Analysis
- user interaction
yes - max time kernel
150s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
01/07/2026, 02:20
General
- Target LunarPatcher_Setup_v7 (1).exe
- Size 58.3MB
- Sample260701-csp5kaev5t
- SHA256 9a219c34a00fe0aaa06d3533558a29b573a8bf6bfcd0b0092ac011634057bea5
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Drops file in Drivers directory 2 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 8 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence 1 TTPs 4 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 35 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 54 IoCs
- Suspicious use of SendNotifyMessage 50 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 27 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\LunarPatcher_Setup_v7 (1).exe"C:\Users\Admin\AppData\Local\Temp\LunarPatcher_Setup_v7 (1).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-XF8L0G3KV0.tmp\LunarPatcher_Setup_v7 (1).tmp"C:\Users\Admin\AppData\Local\Temp\is-XF8L0G3KV0.tmp\LunarPatcher_Setup_v7 (1).tmp" /SL5="$60252,59249693,990720,C:\Users\Admin\AppData\Local\Temp\LunarPatcher_Setup_v7 (1).exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe"C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /Delete /TN "LunarPatcherAutoRefresh" /F4⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "LunarPatcherAutoRefresh" /F5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /Create /SC ONLOGON /TN "LunarPatcherAutoRefresh" /TR "\"C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe\" /refresh" /F /RL HIGHEST /DELAY 0001:004⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /SC ONLOGON /TN "LunarPatcherAutoRefresh" /TR "\"C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe\" /refresh" /F /RL HIGHEST /DELAY 0001:005⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /Create /TN "LunarPatcherAutoRefresh" /XML "C:\Users\Admin\AppData\Local\Temp\lunarpatcher_task.xml" /F4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN "LunarPatcherAutoRefresh" /XML "C:\Users\Admin\AppData\Local\Temp\lunarpatcher_task.xml" /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /Delete /TN "LunarPatcherAutoRefresh" /F4⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "LunarPatcherAutoRefresh" /F5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /Create /SC ONLOGON /TN "LunarPatcherAutoRefresh" /TR "\"C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe\" /refresh" /F /RL HIGHEST /DELAY 0001:004⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /SC ONLOGON /TN "LunarPatcherAutoRefresh" /TR "\"C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe\" /refresh" /F /RL HIGHEST /DELAY 0001:005⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /Create /TN "LunarPatcherAutoRefresh" /XML "C:\Users\Admin\AppData\Local\Temp\lunarpatcher_task.xml" /F4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN "LunarPatcherAutoRefresh" /XML "C:\Users\Admin\AppData\Local\Temp\lunarpatcher_task.xml" /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe"C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe"1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"cmd.exe" /c schtasks /Delete /TN "LunarPatcherAutoRefresh" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /Delete /TN "LunarPatcherAutoRefresh" /F3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c schtasks /Create /SC ONLOGON /TN "LunarPatcherAutoRefresh" /TR "\"C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe\" /refresh" /F /RL HIGHEST /DELAY 0001:002⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /Create /SC ONLOGON /TN "LunarPatcherAutoRefresh" /TR "\"C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe\" /refresh" /F /RL HIGHEST /DELAY 0001:003⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c schtasks /Create /TN "LunarPatcherAutoRefresh" /XML "C:\Users\Admin\AppData\Local\Temp\lunarpatcher_task.xml" /F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /Create /TN "LunarPatcherAutoRefresh" /XML "C:\Users\Admin\AppData\Local\Temp\lunarpatcher_task.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c schtasks /Delete /TN "LunarPatcherAutoRefresh" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /Delete /TN "LunarPatcherAutoRefresh" /F3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c schtasks /Create /SC ONLOGON /TN "LunarPatcherAutoRefresh" /TR "\"C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe\" /refresh" /F /RL HIGHEST /DELAY 0001:002⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /Create /SC ONLOGON /TN "LunarPatcherAutoRefresh" /TR "\"C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe\" /refresh" /F /RL HIGHEST /DELAY 0001:003⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c schtasks /Create /TN "LunarPatcherAutoRefresh" /XML "C:\Users\Admin\AppData\Local\Temp\lunarpatcher_task.xml" /F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /Create /TN "LunarPatcherAutoRefresh" /XML "C:\Users\Admin\AppData\Local\Temp\lunarpatcher_task.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
patcher_profiles.json
patcher_profiles.json
patcher_state.json
mods.json
accounts.json
launcher.json
prep_Activatable Class_Hermes_perf.cache
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
vcruntime140_cor3.dll
wpfgfx_cor3.dll
LunarPatcher_Setup_v7 (1).tmp
lunarpatcher_task.xml
lunarpatcher_task.xml
lunarpatcher_task.xml
hosts
memory/1404-628-0x000001B9A2020000-0x000001B9A2030000-memory.dmp
memory/1404-651-0x000001B9A3B90000-0x000001B9A3BC0000-memory.dmp
memory/1404-638-0x000001B9A2070000-0x000001B9A20F0000-memory.dmp
memory/1404-642-0x000001B9A3B50000-0x000001B9A3B70000-memory.dmp
memory/1824-678-0x000000000F970000-0x00000000101EB000-memory.dmp
memory/1824-627-0x000000000F970000-0x00000000101EB000-memory.dmp
memory/2040-10-0x00000000014D0000-0x00000000014D1000-memory.dmp
memory/2040-12-0x0000000000840000-0x0000000000C9B000-memory.dmp
memory/2040-23-0x0000000000840000-0x0000000000C9B000-memory.dmp
memory/2040-6-0x00000000014D0000-0x00000000014D1000-memory.dmp
memory/2040-116-0x0000000000840000-0x0000000000C9B000-memory.dmp
memory/2040-9-0x0000000000840000-0x0000000000C9B000-memory.dmp
memory/2072-8-0x0000000000E00000-0x0000000000F00000-memory.dmp
memory/2072-121-0x0000000000E00000-0x0000000000F00000-memory.dmp
memory/2072-0-0x0000000000E00000-0x0000000000F00000-memory.dmp
memory/2852-450-0x0000020801FB0000-0x0000020801FD0000-memory.dmp
memory/2852-469-0x0000020804210000-0x0000020804230000-memory.dmp
memory/2852-484-0x0000020814820000-0x0000020814840000-memory.dmp
memory/2852-451-0x00000208143F0000-0x00000208144F0000-memory.dmp
memory/2852-440-0x00000208001E0000-0x00000208002E0000-memory.dmp
memory/4684-65-0x000002932BB50000-0x000002932C340000-memory.dmp
memory/4684-142-0x000002932E6B0000-0x000002932E770000-memory.dmp
memory/4684-166-0x00000293306B0000-0x00000293306F0000-memory.dmp
memory/4684-174-0x0000029330C60000-0x0000029330D00000-memory.dmp
memory/4684-178-0x0000029331090000-0x0000029331300000-memory.dmp
memory/4684-170-0x0000029330B30000-0x0000029330BB0000-memory.dmp
memory/4684-186-0x00000293305B0000-0x00000293305C0000-memory.dmp
memory/4684-154-0x0000029330540000-0x0000029330560000-memory.dmp
memory/4684-150-0x00000293304D0000-0x0000029330520000-memory.dmp
memory/4684-182-0x00000293306F0000-0x0000029330750000-memory.dmp
memory/4684-162-0x0000029330900000-0x0000029330AB0000-memory.dmp
memory/4684-138-0x000002932E540000-0x000002932E560000-memory.dmp
memory/4684-199-0x0000029330DB0000-0x0000029330E20000-memory.dmp
memory/4684-195-0x00000293316F0000-0x00000293317A0000-memory.dmp
memory/4684-203-0x0000029330D70000-0x0000029330D80000-memory.dmp
memory/4684-207-0x0000029331AC0000-0x0000029331C90000-memory.dmp
memory/4684-211-0x0000029331820000-0x0000029331840000-memory.dmp
memory/4684-215-0x00000293318A0000-0x00000293318D0000-memory.dmp
memory/4684-146-0x000002932E5C0000-0x000002932E5E0000-memory.dmp
memory/4684-219-0x0000029331EB0000-0x0000029332010000-memory.dmp
memory/4684-130-0x000002932E480000-0x000002932E4A0000-memory.dmp
memory/4684-126-0x000002932E4D0000-0x000002932E500000-memory.dmp
memory/4684-386-0x0000029334120000-0x0000029334130000-memory.dmp
memory/4684-158-0x0000029330620000-0x0000029330670000-memory.dmp
memory/4684-134-0x000002932E520000-0x000002932E530000-memory.dmp
memory/4684-122-0x000002932E450000-0x000002932E480000-memory.dmp
memory/4684-117-0x000002932EEE0000-0x000002932F650000-memory.dmp
memory/4684-110-0x000002932E2C0000-0x000002932E3C0000-memory.dmp
memory/4684-112-0x000002932E140000-0x000002932E190000-memory.dmp
memory/4684-69-0x0000028B121D0000-0x0000028B121F0000-memory.dmp
memory/4684-45-0x0000029326A00000-0x0000029326C20000-memory.dmp
memory/4684-49-0x0000029328F30000-0x0000029329090000-memory.dmp
memory/4684-57-0x0000028B13B80000-0x0000028B13BC0000-memory.dmp
memory/4684-77-0x0000028B121B0000-0x0000028B121C0000-memory.dmp
memory/4684-81-0x0000029328D30000-0x0000029328D50000-memory.dmp
memory/4684-85-0x0000029329180000-0x00000293291A0000-memory.dmp
memory/4684-89-0x000002932B290000-0x000002932B2B0000-memory.dmp
memory/4684-93-0x000002932B2F0000-0x000002932B310000-memory.dmp
memory/4684-97-0x000002932B310000-0x000002932B340000-memory.dmp
memory/4684-101-0x000002932B340000-0x000002932B360000-memory.dmp
memory/4684-73-0x000002932AFF0000-0x000002932B070000-memory.dmp
memory/4684-61-0x0000029329090000-0x00000293290E0000-memory.dmp
memory/4684-53-0x0000028B13AD0000-0x0000028B13B20000-memory.dmp
memory/4684-41-0x000002932A0D0000-0x000002932AFF0000-memory.dmp
memory/4684-37-0x0000029327BB0000-0x0000029328B00000-memory.dmp