Analysis
- user interaction
yes - max time kernel
98s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
13/11/2026, 03:42
General
- Target metatune-win-1.2.3.0-CRACK.exe
- Size 7.7MB
- Sample261113-d9lddazv2k
- SHA256 7a17b7b138282de28e0ac4b6302c33b4f3df50a3d64640e3fde263962ef6cbe7
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 5 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 21 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\metatune-win-1.2.3.0-CRACK.exe"C:\Users\Admin\AppData\Local\Temp\metatune-win-1.2.3.0-CRACK.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-5ODV3.tmp\metatune-win-1.2.3.0-CRACK.tmp"C:\Users\Admin\AppData\Local\Temp\is-5ODV3.tmp\metatune-win-1.2.3.0-CRACK.tmp" /SL5="$C010E,6579990,1068032,C:\Users\Admin\AppData\Local\Temp\metatune-win-1.2.3.0-CRACK.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\VSTPlugins\Slate Digital\MetaTune.vst3\Contents\x86_64-win\MetaTune.vst32⤵
-
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\InitializeWait.emf"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MetaTune.vst3
metatune-win-1.2.3.0-CRACK.tmp
memory/952-1-0x0000000000400000-0x0000000000512000-memory.dmp
memory/952-20-0x0000000000400000-0x0000000000512000-memory.dmp
memory/4616-5-0x0000000002830000-0x0000000002831000-memory.dmp
memory/4616-19-0x0000000000400000-0x000000000074E000-memory.dmp