Overview

overview

7

Static

static

3

FL Studio ...er.msi

windows10-2004-x64

7

FL Studio ...er.msi

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    162s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 04:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FL Studio Producer Edition All Plugins Edition Full Version 2026 (Latest Update)/FL Studio Producer.msi
  • Size 12.8MB
  • Sample260809-fklc7ahn41
  • SHA256 da9e33b2be53639990c2a2c0a0ffc6e3d92231d1e9006b864379fba2ebdb23bd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
executionransomware

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\FL Studio Producer Edition All Plugins Edition Full Version 2026 (Latest Update)\FL Studio Producer.msi"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:4548
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3124
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2616
      • C:\Windows\system32\wscript.exe
        wscript.exe //B //nologo yxfsways.vbs
        2⤵
        • Executes a VBScript file via the Windows Script Host.
        • Suspicious use of WriteProcessMemory
        PID:1296
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\pkg-assist\cdxxcffs.cmd"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1188
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe" /C "C:\Users\Admin\AppData\Local\pkg-assist\hxdzsvfg.cmd"
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:5068
            • C:\Users\Admin\AppData\Local\pkg-assist\node.exe
              "C:\Users\Admin\AppData\Local\pkg-assist\node.exe" "C:\Users\Admin\AppData\Local\pkg-assist\main.js"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              PID:4896
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2524

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e599eb8.rbs
          • Path C:\Config.Msi\e599eb8.rbs
          • Size 9KB
          • SHA256 ae49571309ce1f79dd93f7bde37c127a2be8009cb4efd64849a4f5a6c6d1b181
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          613bbb5623190284.node
          • Path C:\Users\Admin\AppData\Local\Temp\613bbb5623190284.node
          • Size 1.1MB
          • SHA256 487491a605f418b3c4a124ae23d435f1d0425ff33d68d6fa2a00b0d7f06a4d38
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          boot.node
          • Path C:\Users\Admin\AppData\Local\pkg-assist\boot.node
          • Size 1.1MB
          • SHA256 1f0441108463a5a30963b7aa43215591b41d03341d907eca43b29dfad89c7748
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cdxxcffs.cmd
          • Path C:\Users\Admin\AppData\Local\pkg-assist\cdxxcffs.cmd
          • Size 68B
          • SHA256 46a650ec1722e2fc713b05cdb49939b64a874a80cb868f5d381aaf972fcf9a7a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          hxdzsvfg.cmd
          • Path C:\Users\Admin\AppData\Local\pkg-assist\hxdzsvfg.cmd
          • Size 105B
          • SHA256 ed80d3ead12ca3d30cfaf03020c6b393960064283799b25192ed3cf68a7262da
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          keys.js
          • Path C:\Users\Admin\AppData\Local\pkg-assist\keys.js
          • Size 269B
          • SHA256 f702834be57ee0b6829d75a4372e6835297a6e19b37390a43489ebb60afe7160
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          main.js
          • Path C:\Users\Admin\AppData\Local\pkg-assist\main.js
          • Size 26KB
          • SHA256 7f6d3920e57f4c2a7fbfe402b5a40a9e3991de52f769c85aa1f63cd8da13d0b0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          node.exe
          • Path C:\Users\Admin\AppData\Local\pkg-assist\node.exe
          • Size 28.9MB
          • SHA256 b014e4ec5ca810b2fb54cdbf6ab8d6acc488285c98469606efb8b412472bec2a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pack.bin
          • Path C:\Users\Admin\AppData\Local\pkg-assist\pack.bin
          • Size 1.4MB
          • SHA256 d3f5e93ec2647b3d8fc7f5fb7017f7ab62272bd87d8e9d8593e3b82f5ab35703
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          yxfsways.vbs
          • Path C:\Users\Admin\AppData\Local\pkg-assist\yxfsways.vbs
          • Size 236B
          • SHA256 13f0059b40b02371631ba3fc9a1dc18b56f45b76bc89c4a7bd4573a5e7a6773d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          e599eb7.msi
          • Path C:\Windows\Installer\e599eb7.msi
          • Size 12.8MB
          • SHA256 da9e33b2be53639990c2a2c0a0ffc6e3d92231d1e9006b864379fba2ebdb23bd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 26.1MB
          • SHA256 8b88d8d405923be8e076c19e23c774a86295d8f4be0d58fc4d5fbe18af589d56
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {a55b7783-abd9-4709-956a-d97af2a98797}_OnDiskSnapshotProp
          • Path \??\Volume{c576ab2f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{a55b7783-abd9-4709-956a-d97af2a98797}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 e54c45e444696bb9b2d7e947c3a02735bd4bc59d99f939dd38122786552940b9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/4896-42-0x000001F66C230000-0x000001F66C284000-memory.dmp
          Download