll

        • Path C:\Program Files\Audacity\lib-wave-track-paint.dll
        • Size 130KB
        • SHA256 21fff30c8bf0cc87eab0cbd414a98b367526d3874371c483e4aa8ce1d981a7d0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-wx-init.dll

        • Path C:\Program Files\Audacity\lib-wx-init.dll
        • Size 650KB
        • SHA256 a40e01731065305473e05c671b9ccc5983f0db01b9305cb6da460a1a3d14e3cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lib-wx-wrappers.dll

        • Path C:\Program Files\Audacity\lib-wx-wrappers.dll
        • Size 402KB
        • SHA256 fc6b63080198121780610ef90994042a784b13960bf87c05b3ad7d358c57e2b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wxmsw313u_aui_vc_x64_custom.dll

        • Path C:\Program Files\Audacity\wxmsw313u_aui_vc_x64_custom.dll
        • Size 896KB
        • SHA256 95572bfcfd5c5817f770754c7c410bf4cebec000e0bd5d7bdfed71ccbc62276d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wxmsw313u_core_vc_x64_custom.dll

        • Path C:\Program Files\Audacity\wxmsw313u_core_vc_x64_custom.dll
        • Size 10.4MB
        • SHA256 701c777cde92bc725d97e6662dd1b181469c3068cbc458ad56fd1d08beca0955
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wxmsw313u_html_vc_x64_custom.dll

        • Path C:\Program Files\Audacity\wxmsw313u_html_vc_x64_custom.dll
        • Size 721KB
        • SHA256 41a230a326805a096f733cab0f8da9556bc9f89c47a8cbb255065d8442e28c2f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wxmsw313u_qa_vc_x64_custom.dll

        • Path C:\Program Files\Audacity\wxmsw313u_qa_vc_x64_custom.dll
        • Size 239KB
        • SHA256 7ee33a0f112984cb7f3e2da3c1b43a36a935066494635a089b4a8cf505d9cfe5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        audacity-win-3.7.8-64bit.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\is-W4J6AM65YD.tmp\audacity-win-3.7.8-64bit.tmp
        • Size 4.3MB
        • SHA256 3cb1d280ca1981efc02a89290d1df94c7208941a4ea4e1f17bdcedb974d50bfb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        audacity.cfg

        • Path C:\Users\Admin\AppData\Roaming\audacity\audacity.cfg
        • Size 5KB
        • SHA256 1dc30ceb09eca86d7fcf0431d990521e69f60a1fee06fd50f0c2e11956576041
        • MD5 SHA1 SHA512 SSDEEP TLSH

        audacity.cfg.bkp

        • Path C:\Users\Admin\AppData\Roaming\audacity\audacity.cfg.bkp
        • Size 2KB
        • SHA256 a36e613acdc3bfe6b856b4d689b0f4965770f4dc82c291155a6b48d3e106707d
        • MD5 SHA1 SHA512 TLSH

        pluginregistry.cfg

        • Path C:\Users\Admin\AppData\Roaming\audacity\pluginregistry.cfg
        • Size 40KB
        • SHA256 2e9cf6f6166441ba9b704824cffdfa44209a79dd28132e24c7e5f3fff6d1f834
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/3224-6-0x0000000003410000-0x0000000003411000-memory.dmp

        memory/3224-9-0x0000000000700000-0x0000000000B61000-memory.dmp

        memory/3224-10-0x0000000003410000-0x0000000003411000-memory.dmp

        memory/3224-633-0x0000000000700000-0x0000000000B61000-memory.dmp

        memory/3224-12-0x0000000000700000-0x0000000000B61000-memory.dmp

        memory/3224-14-0x0000000000700000-0x0000000000B61000-memory.dmp

        memory/3224-16-0x0000000000700000-0x0000000000B61000-memory.dmp

        memory/3484-635-0x00007FF7B1ED0000-0x00007FF7B2DE2000-memory.dmp

        memory/4204-8-0x0000000000C90000-0x0000000000D97000-memory.dmp

        memory/4204-1-0x0000000000C90000-0x0000000000D97000-memory.dmp

        memory/4204-634-0x0000000000C90000-0x0000000000D97000-memory.dmp

        memory/6024-710-0x00007FF7B1ED0000-0x00007FF7B2DE2000-memory.dmp

        memory/6024-711-0x00007FFB26130000-0x00007FFB26BD7000-memory.dmp