Resubmissions

01/11/2026, 22:13

261101-148caazz6p7

01/11/2026, 22:09

261101-129gkazz4m7

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/11/2026, 22:13

General

  • Target
    HRTFinator-1.0.1-windows-x64-setup.exe
  • Size 20.2MB
  • Sample261101-148caazz6p
  • SHA256 bbb9c4f95f23d510d1c033936abb2b62e2e01571671604b29ff04110aa75aa43
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HRTFinator-1.0.1-windows-x64-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\HRTFinator-1.0.1-windows-x64-setup.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4580
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\HRTFinator\logs\install.log
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:248
    • C:\Users\Admin\AppData\Local\Apps\HRTFinator\HRTFinator.exe
      "C:\Users\Admin\AppData\Local\Apps\HRTFinator\HRTFinator.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1676
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2136
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:2232

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5921ba.rbs

          • Path C:\Config.Msi\e5921ba.rbs
          • Size 14KB
          • SHA256 56349aec6ded7ee23fea2348e497d55f42f57a265ef7556aebabadafdffa951b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          HRTFinator.exe

          • Path C:\Users\Admin\AppData\Local\Apps\HRTFinator\HRTFinator.exe
          • Size 18.5MB
          • SHA256 d79737d541f8ea53da93f76a3d2f7a92d3e4dabfd815c0aa88ea88408c220c38
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bootstrap.json

          • Path C:\Users\Admin\AppData\Local\Apps\HRTFinator\assets\content\bootstrap.json
          • Size 225KB
          • SHA256 7bdb066b84549b155b7c0c55dc1956b7b9f342f5369332130451c8f811caef95
          • MD5 SHA1 SHA512 SSDEEP TLSH

          k9's Magic Sauce 1.0.wav

          • Path C:\Users\Admin\AppData\Local\Apps\HRTFinator\assets\convolution\k9's Magic Sauce 1.0.wav
          • Size 748KB
          • SHA256 0c08c38bcfdf976c15644fd2db02f9e892472197160b1306e289f491eb018aaa
          • MD5 SHA1 SHA512 SSDEEP TLSH

          CascadiaCode.ttf

          • Path C:\Users\Admin\AppData\Local\Apps\HRTFinator\assets\fonts\CascadiaCode.ttf
          • Size 378KB
          • SHA256 cfb6a8d474018fe46d53a427e5fbee44b998822d0d3d8772914bd712cfc55ac4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          NotoSans-Black.ttf

          • Path C:\Users\Admin\AppData\Local\Apps\HRTFinator\assets\fonts\NotoSans-Black.ttf
          • Size 615KB
          • SHA256 18ee64cb5a5a842f036857f771e3a35ba9708a6d13b047d573ead088682083b9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          NotoSans-Bold.ttf

          • Path C:\Users\Admin\AppData\Local\Apps\HRTFinator\assets\fonts\NotoSans-Bold.ttf
          • Size 616KB
          • SHA256 13a813c49624ae3ba3c5c6e72c5ebffc4b9e1e6ea32f421c04069b037c6ad431
          • MD5 SHA1 SHA512 SSDEEP TLSH

          NotoSans-SemiBold.ttf

          • Path C:\Users\Admin\AppData\Local\Apps\HRTFinator\assets\fonts\NotoSans-SemiBold.ttf
          • Size 616KB
          • SHA256 e691fe27813ec6ed11d0a5be4c6c1f6739996ed682462eaa3244a6185217dd6c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          NotoSans-VariableFont_wdth,wght.ttf

          • Path C:\Users\Admin\AppData\Local\Apps\HRTFinator\assets\fonts\NotoSans-VariableFont_wdth,wght.ttf
          • Size 1.9MB
          • SHA256 7b8cac46a1c86d2533a616b1fcf4e1926b8e39bda69034508b0df96791f56d97
          • MD5 SHA1 SHA512 SSDEEP TLSH

          LICENSE.txt

          • Path C:\Users\Admin\AppData\Local\Apps\HRTFinator\assets\sofa\LICENSE.txt
          • Size 11KB
          • SHA256 3ddf9be5c28fe27dad143a5dc76eea25222ad1dd68934a047064e56ed2fa40c5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          NOTICE.md

          • Path C:\Users\Admin\AppData\Local\Apps\HRTFinator\assets\sofa\NOTICE.md
          • Size 1KB
          • SHA256 2bd6dc80c6b06d5f9670948950ecf82102868b0f3c189b7d76d156aa0c9cd4f5
          • MD5 SHA1 SHA512 TLSH

          SADIE_KEMAR_DFC_256_order_fir_48000.sofa

          • Path C:\Users\Admin\AppData\Local\Apps\HRTFinator\assets\sofa\SADIE_KEMAR_DFC_256_order_fir_48000.sofa
          • Size 11.9MB
          • SHA256 6f4976384ca6ae42b77b305f42ad5669d6d2fe66ca5d7d752390bc34381ccd88
          • MD5 SHA1 SHA512 SSDEEP TLSH

