Analysis
- user interaction
yes - max time kernel
122s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 20:06
General
- Target Setup Keyscape v1.5.2c.exe
- Size 62.7MB
- Sample260810-yvcsxaac75
- SHA256 a5eb97d030fc07a1728a79069e980b35f9b5ba088dc6d24a4e0c993c996e004f
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 7 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup Keyscape v1.5.2c.exe"C:\Users\Admin\AppData\Local\Temp\Setup Keyscape v1.5.2c.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NFHLU.tmp\Setup Keyscape v1.5.2c.tmp"C:\Users\Admin\AppData\Local\Temp\is-NFHLU.tmp\Setup Keyscape v1.5.2c.tmp" /SL5="$4018E,65355757,121344,C:\Users\Admin\AppData\Local\Temp\Setup Keyscape v1.5.2c.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Program Files\Spectrasonics\Keyscape\Keyscape.ico"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
- Checks SCSI registry key(s)
-
C:\Program Files\Spectrasonics\Keyscape\unins000.exe"C:\Program Files\Spectrasonics\Keyscape\unins000.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Program Files\Spectrasonics\Keyscape\unins000.exe" /FIRSTPHASEWND=$301F82⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\srchadmin.dll ,1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Keyscape.vst3
Keyscape.ico
Release Notes.pdf
unins000.dat
unins000.exe
Uninstall.lnk
Keyscape.dll
ISSKINU.DLL
R2RINNO.dll
SKIN.CJSTYLES
Setup Keyscape v1.5.2c.tmp
memory/1764-72-0x0000000076650000-0x0000000076701000-memory.dmp
memory/1764-57-0x0000000075810000-0x0000000075DEC000-memory.dmp
memory/1764-101-0x0000000074FA0000-0x0000000075021000-memory.dmp
memory/1764-99-0x0000000076650000-0x0000000076701000-memory.dmp
memory/1764-96-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-94-0x0000000074FA0000-0x0000000075021000-memory.dmp
memory/1764-93-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-91-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-67-0x0000000073FD0000-0x00000000740F8000-memory.dmp
memory/1764-65-0x0000000075030000-0x0000000075257000-memory.dmp
memory/1764-63-0x0000000075810000-0x0000000075DEC000-memory.dmp
memory/1764-87-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-61-0x0000000073FD0000-0x00000000740F8000-memory.dmp
memory/1764-59-0x0000000075030000-0x0000000075257000-memory.dmp
memory/1764-83-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-53-0x0000000075030000-0x0000000075257000-memory.dmp
memory/1764-79-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-76-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-74-0x0000000074FA0000-0x0000000075021000-memory.dmp
memory/1764-51-0x0000000075810000-0x0000000075DEC000-memory.dmp
memory/1764-49-0x0000000073FD0000-0x00000000740F8000-memory.dmp
memory/1764-47-0x0000000075030000-0x0000000075257000-memory.dmp
memory/1764-45-0x0000000075810000-0x0000000075DEC000-memory.dmp
memory/1764-44-0x0000000076FB0000-0x0000000077105000-memory.dmp
memory/1764-43-0x0000000075FE0000-0x00000000760C2000-memory.dmp
memory/1764-41-0x0000000073FD0000-0x00000000740F8000-memory.dmp
memory/1764-40-0x0000000075030000-0x0000000075257000-memory.dmp
memory/1764-68-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-66-0x0000000074FA0000-0x0000000075021000-memory.dmp
memory/1764-64-0x0000000076650000-0x0000000076701000-memory.dmp
memory/1764-62-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-60-0x0000000074FA0000-0x0000000075021000-memory.dmp
memory/1764-58-0x0000000076650000-0x0000000076701000-memory.dmp
memory/1764-103-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-56-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-55-0x0000000073FD0000-0x00000000740F8000-memory.dmp
memory/1764-54-0x0000000074FA0000-0x0000000075021000-memory.dmp
memory/1764-52-0x0000000076650000-0x0000000076701000-memory.dmp
memory/1764-50-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-48-0x0000000074FA0000-0x0000000075021000-memory.dmp
memory/1764-46-0x0000000076650000-0x0000000076701000-memory.dmp
memory/1764-42-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-38-0x0000000075810000-0x0000000075DEC000-memory.dmp
memory/1764-35-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-26-0x00000000754F0000-0x000000007556E000-memory.dmp
memory/1764-34-0x0000000075580000-0x00000000755A5000-memory.dmp
memory/1764-31-0x00000000741D0000-0x0000000074203000-memory.dmp
memory/1764-32-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-29-0x00000000754F0000-0x000000007556E000-memory.dmp
memory/1764-30-0x0000000075580000-0x00000000755A5000-memory.dmp
memory/1764-28-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-27-0x0000000075580000-0x00000000755A5000-memory.dmp
memory/1764-25-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-24-0x00000000754F0000-0x000000007556E000-memory.dmp
memory/1764-23-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-36-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-21-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-20-0x00000000754F0000-0x000000007556E000-memory.dmp
memory/1764-39-0x0000000076650000-0x0000000076701000-memory.dmp
memory/1764-37-0x0000000076FB0000-0x0000000077105000-memory.dmp
memory/1764-33-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-22-0x00000000754F0000-0x000000007556E000-memory.dmp
memory/1764-14-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1764-6-0x0000000002310000-0x0000000002311000-memory.dmp
memory/1764-154-0x0000000002310000-0x0000000002311000-memory.dmp
memory/4092-0-0x0000000000400000-0x0000000000428000-memory.dmp