13044227afa2e800237038ad95d53c4e2a22f4aac1e2004c202663399faf9357

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
18/10/2026, 15:37

Target
Ableton keygen.exe
Size 1.8MB
Sample261018-s2mc2aev8p
SHA256 13044227afa2e800237038ad95d53c4e2a22f4aac1e2004c202663399faf9357
MD5 c0bacf62b2ad2ffdf63bbd1196026e76
SHA1 17142884f8081c808d64673d90233a0585da37fa
SHA512 fcf8a2db546eefd3af1182bdedcb6cceb0d24f13d8d0421df3eac031822c9cf47e9fb435bb39cad8531824484a78ce6e9fd3d500af70ff91fa175df9f606875d
SSDEEP 24576:IsELBDt7quimMnmszXAxHJons/bl1URz9Hs9Fz7GKaWfHMdH9fSDc+1B/p3n/pa:IsELNt+ms7YHJx9YrpS31TX
TLSH
T1DE95AD14A3A801A8E877D734CA619332D6B07D564770E58F0689F6452F33E92AFBF712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

ransomware

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
3508	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5824	OpenWith.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 3120	1972	cmd.exe	102
PID 5824 wrote to memory of 3508	5824	OpenWith.exe	108

C:\Users\Admin\AppData\Local\Temp\Ableton keygen.exe
"C:\Users\Admin\AppData\Local\Temp\Ableton keygen.exe"
1⤵
PID:1688

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:548

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\Ableton keygen.exe
  "Ableton keygen.exe"
  2⤵
  PID:3120

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5824
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Authorize.auz
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3508