Analysis
- user interaction
yes - max time kernel
148s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/09/2026, 06:26
Static task
static1
Behavioral task
behavioral1
Sample
Auto-Tune_Pro_v9.1.1_Windows.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
Auto-Tune_Pro_v9.1.1_Windows.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target Auto-Tune_Pro_v9.1.1_Windows.exe
- Size 153.9MB
- Sample260909-g7e1csszds
- SHA256 ae1f7834a467b9bcb349f80caa678416dd2a63c191a1dd3d7c51255d5a45e924
- MD5 6bb05871158f7836f32a0b2ac6a1079a
- SHA1 7d2a6d61b910d4cf954952cc5653c63b4d97b787
- SHA512 99a194c66442f681f184153e092335d27b4e030e270cd77cdfbe191646c8bb14da47ed5e80f2dfdc6b3efcb0b30985214911d42423a41ab62c71f3491b455c38
- SSDEEP 3145728:LK/1cEpetTHYmB3c7ZOIDmikRQwAv95DlMcI3J5KJYSo8L8P2XTiY0JXFHd:aaTHYF5n0VAHDaJAJw8A2XR05n
- TLSH T1FC78332395A0412EC9F286351E5F6CF1514ABC3F6F24915AB214FE182DF0A91F973B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: MSIEXEC.EXE File opened (read-only) \??\T: MSIEXEC.EXE File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\X: MSIEXEC.EXE File opened (read-only) \??\B: MSIEXEC.EXE File opened (read-only) \??\K: MSIEXEC.EXE File opened (read-only) \??\O: MSIEXEC.EXE File opened (read-only) \??\V: MSIEXEC.EXE File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: MSIEXEC.EXE File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: MSIEXEC.EXE File opened (read-only) \??\I: MSIEXEC.EXE File opened (read-only) \??\L: MSIEXEC.EXE File opened (read-only) \??\U: MSIEXEC.EXE File opened (read-only) \??\Z: MSIEXEC.EXE File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: MSIEXEC.EXE File opened (read-only) \??\Y: MSIEXEC.EXE File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\G: MSIEXEC.EXE File opened (read-only) \??\Q: MSIEXEC.EXE File opened (read-only) \??\R: MSIEXEC.EXE File opened (read-only) \??\W: MSIEXEC.EXE File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: MSIEXEC.EXE File opened (read-only) \??\J: MSIEXEC.EXE File opened (read-only) \??\N: MSIEXEC.EXE File opened (read-only) \??\P: MSIEXEC.EXE File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4836 set thread context of 1800 4836 Auto-Tune_Pro_v9.1.1_Windows.exe 115 - Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Auto-Tune_AAX.aaxplugin\Contents\x64\Auto-Tune_AAX.aaxplugin msiexec.exe File created C:\Program Files\Antares Audio Technologies\Antares Central.exe msiexec.exe File created C:\Program Files\Antares Audio Technologies\Antares Software License Agreement.pdf msiexec.exe File created C:\Program Files\Antares Audio Technologies\Antares Central Services.exe msiexec.exe File created C:\Program Files\Common Files\VST3\Auto-Tune.vst3 msiexec.exe File created C:\Program Files\Antares Audio Technologies\WibuCm64.dll msiexec.exe File created C:\Program Files\Antares Audio Technologies\Auto-Tune Pro\Activating Your License.pdf msiexec.exe File created C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Auto-Key.aaxplugin\Contents\x64\Auto-Key.aaxplugin msiexec.exe File created C:\Program Files\Common Files\VST3\Auto-Key.vst3 msiexec.exe File created C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Auto-Tune_AAX.aaxplugin\Contents\Resources\Auto-Tune.xml msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\e598dfe.msi msiexec.exe File opened for modification C:\Windows\Installer\e598dfe.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e598e00.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{648D0E3C-9937-483D-ABD4-76209CD00538} msiexec.exe File opened for modification C:\Windows\Installer\MSI92FF.tmp msiexec.exe File created C:\Windows\Installer\{648D0E3C-9937-483D-ABD4-76209CD00538}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\{648D0E3C-9937-483D-ABD4-76209CD00538}\ARPPRODUCTICON.exe msiexec.exe - Executes dropped EXE 2 IoCs
pid Process 4836 Auto-Tune_Pro_v9.1.1_Windows.exe 1796 Antares Central Services.exe - Loads dropped DLL 2 IoCs
pid Process 2904 MsiExec.exe 1796 Antares Central Services.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Auto-Tune_Pro_v9.1.1_Windows.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Auto-Tune_Pro_v9.1.1_Windows.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000306421734df6c2060000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000306421730000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090030642173000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a30642173000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d30642173000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 28 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3E0D8467399D384BA4D6702C90D5083\AuthorizedLUAApp = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\924C6464F4635E74FAB945AABB5553E9\C3E0D8467399D384BA4D6702C90D5083 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3E0D8467399D384BA4D6702C90D5083\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Downloaded Installations\\{8B71AE52-E0F6-4367-A7C3-A381C3482A25}\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3E0D8467399D384BA4D6702C90D5083 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3E0D8467399D384BA4D6702C90D5083\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3E0D8467399D384BA4D6702C90D5083\Version = "151060481" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3E0D8467399D384BA4D6702C90D5083\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3E0D8467399D384BA4D6702C90D5083\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3E0D8467399D384BA4D6702C90D5083\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C3E0D8467399D384BA4D6702C90D5083\NewFeature2 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\924C6464F4635E74FAB945AABB5553E9 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3E0D8467399D384BA4D6702C90D5083\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3E0D8467399D384BA4D6702C90D5083\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Downloaded Installations\\{8B71AE52-E0F6-4367-A7C3-A381C3482A25}\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3E0D8467399D384BA4D6702C90D5083\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3E0D8467399D384BA4D6702C90D5083\SourceList\Media\1 = "DISK1;1" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3E0D8467399D384BA4D6702C90D5083\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C3E0D8467399D384BA4D6702C90D5083 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C3E0D8467399D384BA4D6702C90D5083\AlwaysInstall msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C3E0D8467399D384BA4D6702C90D5083\New_Feature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3E0D8467399D384BA4D6702C90D5083\PackageCode = "25EA17B86F0E76347A3C3A183C84A252" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3E0D8467399D384BA4D6702C90D5083\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3E0D8467399D384BA4D6702C90D5083\ProductIcon = "C:\\Windows\\Installer\\{648D0E3C-9937-483D-ABD4-76209CD00538}\\ARPPRODUCTICON.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3E0D8467399D384BA4D6702C90D5083\SourceList\PackageName = "Antares Auto-Tune Pro.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C3E0D8467399D384BA4D6702C90D5083\NewFeature1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C3E0D8467399D384BA4D6702C90D5083\New_Feature2 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3E0D8467399D384BA4D6702C90D5083\ProductName = "Antares Auto-Tune Pro" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3E0D8467399D384BA4D6702C90D5083\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3E0D8467399D384BA4D6702C90D5083\InstanceType = "0" msiexec.exe - Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 3368 msiexec.exe 3368 msiexec.exe 1796 Antares Central Services.exe 1796 Antares Central Services.exe 1796 Antares Central Services.exe 1796 Antares Central Services.exe 1796 Antares Central Services.exe 1796 Antares Central Services.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5104 MSIEXEC.EXE - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5104 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 5104 MSIEXEC.EXE Token: SeSecurityPrivilege 3368 msiexec.exe Token: SeCreateTokenPrivilege 5104 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 5104 MSIEXEC.EXE Token: SeLockMemoryPrivilege 5104 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 5104 MSIEXEC.EXE Token: SeMachineAccountPrivilege 5104 MSIEXEC.EXE Token: SeTcbPrivilege 5104 MSIEXEC.EXE Token: SeSecurityPrivilege 5104 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 5104 MSIEXEC.EXE Token: SeLoadDriverPrivilege 5104 MSIEXEC.EXE Token: SeSystemProfilePrivilege 5104 MSIEXEC.EXE Token: SeSystemtimePrivilege 5104 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 5104 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 5104 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 5104 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 5104 MSIEXEC.EXE Token: SeBackupPrivilege 5104 MSIEXEC.EXE Token: SeRestorePrivilege 5104 MSIEXEC.EXE Token: SeShutdownPrivilege 5104 MSIEXEC.EXE Token: SeDebugPrivilege 5104 MSIEXEC.EXE Token: SeAuditPrivilege 5104 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 5104 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 5104 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 5104 MSIEXEC.EXE Token: SeUndockPrivilege 5104 MSIEXEC.EXE Token: SeSyncAgentPrivilege 5104 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 5104 MSIEXEC.EXE Token: SeManageVolumePrivilege 5104 MSIEXEC.EXE Token: SeImpersonatePrivilege 5104 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 5104 MSIEXEC.EXE Token: SeCreateTokenPrivilege 5104 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 5104 MSIEXEC.EXE Token: SeLockMemoryPrivilege 5104 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 5104 MSIEXEC.EXE Token: SeMachineAccountPrivilege 5104 MSIEXEC.EXE Token: SeTcbPrivilege 5104 MSIEXEC.EXE Token: SeSecurityPrivilege 5104 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 5104 MSIEXEC.EXE Token: SeLoadDriverPrivilege 5104 MSIEXEC.EXE Token: SeSystemProfilePrivilege 5104 MSIEXEC.EXE Token: SeSystemtimePrivilege 5104 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 5104 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 5104 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 5104 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 5104 MSIEXEC.EXE Token: SeBackupPrivilege 5104 MSIEXEC.EXE Token: SeRestorePrivilege 5104 MSIEXEC.EXE Token: SeShutdownPrivilege 5104 MSIEXEC.EXE Token: SeDebugPrivilege 5104 MSIEXEC.EXE Token: SeAuditPrivilege 5104 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 5104 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 5104 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 5104 MSIEXEC.EXE Token: SeUndockPrivilege 5104 MSIEXEC.EXE Token: SeSyncAgentPrivilege 5104 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 5104 MSIEXEC.EXE Token: SeManageVolumePrivilege 5104 MSIEXEC.EXE Token: SeImpersonatePrivilege 5104 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 5104 MSIEXEC.EXE Token: SeCreateTokenPrivilege 5104 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 5104 MSIEXEC.EXE Token: SeLockMemoryPrivilege 5104 MSIEXEC.EXE - Suspicious use of FindShellTrayWindow 49 IoCs
pid Process 5104 MSIEXEC.EXE 5104 MSIEXEC.EXE 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe - Suspicious use of SendNotifyMessage 47 IoCs
pid Process 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe 4316 taskmgr.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2096 wrote to memory of 4836 2096 Auto-Tune_Pro_v9.1.1_Windows.exe 86 PID 4836 wrote to memory of 5104 4836 Auto-Tune_Pro_v9.1.1_Windows.exe 91 PID 3368 wrote to memory of 2904 3368 msiexec.exe 95 PID 3368 wrote to memory of 2040 3368 msiexec.exe 111 PID 4836 wrote to memory of 1800 4836 Auto-Tune_Pro_v9.1.1_Windows.exe 115 PID 4836 wrote to memory of 1800 4836 Auto-Tune_Pro_v9.1.1_Windows.exe 115 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Auto-Tune_Pro_v9.1.1_Windows.exe"C:\Users\Admin\AppData\Local\Temp\Auto-Tune_Pro_v9.1.1_Windows.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\{F0BC72C0-D133-40C3-A9D4-8747D337B602}\Auto-Tune_Pro_v9.1.1_Windows.exeC:\Users\Admin\AppData\Local\Temp\{F0BC72C0-D133-40C3-A9D4-8747D337B602}\Auto-Tune_Pro_v9.1.1_Windows.exe /q"C:\Users\Admin\AppData\Local\Temp\Auto-Tune_Pro_v9.1.1_Windows.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{F0BC72C0-D133-40C3-A9D4-8747D337B602}" /IS_temp2⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\system32\MSIEXEC.EXE"C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Downloaded Installations\{8B71AE52-E0F6-4367-A7C3-A381C3482A25}\Antares Auto-Tune Pro.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="Auto-Tune_Pro_v9.1.1_Windows.exe"3⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5104
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\system32\explorer.exe3⤵
- System Location Discovery: System Language Discovery
PID:1800
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 52535B7EF29F2120849329037AE2599C C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2904
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2040
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1652
-
C:\Program Files\Antares Audio Technologies\Antares Central Services.exe"C:\Program Files\Antares Audio Technologies\Antares Central Services.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1796
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4316
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e598dff.rbs
- Size 29KB
- SHA256 e024f9fe50a9e8e082251e51507d5b12e235ed6b3bf5ab14604ac5ac86e833bc
- MD5 9e0ea4860dee48abd758ddcba8626071
- SHA1 7fe993107ff3d7de2a71634aaccbadba9137672a
- SHA512 2752ad1886cf1f0af189c5f89b5996ebf64833233e3cc3ecc9cd97cdc52a68120a7013349f80a304a53f56e59f11a1b6d4dddd61d6af91b58eed3408d5cf902f
- SSDEEP 768:hACVCTmAb50aj/q7dBvsb1KPdIUl1uEuNrQkJAWoOLw261WS6xtgtctAtAtAtAtp:aCVCTmAb50aj/q7dBvsb1KPdIUl1uEuB
- TLSH T1BDD2E082A7208387E44F5A38EE5B3F50377AC5EC5794C20B46DD9138CA937C85AFA54E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Antares Audio Technologies\Antares Central Services.exe
- Size 5.2MB
- SHA256 ecc230c627ce707466aaac1d402045bde487652a222db53fff17aa6192e058ab
- MD5 c4ccf1711e60f203877b3324de26e1f2
- SHA1 c62ff4234e1337a793f1109f88eca10c32a3f12d
- SHA512 de106db99de5632e61c3eee25a12efda620bdcb3f2b908050cc3045eb860a98d9f941b9dd5438c4716902d50f529910a67dec244b9812a29d0a3962614bbc19e
- SSDEEP 49152:vjqN6t9mSHEbxJD/C/TK1INbWF3rSZJKaFSTVv0LFkjV:vmNCHy3ZqzQDjV
- TLSH T17346E643166283A5C17D80B886DA557993317C098F904FDF23E8E2793EE34F1AE76768
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Antares Audio Technologies\WibuCm64.dll
- Size 988KB
- SHA256 cdbd2bcd42fa35873cdc6b50ca190828208c0cbad77072db2d316c6497b7b01b
- MD5 c2ab8f8ddaee70cc8cf1f0789ff89f11
- SHA1 4e40f8f01edd0db99c05f46935f40cdc90802f65
- SHA512 9cf9adc0933c525d5674b4f084cc56f406db0cf1a21d413d468538fd101a9ba8ee0a7f5aba1a77002421f0114b96aede00132e00963b9dddfb7a39bdec808cd5
- SSDEEP 24576:056qbjUPeG6SyESLgXM4cLO0EDJ8YB+uhhl:056qbQPz4Lg4L5EDJ8TI
- TLSH T1D7253B097BA885A4F0B2D239D9B28556F7B178559F358BCF0AA1434D2F33EE09939313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI8c1f3.LOG
- Size 102KB
- SHA256 660fe314122c6fc9478681f9df74e34c3b4d5292fb62dd4e6ba1aa8eda43b3f3
- MD5 eac36b0dbe00066ee6094b2d7f6b530f
- SHA1 210d9e0bb59788b2c4a2bfc4973825ab68f5a3f9
- SHA512 6ea66a26e89b367c24775f12ea9299031577ad7cacc4b62f111a013ec32ce9d7d46cc9d8d7a765cfed5b61f9a932baabb2a0b56c4ec7c4afdc8256c3edcaa04a
- SSDEEP 1536:4VNvlRF5gKwM7O/X4NvZRkZVi0w7gLoyKcL01XNHhZ08cIt9rLGTw2oWyhQg+gki:Sce3
- TLSH T183A35E352EF50059F3BBEA43EFF745119A33F9566931CD0D20C5824D04B2E09AAA97BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIC426.tmp
- Size 166KB
- SHA256 d4b028c81ed4d593240afad9db36565ffe2c26d4dc4edf025655dd1d338168eb
- MD5 791c89209ece2aaafff0cf28d42763aa
- SHA1 862c87e5920640c5c825d54740c15d0cc99e1120
