Analysis
- user interaction
yes - max time kernel
299s - max time network
349s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/11/2026, 00:11
General
- Target Blackmagic_Fairlight_Sound_Library_Windows.exe
- Size 933.1MB
- Sample261102-agtmhadg49
- SHA256 fce39c56f9bc057323b658fe2d4225f7a9566e6d8dfe5caa812344232dfc3143
Malware Config
Signatures
- Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- NTFS ADS 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 36 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 63 IoCs
- Suspicious use of SendNotifyMessage 61 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Blackmagic_Fairlight_Sound_Library_Windows.exe"C:\Users\Admin\AppData\Local\Temp\Blackmagic_Fairlight_Sound_Library_Windows.exe"1⤵
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cscript.execscript //Nologo C:\Users\Admin\AppData\Local\Temp\deferredrenameya4372.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SYSTEM32\cscript.execscript //Nologo C:\Users\Admin\AppData\Local\Temp\deferredrenameVw4372.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /k2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /k2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Movies\Fairlight Sound Library/auto_Uninstall.qs"3⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
deferredrenameVw4372.vbs
deferredrenameya4372.vbs
installer.dat
maintenancetool.dat.new
maintenancetool.exe.new
maintenancetool.ini
auto_uninstall.qs
memory/4372-29-0x000002DD8B680000-0x000002DD8B681000-memory.dmp
memory/4372-8-0x000002DD8B680000-0x000002DD8B681000-memory.dmp
memory/4372-79-0x000002DD8C2D0000-0x000002DD8C2D1000-memory.dmp
memory/4372-78-0x000002DD8C2D0000-0x000002DD8C2D1000-memory.dmp
memory/4372-77-0x000002DD8C2D0000-0x000002DD8C2D1000-memory.dmp
memory/4372-76-0x000002DD8C2D0000-0x000002DD8C2D1000-memory.dmp
memory/4372-75-0x000002DD8C2D0000-0x000002DD8C2D1000-memory.dmp
memory/4372-74-0x000002DD8C2D0000-0x000002DD8C2D1000-memory.dmp
memory/4372-73-0x000002DD8C2D0000-0x000002DD8C2D1000-memory.dmp
memory/4372-72-0x000002DD8C2D0000-0x000002DD8C2D1000-memory.dmp
memory/4372-71-0x000002DD8C2D0000-0x000002DD8C2D1000-memory.dmp
memory/4372-70-0x000002DD8C2D0000-0x000002DD8C2D1000-memory.dmp
memory/4372-45-0x000002DD8C2C0000-0x000002DD8C2C1000-memory.dmp
memory/4372-44-0x000002DD8C2C0000-0x000002DD8C2C1000-memory.dmp
memory/4372-43-0x000002DD8C2C0000-0x000002DD8C2C1000-memory.dmp
memory/4372-42-0x000002DD8C2C0000-0x000002DD8C2C1000-memory.dmp
memory/4372-41-0x000002DD8C2C0000-0x000002DD8C2C1000-memory.dmp
memory/4372-40-0x000002DD8C2C0000-0x000002DD8C2C1000-memory.dmp
memory/4372-39-0x000002DD8C2C0000-0x000002DD8C2C1000-memory.dmp
memory/4372-38-0x000002DD8C2C0000-0x000002DD8C2C1000-memory.dmp
memory/4372-37-0x000002DD8C2C0000-0x000002DD8C2C1000-memory.dmp
memory/4372-36-0x000002DD8C2C0000-0x000002DD8C2C1000-memory.dmp
memory/4372-35-0x000002DD8C2C0000-0x000002DD8C2C1000-memory.dmp
memory/4372-34-0x000002DD8C2C0000-0x000002DD8C2C1000-memory.dmp
memory/4372-33-0x000002DD8B680000-0x000002DD8B681000-memory.dmp
memory/4372-32-0x000002DD8C2C0000-0x000002DD8C2C1000-memory.dmp
memory/4372-30-0x000002DD8B680000-0x000002DD8B681000-memory.dmp
memory/4372-81-0x000002DD8C2D0000-0x000002DD8C2D1000-memory.dmp
memory/4372-28-0x000002DD8B680000-0x000002DD8B681000-memory.dmp
memory/4372-27-0x000002DD8B680000-0x000002DD8B681000-memory.dmp
memory/4372-80-0x000002DD8C2D0000-0x000002DD8C2D1000-memory.dmp
memory/4372-26-0x000002DD8B680000-0x000002DD8B681000-memory.dmp
memory/4372-6-0x000002DD8B680000-0x000002DD8B681000-memory.dmp
memory/4372-11-0x000002DD8B680000-0x000002DD8B681000-memory.dmp
memory/4372-539-0x000002DD8C2A0000-0x000002DD8C2A1000-memory.dmp
memory/4372-537-0x000002DD8C4E0000-0x000002DD8C4E1000-memory.dmp
memory/4372-536-0x000002DD8C4E0000-0x000002DD8C4E1000-memory.dmp
memory/4372-535-0x000002DD8C4E0000-0x000002DD8C4E1000-memory.dmp
memory/4372-534-0x000002DD8C4E0000-0x000002DD8C4E1000-memory.dmp
memory/4372-7-0x000002DD8B680000-0x000002DD8B681000-memory.dmp
memory/4372-9-0x000002DD8B680000-0x000002DD8B681000-memory.dmp
memory/4372-5-0x000002DD8B680000-0x000002DD8B681000-memory.dmp
memory/4372-3-0x000002DD8B650000-0x000002DD8B651000-memory.dmp
memory/4372-2-0x000002DD8B650000-0x000002DD8B651000-memory.dmp
memory/4372-0-0x000002DD8AE50000-0x000002DD8B650000-memory.dmp
memory/4372-548-0x000002DD8C2B0000-0x000002DD8C2B1000-memory.dmp
memory/4372-563-0x000002DD8C340000-0x000002DD8C342000-memory.dmp
memory/4372-562-0x000002DD8C340000-0x000002DD8C342000-memory.dmp
memory/4372-561-0x000002DD8C340000-0x000002DD8C342000-memory.dmp
memory/4372-560-0x000002DD8C340000-0x000002DD8C342000-memory.dmp
memory/4372-559-0x000002DD8C340000-0x000002DD8C342000-memory.dmp
memory/4372-558-0x000002DD8C340000-0x000002DD8C342000-memory.dmp
memory/4372-557-0x000002DD8C340000-0x000002DD8C342000-memory.dmp
memory/4372-556-0x000002DD8C2B0000-0x000002DD8C2B1000-memory.dmp
memory/4372-555-0x000002DD8C340000-0x000002DD8C342000-memory.dmp
memory/4372-554-0x000002DD8C340000-0x000002DD8C342000-memory.dmp
memory/4372-553-0x000002DD8C2F0000-0x000002DD8C2F1000-memory.dmp
memory/4372-12-0x000002DD8B680000-0x000002DD8B681000-memory.dmp
memory/4372-10-0x000002DD8B680000-0x000002DD8B681000-memory.dmp
memory/4372-552-0x000002DD8C2F0000-0x000002DD8C2F1000-memory.dmp
memory/4372-550-0x000002DD8C2E0000-0x000002DD8C2E1000-memory.dmp
memory/4372-547-0x000002DD8C2B0000-0x000002DD8C2B1000-memory.dmp
memory/4372-546-0x000002DD8C2B0000-0x000002DD8C2B1000-memory.dmp
memory/4372-545-0x000002DD8C2B0000-0x000002DD8C2B1000-memory.dmp