710006fa07ec3a5f06c5cc4023349eb5064067ddfa60dc6c406eb739023a3ccd

Analysis

max time kernel
118s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 03:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ample Sound Ample Metal Eclipse v4 WiN-MAC Plugin Crack.exe
Size 87KB
Sample260809-d9qyvsgr3w
SHA256 710006fa07ec3a5f06c5cc4023349eb5064067ddfa60dc6c406eb739023a3ccd
MD5 e9bc6423c7c862600abf57160227e1c4
SHA1 322b2c717b7d73765c67911f1b45e812bc1d988d
SHA512 12f7d5bab8d70c3615e512388fc9179048cb13b59134d93950117bbe3ea866740afd5bc5e5911276d9bdd131be62364f3869effa3da272fabde8fdcd61c248f7
SSDEEP 1536:bferrLkSRoe8C4UZsys0Dh1duH4Romu/TqOW9uL7010n6BBXQ+zoAiV+YPIEFI+k:bfi3k+oWDBDh1duH45PRq70+n6XPoAvT
TLSH
T13793E011F7A0C477D6B61731683B27F75FBAA8250290EB0303607F6D7CA2641A92F7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery installer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
23	296	starter.exe

Executes dropped EXE 2 IoCs

pid	Process
296	starter.exe
4448	set_0.exe

Loads dropped DLL 6 IoCs

pid	Process
1208	Ample Sound Ample Metal Eclipse v4 WiN-MAC Plugin Crack.exe
1208	Ample Sound Ample Metal Eclipse v4 WiN-MAC Plugin Crack.exe
1208	Ample Sound Ample Metal Eclipse v4 WiN-MAC Plugin Crack.exe
1208	Ample Sound Ample Metal Eclipse v4 WiN-MAC Plugin Crack.exe
296	starter.exe
296	starter.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ample Sound Ample Metal Eclipse v4 WiN-MAC Plugin Crack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	starter.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000d00000001c532-37.dat	nsis_installer_1
behavioral2/files/0x000d00000001c532-37.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{3E13DB35-B511-459B-9BA9-E9ABECD9C7A5}	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6048	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 296	1208	Ample Sound Ample Metal Eclipse v4 WiN-MAC Plugin Crack.exe	91
PID 296 wrote to memory of 4448	296	starter.exe	94

C:\Users\Admin\AppData\Local\Temp\Ample Sound Ample Metal Eclipse v4 WiN-MAC Plugin Crack.exe
"C:\Users\Admin\AppData\Local\Temp\Ample Sound Ample Metal Eclipse v4 WiN-MAC Plugin Crack.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\Temp\nsw68F.tmp\starter.exe
  "C:\Users\Admin\AppData\Local\Temp\nsw68F.tmp\starter.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:296
- - C:\Users\Admin\AppData\Local\Temp\nsh12EF.tmp\set_0.exe
    "C:\Users\Admin\AppData\Local\Temp\nsh12EF.tmp\set_0.exe"
    3⤵
    - Executes dropped EXE
    PID:4448

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:6060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 dfbbcf6ab9c043dd12e3bbc4c54e82630be7d5c967f60dcba02e1fc229e88836
MD5 96eb6fc11f6961b3b2bca35c278df281
SHA1 4a7caf3074f73adfde790562b71b7a8cc9e4d6cf
SHA512 84e8a596e9621b4a9f6911deb90bc6173fad89996c4b784271f8b2a73f3ddfb627f7cbc0281f8b2e1960bad6eadc029e24b942e2b48aeace3d1d4623ed81fc4a
TLSH
T1D4C08C0833B14559F1300D7F0A82530187BAA1008D4283000F301218C11CA0258A0C02
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 25c61fc5a153473f60abfbe4e2dcf29c147847252949f3d87ee689762d535a38
MD5 dd37f7b3074f11f3a189cb71b58808f0
SHA1 48db16ad4e37bcd72d0a75a2c556433497f690fb
SHA512 ed5f1b9f40edd203369d48e46d4577ddd5b665389926ddef80e690faae1a45ae8f05baa2e9be117e99bdfa749bf82d5669ca9d49ddc8053d808b9251b5f18e9f
TLSH
T11CC09B14B3B54715F10E113D7DD5161457B54105F5D7C3144B78153885186500871D05
MD5 SHA1 SHA512 TLSH

