6887a443f8ce714b6429feae5d6bff664826374dd9ba0bc650cc1524627a2b02

Analysis

max time kernel
154s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 21:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Antares - Bundle VST, VST3, AAX, x86 x64 (NO INSTALL, SymLink Installer) [08.12.2019].exe
Size 399.7MB
Sample260720-1aeswae15k
SHA256 6887a443f8ce714b6429feae5d6bff664826374dd9ba0bc650cc1524627a2b02
MD5 42a10b58b57100263218d409ad0b7cf2
SHA1 692226ae351dacebaca54df779f42f0f00e684b9
SHA512 7d407a34e5a7ebd484e281f2ac36eb13b74fa7926d5289b781ac0018fa486564d4922f6e805b246e0c3a26dcd2491d86916ca92451ea13e685d04cdcfcc5b25c
SSDEEP 12582912:wDGs5kZ+IX3MrwhRM/G6OCID45ONTwQAUL9OoVfz2I:wDn5K/X3M8hRM/dOCIM2D39jVF
TLSH
T13C193399F275C2DFF2C0043634B90B3A77AA1747E06E50B02AA14D9C2A49257E67737F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 10 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Antares\C\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Access.aaxplugin\desktop.ini	Antares - Bundle VST, VST3, AAX, x86 x64 (NO INSTALL, SymLink Installer) [08.12.2019].exe
File created	C:\Users\Admin\AppData\Local\Temp\Antares\C\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune EFX.aaxplugin\desktop.ini	Antares - Bundle VST, VST3, AAX, x86 x64 (NO INSTALL, SymLink Installer) [08.12.2019].exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Antares\C\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune_AAX.aaxplugin\desktop.ini	Antares - Bundle VST, VST3, AAX, x86 x64 (NO INSTALL, SymLink Installer) [08.12.2019].exe
File created	C:\Users\Admin\AppData\Local\Temp\Antares\C\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin\desktop.ini	Antares - Bundle VST, VST3, AAX, x86 x64 (NO INSTALL, SymLink Installer) [08.12.2019].exe
File created	C:\Users\Admin\AppData\Local\Temp\Antares\C\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Access.aaxplugin\desktop.ini	Antares - Bundle VST, VST3, AAX, x86 x64 (NO INSTALL, SymLink Installer) [08.12.2019].exe
File created	C:\Users\Admin\AppData\Local\Temp\Antares\C\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Artist.aaxplugin\desktop.ini	Antares - Bundle VST, VST3, AAX, x86 x64 (NO INSTALL, SymLink Installer) [08.12.2019].exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Antares\C\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Artist.aaxplugin\desktop.ini	Antares - Bundle VST, VST3, AAX, x86 x64 (NO INSTALL, SymLink Installer) [08.12.2019].exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Antares\C\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune EFX.aaxplugin\desktop.ini	Antares - Bundle VST, VST3, AAX, x86 x64 (NO INSTALL, SymLink Installer) [08.12.2019].exe
File created	C:\Users\Admin\AppData\Local\Temp\Antares\C\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune_AAX.aaxplugin\desktop.ini	Antares - Bundle VST, VST3, AAX, x86 x64 (NO INSTALL, SymLink Installer) [08.12.2019].exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Antares\C\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin\desktop.ini	Antares - Bundle VST, VST3, AAX, x86 x64 (NO INSTALL, SymLink Installer) [08.12.2019].exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antares - Bundle VST, VST3, AAX, x86 x64 (NO INSTALL, SymLink Installer) [08.12.2019].exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3212	Antares - Bundle VST, VST3, AAX, x86 x64 (NO INSTALL, SymLink Installer) [08.12.2019].exe

C:\Users\Admin\AppData\Local\Temp\Antares - Bundle VST, VST3, AAX, x86 x64 (NO INSTALL, SymLink Installer) [08.12.2019].exe
"C:\Users\Admin\AppData\Local\Temp\Antares - Bundle VST, VST3, AAX, x86 x64 (NO INSTALL, SymLink Installer) [08.12.2019].exe"
1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:3212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PlugIn.ico

Path C:\Users\Admin\AppData\Local\Temp\Antares\C\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Artist.aaxplugin\PlugIn.ico
Size 45KB
SHA256 00999004190475604537034d99d9a2cc84355579e4b199045dc6c8c3479e3600
MD5 6e03b680fbee54e69e52a15245989862
SHA1 0136100d693fa2cf4eba38ac0314951b7be22c9b
SHA512 1a2e8770e676bfe9c84f81185584fdf347271897637f18ccbcb1f1dfb7f4afac4cf65ab0d19d7f34044b5f5b304d7b54c9c85c8049fee0a4a3e4cabe3ae7c578
SSDEEP 768:bGZFQoWsxV75P4tkACEv3O7fF9mS0ZPdLwDiQ2lKS:OFQobL5P4tkAZv3wNQFdLw2QCKS
TLSH
T1E123ADD2A4491483E3AE1173C78571FE9CB4F8674273B5A6FB026DF80A6A736D709205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\Temp\Antares\C\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Artist.aaxplugin\desktop.ini
Size 126B
SHA256 5526ef6345adee7c693e58354dd72b095df152be62ff7298b4c6f6d0f91e2f83
MD5 798095cd31340606c8e81d0a5107d57e
SHA1 39d058c4d45ef84b188f7ece620106124eb3d74e
SHA512 9ca995c89d3f23cd2a977fb2826da1f75dc4caa4fe965f9aac3a6d486f6558429a44eaeea35217f85d94ba6d7c2c54ab520c9a1786133b2edd103e36159e53a1
TLSH
T190B09B15282F5020D57FC3071990BDCFF2041857985BE804C78287854EE17164FC855C
MD5 SHA1 SHA512 TLSH