Analysis
- max time kernel
95s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 18:41
Behavioral task
behavioral1
Sample
54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe
- Size 1.4MB
- Sample260910-xb231svake
- SHA256 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be
- MD5 5fa692ec04870696910b9ed9ef9893c0
- SHA1 37312a482f9a3c89e76960aaf4fe10ce1210302d
- SHA512 d5def031e16d3719ae88172e2e9c40a9a72f364dbcee09f166dd35d347b9c84e7841cd2131a9da72a335106628befddf18aa68c5d5671cbb2e362c71d7a7e4a2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacxagoP0Le5ji0hmxNrM:A3k03kHRJARJBPji0Aj
- TLSH T191657C17F6A802B5D067C1B8C5D29A5AEA723842173097CF1394C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x0007000000024259-5.dat aspack_v212_v242 behavioral1/files/0x000300000001e6e5-13.dat aspack_v212_v242 behavioral1/files/0x0002000000021277-233.dat aspack_v212_v242 behavioral1/files/0x0017000000021298-572.dat aspack_v212_v242 behavioral1/files/0x0003000000021676-1248.dat aspack_v212_v242 behavioral1/files/0x00150000000202bb-1524.dat aspack_v212_v242 behavioral1/files/0x001000000001691d-1871.dat aspack_v212_v242 behavioral1/files/0x0004000000000721-1970.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5000 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3884 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe 5000 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe"C:\Users\Admin\AppData\Local\Temp\54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3884
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5000
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.4MB
- SHA256 54f2b27934d14e207e8bea4f363a8aff4ed46f612df84f79939d0b5f98f689be
- MD5 5fa692ec04870696910b9ed9ef9893c0
- SHA1 37312a482f9a3c89e76960aaf4fe10ce1210302d
- SHA512 d5def031e16d3719ae88172e2e9c40a9a72f364dbcee09f166dd35d347b9c84e7841cd2131a9da72a335106628befddf18aa68c5d5671cbb2e362c71d7a7e4a2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacxagoP0Le5ji0hmxNrM:A3k03kHRJARJBPji0Aj
- TLSH T191657C17F6A802B5D067C1B8C5D29A5AEA723842173097CF1394C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.9MB
- SHA256 1dfa4348f88e0239d4275e403eeed414ad28fc39a8585845f57a6076f1ba9464
- MD5 310662ebbafd7d33c5807f287b635c0d
- SHA1 d7abba776889e8b2d187ee5d49334f42e207fbe9
- SHA512 27bedc2e4fa5786dfc28f85355f4d1ca3daae2c6f2316519e20108249ed0e2f08059d2cbee7662353a9cb5e4e492299eee2d9a61f4865995b1f66223b3d3701e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacxagoP0Le5ji0hmxNrMX3Td9CHKy7Go:A3k03kHRJARJBPji0AjoTd9CHKyao
- TLSH T180957D16F7A402B5E077C179C9E29656EA7238461730DBCF039496292F33BD19E3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{87EB8AE8-DCC9-4923-8C88-7CEABF61AB19}\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 1.5MB
- SHA256 81c6af0aa8d400d8117d56eb4ee96442fe19a0444a2e5ff5ae87a7456f6bcd95
- MD5 a83797698316ba4f9cc7341c2d4769e8
- SHA1 904030ffad8b9d4cdeb6ddf38f521ca8a96d99ef
- SHA512 beaf4f01d29c5ab4aa000a29b4957ee08ea639b2dffdbac74a9c20412d8cc35591de5445e9362c2dee87152bc4d5b6c39ae8c5c1b742f8a6fe53b3496c567732
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacxagoP0Le5ji0hmxNrMZbBPzBAU:A3k03kHRJARJBPji0Aj+BPVAU
- TLSH T157758C17F6A442B5D067C178C9D29A5AEA72384207309BCF1394C7292F27BE19F3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 31ab610ceeb272598acf862b5f1d7ab1b95db3a800c796cfe72be596b669f03c
- MD5 0dee979b87f43db1cd3e29cb2f19011e
- SHA1 de782254773290f769a67e73cdaf320909729d85
- SHA512 2fd00b31e163dd5926be497fa3f3794c652cb479a1720663e7ab11957ed00e0aad1cd1b0048a7090b6930c1cbffe2a869f7bddcd5d2ac525181044ad8b008ff4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacxagoP0Le5ji0hmxNrMD0Le5ji0hmxe:A3k03kHRJARJBPji0AjKPji0Aj
- TLSH T132A55C16F6B44375D073C0B9C5D2A69AEA72348217308ACB0395C76C3F67BE59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.5MB
- SHA256 0ad52f5f31201fe9dc385a1754f7665a11e65aeac7ce25a334f397892d4c0d03
- MD5 630ff95e9728a9d83387543db1da2486
- SHA1 01e4045738b86e4b4cd78fa8d83d41dd6224c4fe
- SHA512 98a7973db309e1b4af48c7e2d187435c8f38b48f068c3f319ad1fdba1141209aa5fb3e0d943d71a1dde69dd050f0782fc47002a07eaa3db4ff4b0c16796482da
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacxagoP0Le5ji0hmxNrMwo:A3k03kHRJARJBPji0Ajc
- TLSH T107657C17F6A802B5D067C1B8C5D29A5AEA723842173097CF1394C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$
- Size 1.5MB
- SHA256 76bf484d6328c723410570351f0d33087a6599ae8859e283278e2442d7bc0d83
- MD5 64e957e636fdd512a820f6658347b99e
- SHA1 676e7a2e8b609a9bd499dbbbc1a38e76caf86878
- SHA512 7c770b75817094cf2508b13f3bc46b8df02b319f86ea24e5e72c5962d800887d1b9435d4f47ccb4cb7685a7ce1133eea9cf90670a3ab43cf9ac65dfedaa574e7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacxagoP0Le5ji0hmxNrMPf2a9:A3k03kHRJARJBPji0Aj+7
- TLSH T143757B17F6A802B5D077C178C9E2965AEA72384217309BCF1354C7292F67BE19E3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe
- Size 1.5MB
- SHA256 e1eabf9e2637288f7f676201191d4f334d9c0e7e9a8b54dccac1dc7160ec33cb
- MD5 5aa2a0635a4610719bd23ce979ce59fd
- SHA1 4f3e4a6f09ebbeac6ed963298aa0949cf3f0ef82
- SHA512 b6ce34bea5bf55bb2af174371f5f9292c809689181972e593816656f5a72605228ba5ad0dc35017903f4d1054f7ed43f2f3d7a657469a70fa224d317fddfdd6b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacxagoP0Le5ji0hmxNrMPF:A3k03kHRJARJBPji0Ajq
- TLSH T166756C17F6A402B5D067C078C9D69A56FA313C820B309ADF1354F7292F73BD5AA3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.9MB
- SHA256 533793ed3cbe1319bed44b342ca7bb1e9fc075231805bf2441a4c42422697a57
- MD5 22f9c5b553adccf98d600a19f6389f77
- SHA1 418c96e48fc8b3fda06c79e675847da27273e648
- SHA512 ca827b3dc7d8b03449d0fe49403a1662403e716161d99fbc7bf26b28479dd773ae0c5a9aa072d92b8de6e6138bb20b2726aead87b33d18ea334035f64cf3a02e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacxagoP0Le5ji0hmxNrMu3npi63iC:A3k03kHRJARJBPji0AjRXpiMh
- TLSH T10A955B12F7E84275E0B3C274CAE69656EA727C515B3086CF1384961D2F72BD0DA3A732
- MD5 SHA1 SHA512 SSDEEP TLSH