Analysis
- user interaction
yes - max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/09/2026, 20:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Kontakt 8.13.0 Full Options Patcher.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Kontakt 8.13.0 Full Options Patcher.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target Kontakt 8.13.0 Full Options Patcher.exe
- Size 28.8MB
- Sample260928-y9jvrsshqd
- SHA256 e0f0ccd3c32b239c051d4deceacd9ed786823d990eb22ede4675f7890a571c29
- MD5 ab47f0883a0d4d5c603752344553000a
- SHA1 bff24ea04d3632f11e2170c11fb2b1843cd0a7a3
- SHA512 381d67aff4634156e04a76b288ea899e39eea55e5df4f41cd5f19da4621ea6763ce4875c993c3474588443d03f6443d315af977cb527c13b2de00da265406e06
- SSDEEP 786432:OBjcklJAl30rc/TKKjBqHxWSeeMKTERDrKv:O8gqPSne/Ev
- TLSH T18B67E0B27EF86DB1D38301B206EC99D16E7DA73B8944059DB0CC262D5F4068A13E767E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Native Instruments\Kontakt 8\Kontakt_Button.exe Kontakt 8.13.0 Full Options Patcher.exe File created C:\Program Files\Common Files\Native Instruments\Service Center\NativeAccess.xml Kontakt 8.13.0 Full Options Patcher.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kontakt 8.13.0 Full Options Patcher.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell Kontakt 8.13.0 Full Options Patcher.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000002b5dc87b10004c6f63616c003c0009000400efbe2b5ded783c5daaa32e00000069e101000000010000000000000000000000000000001fc913014c006f00630061006c00000014000000 Kontakt 8.13.0 Full Options Patcher.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Kontakt 8.13.0 Full Options Patcher.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 Kontakt 8.13.0 Full Options Patcher.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Kontakt 8.13.0 Full Options Patcher.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Kontakt 8.13.0 Full Options Patcher.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\ALSupport8\shell\open Kontakt 8.13.0 Full Options Patcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\ALSupport8\shell\open\command\ = "\"C:\\Program Files\\Native Instruments\\Kontakt 8\\Kontakt_Button.exe\" \"%1\"" Kontakt 8.13.0 Full Options Patcher.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Kontakt 8.13.0 Full Options Patcher.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Kontakt 8.13.0 Full Options Patcher.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff Kontakt 8.13.0 Full Options Patcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads" Kontakt 8.13.0 Full Options Patcher.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Kontakt 8.13.0 Full Options Patcher.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Kontakt 8.13.0 Full Options Patcher.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\ALSupport8\shell Kontakt 8.13.0 Full Options Patcher.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Kontakt 8.13.0 Full Options Patcher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Kontakt 8.13.0 Full Options Patcher.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" Kontakt 8.13.0 Full Options Patcher.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" Kontakt 8.13.0 Full Options Patcher.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257" Kontakt 8.13.0 Full Options Patcher.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff Kontakt 8.13.0 Full Options Patcher.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e8005398e082303024b98265d99428e115f0000 Kontakt 8.13.0 Full Options Patcher.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2" Kontakt 8.13.0 Full Options Patcher.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" Kontakt 8.13.0 Full Options Patcher.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff Kontakt 8.13.0 Full Options Patcher.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Kontakt 8.13.0 Full Options Patcher.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c004346534616003100000000002b5ded78120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe2b5ded783c5daaa32e00000056e101000000010000000000000000000000000000009f32b7004100700070004400610074006100000042000000 Kontakt 8.13.0 Full Options Patcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Kontakt 8.13.0 Full Options Patcher.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" Kontakt 8.13.0 Full Options Patcher.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Kontakt 8.13.0 Full Options Patcher.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff Kontakt 8.13.0 Full Options Patcher.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Kontakt 8.13.0 Full Options Patcher.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Kontakt 8.13.0 Full Options Patcher.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 Kontakt 8.13.0 Full Options Patcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" Kontakt 8.13.0 Full Options Patcher.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff Kontakt 8.13.0 Full Options Patcher.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" Kontakt 8.13.0 Full Options Patcher.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" Kontakt 8.13.0 Full Options Patcher.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" Kontakt 8.13.0 Full Options Patcher.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" Kontakt 8.13.0 Full Options Patcher.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Kontakt 8.13.0 Full Options Patcher.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000003c5daaa3100054656d7000003a0009000400efbe2b5ded783c5daaa32e0000006ae10100000001000000000000000000000000000000f1907a00540065006d007000000014000000 Kontakt 8.13.0 Full Options Patcher.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" Kontakt 8.13.0 Full Options Patcher.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 Kontakt 8.13.0 Full Options Patcher.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Kontakt 8.13.0 Full Options Patcher.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" Kontakt 8.13.0 Full Options Patcher.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" Kontakt 8.13.0 Full Options Patcher.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 Kontakt 8.13.0 Full Options Patcher.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg Kontakt 8.13.0 Full Options Patcher.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} Kontakt 8.13.0 Full Options Patcher.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\ALSupport8 Kontakt 8.13.0 Full Options Patcher.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings Kontakt 8.13.0 Full Options Patcher.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff Kontakt 8.13.0 Full Options Patcher.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" Kontakt 8.13.0 Full Options Patcher.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" Kontakt 8.13.0 Full Options Patcher.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Kontakt 8.13.0 Full Options Patcher.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell Kontakt 8.13.0 Full Options Patcher.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg Kontakt 8.13.0 Full Options Patcher.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Kontakt 8.13.0 Full Options Patcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Kontakt 8.13.0 Full Options Patcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\ALSupport8\URL Protocol Kontakt 8.13.0 Full Options Patcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\ALSupport8\ = "URL:ALSupport8" Kontakt 8.13.0 Full Options Patcher.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Kontakt 8.13.0 Full Options Patcher.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Kontakt 8.13.0 Full Options Patcher.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1000 Kontakt 8.13.0 Full Options Patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kontakt 8.13.0 Full Options Patcher.exe"C:\Users\Admin\AppData\Local\Temp\Kontakt 8.13.0 Full Options Patcher.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1000
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x48c 0x4b41⤵PID:4844