Overview

overview

7

Static

static

3

pianoteq_s...02.exe

windows10-ltsc_2021-x64

7

Analysis

  • geolocation tags

    eueuropelondonukunited-kingdom
  • user interaction
    yes
  • max time kernel
    40s
  • max time network
    53s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260911-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    24/10/2026, 02:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    pianoteq_setup_v902.exe
  • Size 112.8MB
  • Sample261024-ckmdpsfs2x
  • SHA256 569d9039266359c9c4cf10a68da5ca4cf49fb38ed7c76f0c77336faf7efa7ffc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryinstaller

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 16 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Modifies registry class 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\pianoteq_setup_v902.exe
    "C:\Users\Admin\AppData\Local\Temp\pianoteq_setup_v902.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1396
    • C:\Users\Admin\AppData\Local\Temp\is-SR5S7.tmp\pianoteq_setup_v902.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-SR5S7.tmp\pianoteq_setup_v902.tmp" /SL5="$80296,117095997,882176,C:\Users\Admin\AppData\Local\Temp\pianoteq_setup_v902.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1536
      • C:\Program Files\Modartt\Pianoteq 9\Pianoteq 9.exe
        "C:\Program Files\Modartt\Pianoteq 9\Pianoteq 9.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Direct Volume Access: Opens a physical disk for reading
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of SetWindowsHookEx
        PID:2720

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        pianoteq-deutsch.html
        • Path C:\Program Files\Modartt\Pianoteq 9\Documentation\pianoteq-deutsch.html
        • Size 3.7MB
        • SHA256 5bb9d5f137e62900e73c006f1ba15df92346d02e6bb81437d2c97079b7aefe24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pianoteq-english.html
        • Path C:\Program Files\Modartt\Pianoteq 9\Documentation\pianoteq-english.html
        • Size 3.7MB
        • SHA256 234c8d5baffcc88c481a5bf255e9dc1b6d020550be444222008fb694e01a308c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pianoteq-francais.html
        • Path C:\Program Files\Modartt\Pianoteq 9\Documentation\pianoteq-francais.html
        • Size 3.7MB
        • SHA256 180665f2696dcde265536195073da4cd6a19cff0cf2441189e52cd44243e4a88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pianoteq-italiano.html
        • Path C:\Program Files\Modartt\Pianoteq 9\Documentation\pianoteq-italiano.html
        • Size 3.7MB
        • SHA256 02ef25eed07e849de67475235bdfe144d721bc054f5216e9674117117e59697d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ptq902p.dll
        • Path C:\Program Files\Modartt\Pianoteq 9\ptq902p.dll
        • Size 136KB
        • SHA256 7ad08f70a024b687188dcb9f8cbda945da2bf802feebc1d9a6ae6cbc6b98de87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unins000.exe
        • Path C:\Program Files\Modartt\Pianoteq 9\unins000.exe
        • Size 3.6MB
        • SHA256 d6d431835d1d85f458aea21cc0e4d700c411ec62ee63b9ca4cebfb50bac0f9f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        K1.ptq
        • Path C:\ProgramData\Modartt\Pianoteq\Addons\K1.ptq
        • Size 1.0MB
        • SHA256 5f430eb02af4ad36d388d766a6697827fb2abfff6e2516c8ae53b709178ac18d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KIViR.ptq
        • Path C:\ProgramData\Modartt\Pianoteq\Addons\KIViR.ptq
        • Size 4.8MB
        • SHA256 011c8f9fc84d47ee42287b5bb86458ad98cd29d47775da22479aecb906947c33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KPRAUSCH.ptq
        • Path C:\ProgramData\Modartt\Pianoteq\Addons\KPRAUSCH.ptq
        • Size 161KB
        • SHA256 25c9829d2108f6146b2b6e38cbe95404d621329adbc06f691b4d0c4217b1bb98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        V3.ptq
        • Path C:\ProgramData\Modartt\Pianoteq\Addons\V3.ptq
        • Size 2.7MB
        • SHA256 c5790c235668e4c74c42ff8b099c843a87fa9342d132badafabb3ac8053a1e4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bells.ptq
        • Path C:\ProgramData\Modartt\Pianoteq\Addons\bells.ptq
        • Size 568KB
        • SHA256 94a4998fec74e88822adf70bc86cc0fe4971d9e9b1ed183d0e350e97719d1c86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pianoteq_setup_v902.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-SR5S7.tmp\pianoteq_setup_v902.tmp
        • Size 3.6MB
        • SHA256 a6fd050e0788f4f92465485d9efdc26eae27c18e2986b3f17ce30661b3401ff5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1396-17-0x00000000001D0000-0x00000000002B7000-memory.dmp
        Download

        memory/1396-0-0x00000000001D0000-0x00000000002B7000-memory.dmp
        Download

        memory/1396-4447-0x00000000001D0000-0x00000000002B7000-memory.dmp
        Download

        memory/1536-19-0x0000000003130000-0x0000000003131000-memory.dmp
        Download

        memory/1536-4425-0x0000000000810000-0x0000000000BBE000-memory.dmp
        Download

        memory/1536-5-0x0000000003130000-0x0000000003131000-memory.dmp
        Download

        memory/1536-18-0x0000000000810000-0x0000000000BBE000-memory.dmp
        Download

        memory/1536-4445-0x0000000000810000-0x0000000000BBE000-memory.dmp
        Download

        memory/1536-4446-0x0000000000810000-0x0000000000BBE000-memory.dmp
        Download