Analysis
- max time kernel
83s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/09/2026, 15:52
Behavioral task
behavioral1
Sample
952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe
- Size 1.4MB
- Sample260916-tbdtmsw15m
- SHA256 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17
- MD5 326ac921d0c13c323d3769aeb2990f81
- SHA1 433fd7381b1ffd1af66bc33d0daa615ab230a5b2
- SHA512 573527d74b306dea98c72b6f68a48f2aacb428105ee305fb00b6220773cb26e3f60e175f861fd0c047b258d2615037712d65ddfbfef34c60344ee7b14c7f4b88
- SSDEEP 24576:A3mnXoZjzyaT5Ba45jcAkSYqyEOx0Le5ji0hmxNrM:A3kMfpYqIPji0Aj
- TLSH T137654B16F6744375D073C0B9C5D2A69AEE72348617308ACB1385D7782F27BE68A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x000700000002444b-6.dat aspack_v212_v242 behavioral1/files/0x0005000000022bf2-12.dat aspack_v212_v242 behavioral1/files/0x000a00000001f2f3-150.dat aspack_v212_v242 behavioral1/files/0x0013000000021666-1077.dat aspack_v212_v242 behavioral1/files/0x0044000000020254-1522.dat aspack_v212_v242 behavioral1/files/0x0007000000024463-1701.dat aspack_v212_v242 behavioral1/files/0x001200000000071d-2066.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3124 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ patcher.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe$ 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4840 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe 3124 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe"C:\Users\Admin\AppData\Local\Temp\952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4840
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3124
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.4MB
- SHA256 952f7a06169e36b425bb26ede6f7df0426e0869268b4630d31d228c27014ae17
- MD5 326ac921d0c13c323d3769aeb2990f81
- SHA1 433fd7381b1ffd1af66bc33d0daa615ab230a5b2
- SHA512 573527d74b306dea98c72b6f68a48f2aacb428105ee305fb00b6220773cb26e3f60e175f861fd0c047b258d2615037712d65ddfbfef34c60344ee7b14c7f4b88
- SSDEEP 24576:A3mnXoZjzyaT5Ba45jcAkSYqyEOx0Le5ji0hmxNrM:A3kMfpYqIPji0Aj
- TLSH T137654B16F6744375D073C0B9C5D2A69AEE72348617308ACB1385D7782F27BE68A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.9MB
- SHA256 64ca85c23cbd0c1009bd3233fce603c0afb52e228800fa566d2d5a568712bd5f
- MD5 710a5bccdf15f87b947b41365530082b
- SHA1 62930e680f339b6e3e6dd82dd00f15f0324cea86
- SHA512 200f567851b36c64df53ca3bd30ba06828b1db72024a63c275ce92b42465788bbd79a83b081b170d298b7fe6f95bd995977ae8e577b41ca80cd13bcad6404c18
- SSDEEP 24576:A3mnXoZjzyaT5Ba45jcAkSYqyEOx0Le5ji0hmxNrMX3Td9CHKy7GZO:A3kMfpYqIPji0AjoTd9CHKyao
- TLSH T1B8955C16F6B442B5D073C179C9D2965AEA7234461B30CACF0395D7782F277E28A3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
- Size 1.6MB
- SHA256 3d7f9e7c2d15c073ec3e797220ac8c7c35b5feb7bdf219a4427de067b721d5fe
- MD5 7f58c0a15d205dd6673bdc7d432e533b
- SHA1 e6ecc2e0bfab399ae73a77f0d3408f6be5c2e1b1
- SHA512 2e065e2d8932bea3bf8902707c965c2093b9ee231ee667b90f534cfa0b7fd4205c4a6b1ae1655311ff3f7bf9104acf770afb23eefaa879cee814270eaecd71d6
- SSDEEP 24576:A3mnXoZjzyaT5Ba45jcAkSYqyEOx0Le5ji0hmxNrMeGen:A3kMfpYqIPji0AjMI
- TLSH T1F5754A16F67443B5D073C0B9C5D2A69AEB72344607308ACB1395C7782F27BE69A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 811f9e6545a255e8b42ec6537b9a4298343521913a33c333b0829bef032fce92
- MD5 1794d163801731f7a02a1690e85e26d1
- SHA1 770fff57407a908b104f603d2eec55c0771381cc
- SHA512 819fe17afc95e2611599a12afdef7f19698e3f61c2fe8e2ffdbd21d0d49e12fd403729d5578b5afe1311e3753aadc3bd2a67332e30b972ab90fb949a260084bd
- SSDEEP 24576:A3mnXoZjzyaT5Ba45jcAkSYqyEOx0Le5ji0hmxNrMD0Le5ji0hmxNrM:A3kMfpYqIPji0AjKPji0Aj
- TLSH T124A52A16F6748375D073C0B9C5D2A69AEA71308617308ACB1385D77C2F67BE68A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$
- Size 1.6MB
- SHA256 d912928da308a602772091ba59ca8772d50085d6b16702a16a40113d3f6bd7c9
- MD5 7dadb9d428c1d022a0c1586d54990894
- SHA1 ca87d8988d61250efbc1f7dafbbe887c1ec40aaa
- SHA512 b2cc30d94a1a0211dcc4a00732e00add5486f4a2d8c91d05a006fad582ae751abebdeb5fd42111485bcbb4a591daeb7aea065d9f5a89c8b8571bab6096079438
- SSDEEP 24576:A3mnXoZjzyaT5Ba45jcAkSYqyEOx0Le5ji0hmxNrMYD:A3kMfpYqIPji0AjX
- TLSH T1B2751916F6644275D07AC0B9C7D2A65AFA33344107B08ACB13C5D67C2F276E58ABA733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$
- Size 1.6MB
- SHA256 5aeebda7cc52535d91edaa0630ef00bea4deba6c75f8212be0b284241d498e21
- MD5 1a09c5db50a58c2461eb86eefd36d1dd
- SHA1 bd98003ebaba01e8e03c9d425074939e2df95a6f
- SHA512 96dcee295524bf8ad247b9beef83f6cf35b86492e78b8ad8baae630b1acf46ca1043ad033fb575f9a1f02306feae9a68136212ce60155fa471cca122d59ffbac
- SSDEEP 24576:A3mnXoZjzyaT5Ba45jcAkSYqyEOx0Le5ji0hmxNrMWY8dml:A3kMfpYqIPji0Aja1l
- TLSH T18F754B16F6B44275D073C1B9C9E2A69AEE72344517308ACF1345C7782F27BE68A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 1.7MB
- SHA256 ded1cbb4b13ca8736f5de1c7478274dc5bb2cda7d4723e0c3bf60cee5be4d1d6
- MD5 873393ff2ece39b5af087e1af3e80b17
- SHA1 34f7893b05cd4699c0e97d3b9f59d98b63dccb8d
- SHA512 115188e9cd523e136fcc3c222adeb71a26fc4db71fc37800a1f795606ba120f9b731ad7134c0a21da9510f2fec746313d815e1efd6273484c73f120c324886a4
- SSDEEP 24576:A3mnXoZjzyaT5Ba45jcAkSYqyEOx0Le5ji0hmxNrMfV+PAk2hMH3:A3kMfpYqIPji0AjYi2WH3
- TLSH T128856C26F6B44275D073C0B9C9D2A69AEE71344207308ACB5385D77C2F677E68A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH