Overview

overview

8

Static

static

1

fxsound_setup.exe

windows10-2004-x64

8

fxsound_setup.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/09/2026, 12:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fxsound_setup.exe
  • Size 69.2MB
  • Sample260905-pybwcavcra
  • SHA256 d97f1d58d36a1cc5748749b12c691c537342c0a3ccdce125e6cefefb1287e2e1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 20 IoCs
  • Drops file in Program Files directory 57 IoCs
  • Drops file in Windows directory 26 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 53 IoCs
  • Modifies registry class 26 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\fxsound_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\fxsound_setup.exe"
    1⤵
    • Enumerates connected drives
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4156
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\FxSound LLC\FxSound 1.2.6.0\install\fxsound.x64.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\fxsound_setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1788371548 " AI_EUIMSI=""
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:4664
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5836
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 11A0BF4B6BCE40D3858718475B93582B C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2792
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2724
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding BB407D50A5D84C7679A4DD4C077384DB
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:940
        • C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe
          "C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe" remove *DFX12
          3⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          PID:3320
        • C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe
          "C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe" check
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5316
        • C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe
          "C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe" install "C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.inf"
          3⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          PID:2580
        • C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe
          "C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe" getguid
          3⤵
          • Executes dropped EXE
          PID:1456
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2000
    • C:\PROGRA~1\FXSOUN~1\FxSound\FxSound.exe
      C:\PROGRA~1\FXSOUN~1\FxSound\FxSound.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4248
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{9c2f4886-65ec-ec41-95ff-96285b0ee479}\fxvad.inf" "9" "4143399a7" "0000000000000190" "WinSta0\Default" "000000000000016C" "208" "c:\program files\fxsound llc\fxsound\drivers\win10\x64"
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:5832
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\System32\DriverStore\FileRepository\fxvad.inf_amd64_a75d87b3871a94a9\fxvad.inf" "oem1.inf:ed86ca115cc2c934:DFX_Device:14.1.0.0:root\fxvad," "4143399a7" "0000000000000190" "9bb"
      1⤵
      • Drops file in Drivers directory
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      PID:2992

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e595398.rbs
          • Path C:\Config.Msi\e595398.rbs
          • Size 18KB
          • SHA256 1e730f84f0674eeed1fdae2781ccb8497a4ff2473241a7ed31efdb51d9c2d763
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DfxInstall.dll
          • Path C:\Program Files\FxSound LLC\FxSound\Apps\DfxInstall.dll
          • Size 125KB
          • SHA256 f7aa2cb8b18d5cae94ab151dfe744d09fb0c59654bfa0696ed01fa42c68f9dfc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DfxSetupDrv.exe
          • Path C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe
          • Size 65KB
          • SHA256 204474b72a3c8f1faf68a8916bdf3c4d594e98506f3b1bedd9208a88be293531
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fxdevcon64.exe
          • Path C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe
          • Size 263KB
          • SHA256 8fa948e4d39f2862382336400e79c9dc0b83295ab988ee1baba3ecb9e485f55b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fxvad.inf
          • Path C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.inf
          • Size 5KB
          • SHA256 ba175cfddd91b87bdda3f1df2a70249e1742e846b843381eb0438b70f91a110a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FxSound.exe
          • Path C:\Program Files\FxSound LLC\FxSound\FxSound.exe
          • Size 3.5MB
          • SHA256 fd80d20eb35b62b0298ac9988c91b416b17923edff854f00ef20f9aef7cbecd5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          updater.ini
          • Path C:\Program Files\FxSound LLC\FxSound\updater.ini
          • Size 484B
          • SHA256 510264ef1808541825e440bb4b891ff6f39510d29164c8f0e5b2dc14c91d906f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          FxSound.settings
          • Path C:\ProgramData\FxSound\FxSound.settings
          • Size 415B
          • SHA256 4347a99e0a128052bc3a99811b9aab78a2e51abb147e705d13d844a300f79e4f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI71C.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI71C.tmp
          • Size 1019KB
          • SHA256 15c35c5abf7bab8d1375f5622e31da14fd027ae1046b8a6ddfd74263fa34eda6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI90b70.LOG
          • Path C:\Users\Admin\AppData\Local\Temp\MSI90b70.LOG
          • Size 23KB
          • SHA256 8b392238c7754c06b70923b5886c524f4584686b8dfd5c417950a7abd89a9344
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI9FE.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI9FE.tmp
          • Size 917KB
          • SHA256 0fa9b28d3bb8e455ad61735f5259d5d9b8f65bcefa44f83f69db8a4ca451e5bd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fxsound.x64.msi
          • Path C:\Users\Admin\AppData\Roaming\FxSound LLC\FxSound 1.2.6.0\install\fxsound.x64.msi
          • Size 2.9MB
          • SHA256 a94592a6bb9626291c36400b74731c3e3632be4fdaf511315cc989654f4a698b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fxvad.inf_amd64_a75d87b3871a94a9.ini
          • Path C:\Windows\System32\DriverStore\FileRepository\fxvad.inf_amd64_a75d87b3871a94a9.ini
          • Size 416B
          • SHA256 76fff63f2551e716be50974ecf207dd6a9521375a69a588b40466ac84eac32e7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 26.1MB
          • SHA256 8ae7c972b3f73ab0b66bce75e76d76d574387eb2e5e5e798af0fe7dab9829317
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {4480ce5c-fd7a-4f04-8746-afa4552d740a}_OnDiskSnapshotProp
          • Path \??\Volume{5d76dc85-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{4480ce5c-fd7a-4f04-8746-afa4552d740a}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 05ca6828e372e7c5961e8261d3ba9b9d2407bab3bc179f0c33f3d6d8f315c86e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fxvad.sys
          • Path \??\c:\PROGRA~1\FXSOUN~1\fxsound\drivers\win10\x64\fxvad.sys
          • Size 319KB
          • SHA256 425629b6309000013e8cd1a9b827bee365d21c9f743873aadd0c3bc96a999d2a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fxvadNTAMD64.cat
          • Path \??\c:\program files\fxsound llc\fxsound\drivers\win10\x64\fxvadNTAMD64.cat
          • Size 10KB
          • SHA256 25c8dae186155d20f74feedefb4f84161e4215925b8fd0c898f68f3e50ebcd7d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download