Analysis
- max time kernel
73s - max time network
121s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 08:22
Behavioral task
behavioral1
Sample
1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe
- Size 1.4MB
- Sample260910-j93kjstsb1
- SHA256 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991
- MD5 4858e708b13002b8073327c5526f6024
- SHA1 b1a4d902a638e849d8a41749ccd70c6a9c00981d
- SHA512 60b6fa7afc62b8fc1221a170d5525fc7bac1c21bdf6725a41f737cb6dda252497e47d851e3413f227aa3c3eddb8acd8c00ab6668d940b218cf5ea7e4083058aa
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiak0Le5ji0hmxNrM:A3kMjKJsPji0Aj
- TLSH T14A657B17F6A402B5E077C174C9E2965AEB7138921B308ACF1399C7292F237D19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x000700000002454a-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b88-12.dat aspack_v212_v242 behavioral1/files/0x00030000000202b6-452.dat aspack_v212_v242 behavioral1/files/0x00040000000212e9-758.dat aspack_v212_v242 behavioral1/files/0x00030000000216f6-1284.dat aspack_v212_v242 behavioral1/files/0x0002000000023104-1763.dat aspack_v212_v242 behavioral1/files/0x0004000000022fe7-1875.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1988 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 404 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe 1988 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe"C:\Users\Admin\AppData\Local\Temp\1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:404
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1988
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.4MB
- SHA256 1c485bc2949ae84acf07d275e9d0d13b624ca5db94fd629532df98a96a2a0991
- MD5 4858e708b13002b8073327c5526f6024
- SHA1 b1a4d902a638e849d8a41749ccd70c6a9c00981d
- SHA512 60b6fa7afc62b8fc1221a170d5525fc7bac1c21bdf6725a41f737cb6dda252497e47d851e3413f227aa3c3eddb8acd8c00ab6668d940b218cf5ea7e4083058aa
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiak0Le5ji0hmxNrM:A3kMjKJsPji0Aj
- TLSH T14A657B17F6A402B5E077C174C9E2965AEB7138921B308ACF1399C7292F237D19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe
- Size 1.5MB
- SHA256 05738aff1184e8974bc038440f7e593d9a6175a3fc5476899d2ea8b0ac9e63e7
- MD5 5e49fb0238a0c7a77ac1475ded4be665
- SHA1 74e0a856a7223b83024382fe5eac728997329ee6
- SHA512 10180d0954be1f71abd756cea0b3c2db86c64f0233195fefc7bcfa8e32c8b8563f81f1ddaee3fbbc1c6fab99d45ef35c67ad707b19f3dbdc7f7353bf157dad03
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiak0Le5ji0hmxNrMdTjE:A3kMjKJsPji0Ajow
- TLSH T110757C17F6A402B5E077C178C9E2965AEB7178521B308ACF1398C7292F237D19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{51A7B87B-57A4-493D-87A7-45DD03C49092}\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 1.5MB
- SHA256 fcc0e608ecacdbd041e9b5a1a85f0fb942e8fba6f764de969065e9577f10b543
- MD5 795f7080f0b7314946c9f2f857d59924
- SHA1 7c6befa3815685e993239de0ae9ec8696cff6e97
- SHA512 611ddcba85518cd92a9084df1dbd1f68b61758b11b2cfad189b743bb562595b101aed3722dff5f46c0775e662e6327fc20aecc8950a4f0a263e7648808bd3b48
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiak0Le5ji0hmxNrMZbBPzBAU:A3kMjKJsPji0Aj+BPVAU
- TLSH T181757C17F6A442B5E073C174C9E29A5AEB7178521B308ACF1398C7292F237D19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 a33359ba13f286333e3ea1541f8a6b0483baef570d5a899385dc4a16aeea8d41
- MD5 57ca1d733671e82c87bbbcf724820640
- SHA1 af956fcb451f9a9c8a1a159e0fa9bc3d00308c25
- SHA512 a98d422ab136288b6b2ed27fa9299991f21da3bb02d715c1cafe2f9888f3f1d60716e7c99f74e0b5c716871040b0b5db8c7e13f5ee592fed454bc106736dd3a5
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiak0Le5ji0hmxNrMD0Le5ji0hmxNrM:A3kMjKJsPji0AjKPji0Aj
- TLSH T1A2956B16F6B44375D073C1B9C5E2A69AEA7134821B308ACB1395C7783F277D29A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 1.4MB
- SHA256 3df54dbdb6f5f1caba1cbbfe59c5feafca04d76c61e67bfe9af3561f3cf32635
- MD5 36aa7f3a0358fc0fcd45b366322eebfd
- SHA1 c2a6f56f4be147b2fd9d51645bb6360bb979f237
- SHA512 b8cc57f5be8b92b365cf5f52f5d67064ca7186bc048ebb25c9dce2016ef2bd5a1c78e1b4bdb32aa0c6bc25f80ca92006e15b6053c4978adcd2f5547b80ec3027
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiak0Le5ji0hmxNrMIL:A3kMjKJsPji0AjH
- TLSH T12E657B17F6A402B5E077C174C9E2965AEB7138921B308ACF1399C7292F237D19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
- Size 1.5MB
- SHA256 030c2b336de9155ace996840cd5f8f9e22e1d0ef4a843257a15d353c78398cfd
- MD5 098aaa89e73368594066ad6c9ca902ee
- SHA1 ca98df5586018f915f8efc8cbcb74a851a5fc580
- SHA512 384956c2c445358b15fa0c3782abcdd850fc8c725e3a2d3027ccf73bbb134c1a66ada36072adfa0976806175a3e9f955c03cae5b9121d59c2c79ec6b9db53ecf
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiak0Le5ji0hmxNrMPF:A3kMjKJsPji0Ajq
- TLSH T1A4756B12F6A402B5D063C174C9E29656EB717D921B308ADF1398B7392F337D1AA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
- Size 1.9MB
- SHA256 351cfb3204b40a6494f596e6c02927b46ea6d8f4bfb7ae1a042196583a4d3aba
- MD5 ea7a3c3afe73e1bc5a8ed00294d00813
- SHA1 9e2ff213f38886f70f7430c16837f8f3de9eb7a5
- SHA512 99ccb69c91079169a7fa57b75da390e896b772758751a8fed456f7b688f2e450befca432f52d773b953d5a1e5073399ffda2c9d39f58f02c361aa8aa7c3ef744
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiak0Le5ji0hmxNrMzUOlZ7q/c9:A3kMjKJsPji0AjqUOlk09
- TLSH T15D956B26FA6446F5D077C578C5E29646EB7138521B30CACB6368C3292F237D19E3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH