Analysis
- user interaction
yes - max time kernel
333s - max time network
374s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 00:11
General
- Target Blackmagic_Fairlight_Sound_Library_Windows.exe
- Size 933.1MB
- Sample261102-agtmhadg49
- SHA256 fce39c56f9bc057323b658fe2d4225f7a9566e6d8dfe5caa812344232dfc3143
Malware Config
Signatures
- Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- NTFS ADS 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Blackmagic_Fairlight_Sound_Library_Windows.exe"C:\Users\Admin\AppData\Local\Temp\Blackmagic_Fairlight_Sound_Library_Windows.exe"1⤵
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cscript.execscript //Nologo C:\Users\Admin\AppData\Local\Temp\deferredrenameBb4860.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SYSTEM32\cscript.execscript //Nologo C:\Users\Admin\AppData\Local\Temp\deferredrenamegO4860.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /k2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /k2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\Movies\Fairlight Sound Library/auto_Uninstall.qs"3⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
deferredrenameBb4860.vbs
deferredrenamegO4860.vbs
installer.dat
maintenancetool.dat.new
maintenancetool.exe
maintenancetool.ini
auto_uninstall.qs
memory/4860-34-0x0000022D04010000-0x0000022D04011000-memory.dmp
memory/4860-2-0x0000022D033A0000-0x0000022D033A1000-memory.dmp
memory/4860-539-0x0000022D03FF0000-0x0000022D03FF1000-memory.dmp
memory/4860-537-0x0000022D04230000-0x0000022D04231000-memory.dmp
memory/4860-536-0x0000022D04230000-0x0000022D04231000-memory.dmp
memory/4860-535-0x0000022D04230000-0x0000022D04231000-memory.dmp
memory/4860-79-0x0000022D04020000-0x0000022D04021000-memory.dmp
memory/4860-78-0x0000022D04020000-0x0000022D04021000-memory.dmp
memory/4860-77-0x0000022D04020000-0x0000022D04021000-memory.dmp
memory/4860-76-0x0000022D04020000-0x0000022D04021000-memory.dmp
memory/4860-75-0x0000022D04020000-0x0000022D04021000-memory.dmp
memory/4860-74-0x0000022D04020000-0x0000022D04021000-memory.dmp
memory/4860-73-0x0000022D04020000-0x0000022D04021000-memory.dmp
memory/4860-72-0x0000022D04020000-0x0000022D04021000-memory.dmp
memory/4860-71-0x0000022D04020000-0x0000022D04021000-memory.dmp
memory/4860-70-0x0000022D04020000-0x0000022D04021000-memory.dmp
memory/4860-45-0x0000022D04010000-0x0000022D04011000-memory.dmp
memory/4860-44-0x0000022D04010000-0x0000022D04011000-memory.dmp
memory/4860-43-0x0000022D04010000-0x0000022D04011000-memory.dmp
memory/4860-42-0x0000022D04010000-0x0000022D04011000-memory.dmp
memory/4860-41-0x0000022D04010000-0x0000022D04011000-memory.dmp
memory/4860-40-0x0000022D04010000-0x0000022D04011000-memory.dmp
memory/4860-39-0x0000022D04010000-0x0000022D04011000-memory.dmp
memory/4860-38-0x0000022D04010000-0x0000022D04011000-memory.dmp
memory/4860-37-0x0000022D04010000-0x0000022D04011000-memory.dmp
memory/4860-36-0x0000022D04010000-0x0000022D04011000-memory.dmp
memory/4860-35-0x0000022D04010000-0x0000022D04011000-memory.dmp
memory/4860-80-0x0000022D04020000-0x0000022D04021000-memory.dmp
memory/4860-33-0x0000022D033D0000-0x0000022D033D1000-memory.dmp
memory/4860-30-0x0000022D033D0000-0x0000022D033D1000-memory.dmp
memory/4860-534-0x0000022D04230000-0x0000022D04231000-memory.dmp
memory/4860-27-0x0000022D033D0000-0x0000022D033D1000-memory.dmp
memory/4860-10-0x0000022D033D0000-0x0000022D033D1000-memory.dmp
memory/4860-6-0x0000022D033D0000-0x0000022D033D1000-memory.dmp
memory/4860-32-0x0000022D04010000-0x0000022D04011000-memory.dmp
memory/4860-29-0x0000022D033D0000-0x0000022D033D1000-memory.dmp
memory/4860-28-0x0000022D033D0000-0x0000022D033D1000-memory.dmp
memory/4860-26-0x0000022D033D0000-0x0000022D033D1000-memory.dmp
memory/4860-12-0x0000022D033D0000-0x0000022D033D1000-memory.dmp
memory/4860-11-0x0000022D033D0000-0x0000022D033D1000-memory.dmp
memory/4860-5-0x0000022D033D0000-0x0000022D033D1000-memory.dmp
memory/4860-9-0x0000022D033D0000-0x0000022D033D1000-memory.dmp
memory/4860-8-0x0000022D033D0000-0x0000022D033D1000-memory.dmp
memory/4860-7-0x0000022D033D0000-0x0000022D033D1000-memory.dmp
memory/4860-3-0x0000022D033A0000-0x0000022D033A1000-memory.dmp
memory/4860-546-0x0000022D04000000-0x0000022D04001000-memory.dmp
memory/4860-563-0x0000022D04090000-0x0000022D04092000-memory.dmp
memory/4860-562-0x0000022D04090000-0x0000022D04092000-memory.dmp
memory/4860-561-0x0000022D04090000-0x0000022D04092000-memory.dmp
memory/4860-560-0x0000022D04090000-0x0000022D04092000-memory.dmp
memory/4860-559-0x0000022D04090000-0x0000022D04092000-memory.dmp
memory/4860-558-0x0000022D04090000-0x0000022D04092000-memory.dmp
memory/4860-557-0x0000022D04090000-0x0000022D04092000-memory.dmp
memory/4860-556-0x0000022D04000000-0x0000022D04001000-memory.dmp
memory/4860-555-0x0000022D04090000-0x0000022D04092000-memory.dmp
memory/4860-554-0x0000022D04090000-0x0000022D04092000-memory.dmp
memory/4860-553-0x0000022D04040000-0x0000022D04041000-memory.dmp
memory/4860-81-0x0000022D04020000-0x0000022D04021000-memory.dmp
memory/4860-0-0x0000022D02BA0000-0x0000022D033A0000-memory.dmp
memory/4860-552-0x0000022D04040000-0x0000022D04041000-memory.dmp
memory/4860-550-0x0000022D04030000-0x0000022D04031000-memory.dmp
memory/4860-548-0x0000022D04000000-0x0000022D04001000-memory.dmp
memory/4860-547-0x0000022D04000000-0x0000022D04001000-memory.dmp
memory/4860-545-0x0000022D04000000-0x0000022D04001000-memory.dmp