          SADIE_KU100_DFC_256_order_fir_48000.sofa

          • Path C:\Users\Admin\AppData\Local\Apps\HRTFinator\assets\sofa\SADIE_KU100_DFC_256_order_fir_48000.sofa
          • Size 11.9MB
          • SHA256 6822b4318ce80ab6b8421a4b55b1edcedde1b276426aa5416526a57cccbe7e58
          • MD5 SHA1 SHA512 SSDEEP TLSH

          install.log

          • Path C:\Users\Admin\AppData\Local\HRTFinator\logs\install.log
          • Size 1KB
          • SHA256 4d7264daa51109b4b0ab017e0c15c9348a04f18e558d2e68bb2fa6f9d2039be9
          • MD5 SHA1 SHA512 TLSH

          install.log

          • Path C:\Users\Admin\AppData\Local\HRTFinator\logs\install.log
          • Size 161KB
          • SHA256 5d61ebcdbd0fc158af4309d9cdb494426c2b62d4cd9cdfb3ba2caffa2537f128
          • MD5 SHA1 SHA512 SSDEEP TLSH

          storage-locations.json

          • Path C:\Users\Admin\AppData\Local\HRTFinator\storage-locations.json
          • Size 240B
          • SHA256 2741a639f95ecfea2ec09f0061eb7a1d99f044954270e8ae7b6b396bad0794ad
          • MD5 SHA1 SHA512 TLSH

          calibration-state.json.tmp

          • Path C:\Users\Admin\AppData\Local\HRTFinator\updates\calibration-state.json.tmp
          • Size 24B
          • SHA256 f54234f455dfd1683099256a10fcbb6b56e4de44ddb12fc678f63fbdc3084909
          • MD5 SHA1 SHA512

          published-targets.json

          • Path C:\Users\Admin\AppData\Local\HRTFinator\updates\published-targets.json
          • Size 54KB
          • SHA256 8bcfd395ed779699217bb4a99221e1df59e7b96c27e732836bcc2e061ce05647
          • MD5 SHA1 SHA512 SSDEEP TLSH

          HRTFinator-1.0.1-x64.msi

          • Path C:\Users\Admin\AppData\Local\Temp\HRTFinator-setup-4580\HRTFinator-1.0.1-x64.msi
          • Size 19.9MB
          • SHA256 d38fdfb21ad76de00349b08310d754f50a09b09f9972ae6fbb26b9f52c77c2e0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          snapshot.json

          • Path C:\Users\Admin\Documents\HRTFinator\Equalizer\General\snapshot.json
          • Size 2KB
          • SHA256 92ca1b876bcfb69f9897ab1d904a6990817d5ec1f8fe49af1baa5883976a56fc
          • MD5 SHA1 SHA512 TLSH

          auto_eq.json

          • Path C:\Users\Admin\Documents\HRTFinator\Equalizer\Settings\auto_eq.json
          • Size 346B
          • SHA256 a47bb7b9be92bd0fb07bb06540a6a2dfdd7d6285b2566842079ae855d636b087
          • MD5 SHA1 SHA512 TLSH

          targets.json

          • Path C:\Users\Admin\Documents\HRTFinator\Equalizer\Targets\targets.json
          • Size 409B
          • SHA256 c94b45ca7506d8b05396bcc299b3d0c1f8847404a84ca4a34b42421a4a48b53b
          • MD5 SHA1 SHA512 TLSH

          library.json

          • Path C:\Users\Admin\Documents\HRTFinator\Measurements\General\library.json
          • Size 42B
          • SHA256 7706aaeefbd9b1f8f5b4e9721ea81859b08413fbb9e646576f13bc68d786e0bb
          • MD5 SHA1 SHA512

          published-calibration.json

          • Path C:\Users\Admin\Documents\HRTFinator\Measurements\General\published-calibration.json
          • Size 762KB
          • SHA256 915e20941db085999aa469946c6ae3e383935bbd4051b3c76cc8c31f6bc7ba41
          • MD5 SHA1 SHA512 SSDEEP TLSH

          .bundled-sofa-receipts.json

          • Path C:\Users\Admin\Documents\HRTFinator\SOFA measurements\.bundled-sofa-receipts.json
          • Size 97B
          • SHA256 d1c8d5bae58aec33da7d3b0c4693915d4afbf449a570f7aae9e6a85a56821fec
          • MD5 SHA1 SHA512 TLSH

          .bundled-sofa-receipts.json

          • Path C:\Users\Admin\Documents\HRTFinator\SOFA measurements\.bundled-sofa-receipts.json
          • Size 155B
          • SHA256 b6757a3dfec48e51aa75caefe8f58b3ad91a1d40a4993854937b6c4ec9ca8bf2
          • MD5 SHA1 SHA512 TLSH

          app_settings.json

          • Path C:\Users\Admin\Documents\HRTFinator\Settings\app_settings.json
          • Size 142B
          • SHA256 b6198c053294e797b0e9cce6ec10bacc4847b53fcda77e4d4f00938f0efc222f
          • MD5 SHA1 SHA512 TLSH

          .bundled-convolution-receipts.json

          • Path C:\Users\Admin\Documents\HRTFinator\System EQ\Convolution responses\.bundled-convolution-receipts.json
          • Size 81B
          • SHA256 a082895960f6cbfdeabe5b0a3fbaffc20f51017f195620a4ee8edfcf582a7772
          • MD5 SHA1 SHA512 TLSH

          config.json

          • Path C:\Users\Admin\Documents\HRTFinator\System EQ\General\config.json
          • Size 1KB
          • SHA256 8281e504c6c481c0d4e92502f583073aba52aa09ea458ec528ecae5065a83e6b
          • MD5 SHA1 SHA512 TLSH

          .managed-defaults.json

          • Path C:\Users\Admin\Documents\HRTFinator\Themes\.managed-defaults.json
          • Size 112B
          • SHA256 af446eb3b05199119c801f33e6a40d735a9b04647b187e2d967085619509128c
          • MD5 SHA1 SHA512 TLSH

          Main_theme.json

          • Path C:\Users\Admin\Documents\HRTFinator\Themes\Main_theme.json
          • Size 7KB
          • SHA256 a14e9ed7bead3ce7f9b24a5c51ff604988a7515e0e130527eee7749495388c2e
          • MD5 SHA1 SHA512 SSDEEP TLSH