- SHA512 0e5d037cdd0df3cf5caad2c9f973e57dd70512f9d382beb7ec39aca15aba5f43764b7b075c8a9bbfac3154d274469f18db9dd8f3dd9bc22e03b567873d552e7b
- SSDEEP 3072:jq3oP/44Yvge5XKhpKJJdu+ew+BZPHbNz8+nGq:jQg/ve5XKhMVJSRLn9
- TLSH T1A2F3281177E18034E5EF1A3A69749A264B7F7C72CB7489CBB384464E1D70AC1AE35B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{F0BC72C0-D133-40C3-A9D4-8747D337B602}\0x0409.ini
- Size 21KB
- SHA256 8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948
- MD5 a108f0030a2cda00405281014f897241
- SHA1 d112325fa45664272b08ef5e8ff8c85382ebb991
- SHA512 d83894b039316c38915a789920758664257680dcb549a9b740cf5361addbee4d4a96a3ff2999b5d8acfb1d9336da055ec20012d29a9f83ee5459f103fbeec298
- SSDEEP 384:CTmyuV//BiTbh/YgAwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/t/lWr0aa0Mhs+XVgv
- TLSH T1BBA2B95667F94219F6F77F50FDB812221E7ABC82AC38D25C1280499D09F1E84D8B1B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{F0BC72C0-D133-40C3-A9D4-8747D337B602}\Setup.INI
- Size 5KB
- SHA256 5739b1c2fbcac40d28f5754e49201d5eb70ac478c9f26aa049ec5b5f58fbd86d
- MD5 09d9a1227ff54e3528abf313a61a7d78
- SHA1 b6ad6f10ed0ef2541e7ef69cb6aeb12209aef28c
- SHA512 75e821e97cd40233c55f9c4fcb8fe1e08c25444950ebe67d1a0878549797cbfd65c1fb8a72e99b71b984a37686ace40a810f3fea131a6ddce11c70fe2d92d36c
- SSDEEP 96:rEhkMaERYcqIbC5rON/XsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05w7tCYOvlG:YhcblkcuQaEZhdxoIWRGcQbPr/p0050d
- TLSH T13CB18B1B2BF6001EF6F36B44DAF0443787273C12282CD95C55D0875A28F2D828A67BEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{F0BC72C0-D133-40C3-A9D4-8747D337B602}\_ISMSIDEL.INI
- Size 488B
- SHA256 c909fa0edd841f43f9619d8f6569ab4a27901a1e65f20900723b401915ba4653
- MD5 1877c24ce0c6a865ced37707e5ad5e2a
- SHA1 d872d77f430d673446b5e8c6420de8dd77f60fb2
- SHA512 59648651cbf184bbcff70d631ea1b58d22134b75a0da90f345cbd72752273e8110342720d15570ea18061ba6a7d40b92d99aea5aae3b399a9c19da5b6c3db1fb
- TLSH T182F0A03974FD0222B37BE58567F5126612BAF8F388068E0F0085CA0D0D90D218AA1F1A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{F0BC72C0-D133-40C3-A9D4-8747D337B602}\_ISMSIDEL.INI
- Size 740B
- SHA256 88adaf6b4cf5742280b5ef327bc699c375946794cd2772474aebe209ea535fe9
- MD5 39434b3127a0adc27095463e774b6196
- SHA1 ed84651731e3c2231c8b9fd918afe9d104de8628
- SHA512 43dbf9d1e11e4b4e415abe4aa65f9820b38bb91eeccf93b7fede3a7a40e43903cc5213055eb8481a4eb852d237483e60999fcf84d2bcb79524ec435720f13d57
- TLSH T17D01AD3974FD1223B3BBFA8567F1166612BAB8B3CD169D0F0084CA0D0DA1D6086A1F17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{F0BC72C0-D133-40C3-A9D4-8747D337B602}\_ISMSIDEL.INI
- Size 20B
- SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
- MD5 db9af7503f195df96593ac42d5519075
- SHA1 1b487531bad10f77750b8a50aca48593379e5f56
- SHA512 6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b
- MD5 SHA1 SHA512
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 3b56b5dd67ca6b926d20418ca3d80674c3dc29b38f8f7c931403ce022049e8db
- MD5 affa5b6ead305afbb678e213162ec88a
- SHA1 652401d4268aa837a0b0114cbe3effc1a0fc7795
- SHA512 a38a80951656c3fba0c01572af760bd652665ca67070b0dbfce4763502a7c717012ea44f9271ac9a65f21449c88cb90a081b9c6e7a8e73906aa1293dc2b279da
- SSDEEP 24576:du8m+1zHdoO/vvTLbWzuGWKHiakzLlzi/FW9R8iF7kaiu0qOIPlqr1YRG:d
- TLSH T13947D42832F92210E7F79F3C68F0AA2749397D579C19DE8D45411F4E0921BB1E8B2F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{73216430-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{cb66855c-14d4-4c74-b4e3-9b86b573cd0f}_OnDiskSnapshotProp
- Size 6KB
- SHA256 5be8e35677eec58b2722f0a8bd24657fe6a43a832d9d998a4db60d5bb9741a05
- MD5 5e15a9844021ba1585e957eda30e0176
- SHA1 451732f916a69cb5173a87e39a53275f3e127477
- SHA512 997a8cc885cc3beee3abc1a18dbed973e3ce3b35724d4f1b15ff539baac35eda3b6af70434fc57952cffc6a38be8eb08b21f96b7930234bf6b303a8a5eacd40c
- SSDEEP 96:Ft/Lhdiyvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:T9wIb++ZVm
- TLSH T1A9D178185AF54311E2B3AB7129F14557A877B911EF33CB8E0298238E6670910F875F6F
- MD5 SHA1 SHA512 SSDEEP TLSH