Analysis
- user interaction
yes - max time kernel
153s - max time network
252s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 19:22
Behavioral task
behavioral1
Sample
BorisFX.Sapphire.AE.2026.51.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
BorisFX.Sapphire.AE.2026.51.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
BorisFX Sapphire AE 2026.51.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target BorisFX.Sapphire.AE.2026.51.rar
- Size 1519.9MB
- Sample260803-x3pl1aee88
- SHA256 741cb6fd12676b988b6ee3d48f9f230ca34a6d075a16abb2021343c3a7c783b9
- MD5 e69fc3bb18b6989bae3474d0c5c0c61e
- SHA1 a1ebc4d94d117086ce5c2abb9c66c7060ca857c0
- SHA512 c08dee2cf9912c380cbfab1e2c755fa7a5c6ecc8f2f70dc9e478fa4770f6f5f202560109ebe6b86bcdf7a379a3cfa444a467c821418377ed4270032c9e81fb59
- SSDEEP 25165824:22rY4E5lId1iHgQE5aeSCpYJyyHGlvU+0QqMdWEkU9c6F6jrRTgYcsteeMgOsD0B:2mslImHEPpYyTlv+9Ek6c9jrl2eTOsD0
- TLSH T13FF9331BE01FE43ECE805A71815A976C7E6C7D82F7018F2B96F977158E022994F2B0B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 5296 BorisFX Sapphire AE 2026.51.exe 1704 BorisFX Sapphire AE 2026.51.tmp - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\Sapphire Plug-ins\Sapphire Time\is-N83S1.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\Sapphire Plug-ins\Sapphire Time\is-BM2S7.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-I783G.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-0CTNC.tmp BorisFX Sapphire AE 2026.51.tmp File opened for modification C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\pylib\Lib\site-packages\PyQt5\Qt\plugins\platforms\qwindows.dll BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\Sapphire Plug-ins\Sapphire Transitions\is-MLDV2.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-77ASF.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-NV9O3.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-LPM5S.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\luts\is-2NE8T.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-LO50O.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-2I19G.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-O1U8B.tmp BorisFX Sapphire AE 2026.51.tmp File opened for modification C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\mocha-wrapper.exe BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-INHNV.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-JEN5N.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-DVUOC.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\qt\is-E1NR4.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\luts\is-T2VJ0.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\luts\is-CNEH6.tmp BorisFX Sapphire AE 2026.51.tmp File opened for modification C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\pylib\python3.dll BorisFX Sapphire AE 2026.51.tmp File opened for modification C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\update-check\update-check.exe BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\Sapphire Plug-ins\Sapphire Adjust\is-CMNIU.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\Sapphire Plug-ins\Sapphire Transitions\is-EIHOI.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-AISNT.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-P71BT.tmp BorisFX Sapphire AE 2026.51.tmp File opened for modification C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\bin\is.dll BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\bin\is-CI1RM.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\bin\is-LM9KF.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-9HS8J.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-F3QGA.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\BorisFX.Sapphire.bfxdirect.em64t\is-DPCUI.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\pylib\Lib\site-packages\PyQt5\Qt\plugins\imageformats\is-USDDF.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\Sapphire Plug-ins\Sapphire Blur+Sharpen\is-99M0I.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-3O25I.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-728SF.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\qt\is-GL8U8.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\luts\is-CHG93.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\Sapphire Plug-ins\Sapphire Blur+Sharpen\is-N55J2.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\Sapphire Plug-ins\Sapphire Stylize\is-SN799.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-GH5EF.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-DQPHK.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-VJTIL.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\bin\ML\is-MG8V8.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\bin\is-M4OO0.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\Sapphire Plug-ins\Sapphire Stylize\is-7Q1FU.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-A47UJ.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-N73BH.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-89Q5J.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-94LJ2.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\Sapphire Plug-ins\Sapphire Blur+Sharpen\is-Q9GK8.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-SH8LD.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\Sapphire Plug-ins\Sapphire Transitions\is-Q3QJG.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\Sapphire Plug-ins\Sapphire Stylize\is-Q4TS5.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\Sapphire Plug-ins\Sapphire Lighting\is-706V9.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-LVI5P.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\bin\is-SC399.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-KIK1I.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-VMSSI.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-MA6PK.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\Sapphire Plug-ins\Sapphire Time\is-EHTRM.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\is-1NB9D.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-IBSQM.tmp BorisFX Sapphire AE 2026.51.tmp File created C:\Program Files\BorisFX\Sapphire 2026.5 Adobe\lib64\Mocha Sapphire.app\resources\ML\models\imgcvt\is-QDFHM.tmp BorisFX Sapphire AE 2026.51.tmp - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BorisFX Sapphire AE 2026.51.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BorisFX Sapphire AE 2026.51.tmp - Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/5296-3-0x0000000000400000-0x00000000004F2000-memory.dmp innosetup behavioral2/memory/5296-11-0x0000000000400000-0x00000000004F2000-memory.dmp innosetup - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1704 BorisFX Sapphire AE 2026.51.tmp 1704 BorisFX Sapphire AE 2026.51.tmp - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3132 7zFM.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 3132 7zFM.exe Token: 35 3132 7zFM.exe Token: SeSecurityPrivilege 3132 7zFM.exe Token: SeSecurityPrivilege 3132 7zFM.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3132 7zFM.exe 3132 7zFM.exe 1704 BorisFX Sapphire AE 2026.51.tmp 3132 7zFM.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5296 wrote to memory of 1704 5296 BorisFX Sapphire AE 2026.51.exe 92
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\BorisFX.Sapphire.AE.2026.51.rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3132
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:6088
-
C:\Users\Admin\Desktop\BorisFX Sapphire AE 2026.51.exe"C:\Users\Admin\Desktop\BorisFX Sapphire AE 2026.51.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Users\Admin\AppData\Local\Temp\is-EFIM3.tmp\BorisFX Sapphire AE 2026.51.tmp"C:\Users\Admin\AppData\Local\Temp\is-EFIM3.tmp\BorisFX Sapphire AE 2026.51.tmp" /SL5="$7007E,1575890003,934400,C:\Users\Admin\Desktop\BorisFX Sapphire AE 2026.51.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1704
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\is-EFIM3.tmp\BorisFX Sapphire AE 2026.51.tmp
- Size 3.6MB
- SHA256 ade6d6a1c9df44a28a7bdf1af27afe28d8b7c22597476c8a57c5b5c5b4f5346f
- MD5 7e6580e36446f765c3180c727f67645a
- SHA1 28fd08c0b90c2547451930ce4f4def2fe4d55b9e
- SHA512 7c5058bd67cc6b85517a321b426affec5a4bed850cde367aa740ae5232771b89d61cf9fa10ff2d17a791ea30868fa4c8485b50ee5774e3edd9683d98d838d084
- SSDEEP 49152:RviYUtaivJlWSM0WXo7FhDGS6Yh2ewYAJpg7xmUzWc8UecQ3/fmmowkTOR333u:ugoDyS6Oy/+O333u
- TLSH T1EF065B13F244613BC35F1E35543B8694A937BB61692A8CA36BF8BD4C4F750402E3BB96
- MD5 SHA1 SHA512 SSDEEP TLSH