Analysis
- user interaction
yes - max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-es - resource tags
- submitted
08/08/2026, 21:09
General
- Target Antares Auto-Tune bundle V9 CE/Antares Auto-Tune bundle V9 CE.exe
- Size 110.0MB
- Sample260808-zzmpcafd83
- SHA256 fb83741f29e99b8af74f9e182c3f1eaebeb2f401a5c6886f1c045d406e282c23
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops desktop.ini file(s) 2 IoCs
- Drops file in System32 directory 1 IoCs
- Drops file in Program Files directory 44 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 6 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Antares Auto-Tune bundle V9 CE\Antares Auto-Tune bundle V9 CE.exe"C:\Users\Admin\AppData\Local\Temp\Antares Auto-Tune bundle V9 CE\Antares Auto-Tune bundle V9 CE.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-U0F7H.tmp\Antares Auto-Tune bundle V9 CE.tmp"C:\Users\Admin\AppData\Local\Temp\is-U0F7H.tmp\Antares Auto-Tune bundle V9 CE.tmp" /SL5="$502AE,114584709,763392,C:\Users\Admin\AppData\Local\Temp\Antares Auto-Tune bundle V9 CE\Antares Auto-Tune bundle V9 CE.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault68fd0ce2h3924h43c5h96ebh190e630a10821⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault68fd0ce2h3924h43c5h96ebh190e630a1082 --edge-skip-compat-layer-relaunch2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x274,0x7ffd6444c188,0x7ffd6444c194,0x7ffd6444c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,14535453441214934399,2902578454550831164,524288 --field-trial-handle=2260,i,6577963893128577306,18232636705208478716,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,16305390808931184651,4825177971509326685,262144 --field-trial-handle=2260,i,6577963893128577306,18232636705208478716,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,9885166848164805844,18426065814140080221,524288 --field-trial-handle=2260,i,6577963893128577306,18232636705208478716,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3328,i,17981918407941372688,16215357198905936511,2097152 --field-trial-handle=2260,i,6577963893128577306,18232636705208478716,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:23⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\WF.msc"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
is-5HNCB.tmp
is-GA5BJ.tmp
settings.dat
settings.dat
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Preferences
Secure Preferences
Local State
Local State
Local State
Local State
Antares Auto-Tune bundle V9 CE.tmp
memory/2576-15-0x0000000000400000-0x0000000000683000-memory.dmp
memory/2576-317-0x0000000000400000-0x0000000000683000-memory.dmp
memory/2576-68-0x0000000000400000-0x0000000000683000-memory.dmp
memory/2576-17-0x0000000000400000-0x0000000000683000-memory.dmp
memory/2576-8-0x0000000000400000-0x0000000000683000-memory.dmp
memory/2576-9-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/2576-5-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/3764-318-0x0000000000400000-0x00000000004C8000-memory.dmp
memory/3764-0-0x0000000000400000-0x00000000004C8000-memory.dmp
memory/3764-7-0x0000000000400000-0x00000000004C8000-memory.dmp
memory/4532-472-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-486-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-509-0x000001EAED4F0000-0x000001EAED4F1000-memory.dmp
memory/4532-508-0x000001EAED500000-0x000001EAED501000-memory.dmp
memory/4532-433-0x000001EADD040000-0x000001EADD050000-memory.dmp
memory/4532-449-0x000001EADD140000-0x000001EADD150000-memory.dmp
memory/4532-465-0x000001EAED480000-0x000001EAED481000-memory.dmp
memory/4532-469-0x000001EAED5C0000-0x000001EAED5C1000-memory.dmp
memory/4532-468-0x000001EAED4B0000-0x000001EAED4B1000-memory.dmp
memory/4532-467-0x000001EAED4B0000-0x000001EAED4B1000-memory.dmp
memory/4532-470-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-471-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-507-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-473-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-474-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-475-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-476-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-477-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-480-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-479-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-478-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-481-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-482-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-483-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-484-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-506-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-485-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-489-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-488-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-487-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-494-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-493-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-492-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-491-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-490-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-495-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-496-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-497-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-498-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-499-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-500-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-501-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-502-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-503-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-504-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/4532-505-0x000001EAED4C0000-0x000001EAED4C1000-memory.dmp
memory/5460-429-0x000000001D8D0000-0x000000001D8DC000-memory.dmp
memory/5460-428-0x000000001DA40000-0x000000001DB42000-memory.dmp
memory/5460-431-0x000000001E800000-0x000000001EB04000-memory.dmp
memory/5460-430-0x000000001E310000-0x000000001E7F6000-memory.dmp