Submit Download

inetc.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh12EF.tmp\inetc.dll
Size 22KB
SHA256 89e24e4124b607f3f98e4df508c4ddd2701d8f7fcf1dc6e2aba11d56c97c0c5a
MD5 cab75d596adf6bac4ba6a8374dd71de9
SHA1 fb90d4f13331d0c9275fa815937a4ff22ead6fa3
SHA512 510786599289c8793526969cfe0a96e049436d40809c1c351642b2c67d5fb2394cb20887010727a5da35c52a20c5557ad940967053b1b59ad91ca1307208c391
SSDEEP 384:PWc7V9H6MVsnCPFN4DC5/kdhdj/ouVj19L0d10Ac9khYLMkIX0+GbyeEaI2sJ:PWqTH/V7tHSWutp
TLSH
T19BA2E6124A600AF7E3B90534B0AB37530769EE72646565D786F32AC93874393FF36722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

set_0.exe

Path C:\Users\Admin\AppData\Local\Temp\nsh12EF.tmp\set_0.exe
Size 3.9MB
SHA256 90eb16162aa7723a74dd8a1a8e49a3a659dd982afaf4abd7c93e455ec8cf8f99
MD5 42e5384c554e2768bb5dd4f67b95eaac
SHA1 d2df9fe60198d53c63081dc5544e7b9fc758aed8
SHA512 b3c7287297d2851b5d7510b98dbe28672eaa7e7697f2d100db630ba6c93e9af4f5ff642c219049ef5134ad814df9de3a51de7edbf5c2f2bcbf6db68a703f7a03
SSDEEP 49152:SliC2k8kQlyGPOSYQ8McmheHqyPore+J7ocO/:SDytV8THRPTqi
TLSH
T19A163903BDA508F9C19AE73189A752527B74BC4C4B3123E32E90BAB82F767D05E35B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw68F.tmp\INetC.dll
Size 25KB
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
TLSH
T1F0B2F99257EA179AF7BAAB3478B9E762497FBC211821CCCF5533068D1872241ED30727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSISdl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw68F.tmp\NSISdl.dll
Size 15KB
SHA256 aab28914794a1cdda4561e9f2af3e006dbed220d9d6bfe049b56d0cb9b783648
MD5 05f72d6a944e701217ef2eb2cc13e0ee
SHA1 fac99c39150ae484e4b3e0af2f4be86bb1835dde
SHA512 c87e783fc169ef01ac0d3ce29fbfbf349a2e22329df9203a1443cc2caebbe7f8282c0754740289ecca534951cb7e574bafef9ccbaa0da7c287109920ec9573eb
SSDEEP 384:hRy180+1ygVaLfKgcIno1gEBWZwCUKihb:hRy180+HSegEBWyQih
TLSH
T185623C46AA2084F1DBA2167034D33E3A67F18E751A2484C247F35D4FAE16317B37A986
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw68F.tmp\System.dll
Size 12KB
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
TLSH
T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw68F.tmp\nsDialogs.dll
Size 9KB
SHA256 4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
MD5 1d8f01a83ddd259bc339902c1d33c8f1
SHA1 9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
SHA512 28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
SSDEEP 96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
TLSH
T12A120992E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

starter.exe

Path C:\Users\Admin\AppData\Local\Temp\nsw68F.tmp\starter.exe
Size 10.9MB
SHA256 4db3ee7fd3b537142d3ef43317b8a098824540fceabaef956899a6631aeda655
MD5 ba9899e1ceacaf50f740cb56de2b046d
SHA1 2ea8f6a23914443b0b9cdf2190d218f5c1dc1a0a
SHA512 00fe5edc9083626745eb8e021bdf563b8c1e71751505a514d86da1fd7b746270f55a7ce106bab8dad06fc00784cdad5d8ef83ea533f7cd3bcdeb4a326da8b6fa
SSDEEP 196608:xy/9aBCEGCT2RxRbgyQBOrafXBIx2imh/wtEzFdxlTg9lt:xs9aBmzxRYBOrO+UIgTxy9
TLSH
T19CB6333BE12974D0E44188BE7A5D026991BD217278ADE0A7F07E6DC4B408D4B5BEE07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6048-59-0x00000191372E0000-0x000001913753F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads