Overview
overview
7Static
static
3Release_FH...64.msi
windows10-2004-x64
7Release_FH...64.msi
windows11-21h2-x64
7Release_FH...up.exe
windows10-2004-x64
7Release_FH...up.exe
windows11-21h2-x64
7Release_La...er.msi
windows10-2004-x64
7Release_La...er.msi
windows11-21h2-x64
7Release_La...up.exe
windows10-2004-x64
7Release_La...up.exe
windows11-21h2-x64
7Simulation...4B.pdf
windows10-2004-x64
3Simulation...4B.pdf
windows11-21h2-x64
3Simulation...8.docx
windows10-2004-x64
1Simulation...8.docx
windows11-21h2-x64
1Analysis
- max time kernel
149s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
30/05/2026, 12:14
Static task
static1
Behavioral task
behavioral1
Sample
Release_FH(x64)/FH Simulator_x64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Release_FH(x64)/FH Simulator_x64.msi
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
Release_FH(x64)/setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Release_FH(x64)/setup.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
Release_Launcher/FH_FHV Launcher.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Release_Launcher/FH_FHV Launcher.msi
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
Release_Launcher/setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Release_Launcher/setup.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
Simulation software_v640_64bit/FZ_FH_FJ_Launcher_Instruction_manual_S2D-175074B.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Simulation software_v640_64bit/FZ_FH_FJ_Launcher_Instruction_manual_S2D-175074B.pdf
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
Simulation software_v640_64bit/How to use simulation software_201808.docx
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Simulation software_v640_64bit/How to use simulation software_201808.docx
Resource
win11-20260513-en
windows11-21h2-x64
General
- Target Release_FH(x64)/FH Simulator_x64.msi
- Size 43.4MB
- Sample260530-pellfady6k
- SHA256 2e6fd030d905914ad69ad288f88451d934cd44951e4b9ca69851f5f53c36bae4
- MD5 f83ffb09351f2c451f3a17095e8d505a
- SHA1 7e50044f6f5baa145822629fc59fe776d2f79255
- SHA512 1ff634b8d06087673ab528ebc6044178074e6e34d57970e348052665366817e0272a258ea8d3ddbd33da5f5145eb6ae3a09ea8a513176395936d3ac9a368ba38
- SSDEEP 786432:M2ccqbNmzyK71fuHACZTvBEnOx/DHHTgSHMXNJ0fEJgsJLIP5s6nIVeDTzYkUvpc:J1sNIyK7Rk9Z1EngFMwkXL45RkeHz5kH
- TLSH T175A73363BC592D53E045B37122AC43AE82737DE113625743AE79970A2E3F1C6A23D787
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 2176 MsiExec.exe 2176 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5008 msiexec.exe Token: SeIncreaseQuotaPrivilege 5008 msiexec.exe Token: SeSecurityPrivilege 2736 msiexec.exe Token: SeCreateTokenPrivilege 5008 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5008 msiexec.exe Token: SeLockMemoryPrivilege 5008 msiexec.exe Token: SeIncreaseQuotaPrivilege 5008 msiexec.exe Token: SeMachineAccountPrivilege 5008 msiexec.exe Token: SeTcbPrivilege 5008 msiexec.exe Token: SeSecurityPrivilege 5008 msiexec.exe Token: SeTakeOwnershipPrivilege 5008 msiexec.exe Token: SeLoadDriverPrivilege 5008 msiexec.exe Token: SeSystemProfilePrivilege 5008 msiexec.exe Token: SeSystemtimePrivilege 5008 msiexec.exe Token: SeProfSingleProcessPrivilege 5008 msiexec.exe Token: SeIncBasePriorityPrivilege 5008 msiexec.exe Token: SeCreatePagefilePrivilege 5008 msiexec.exe Token: SeCreatePermanentPrivilege 5008 msiexec.exe Token: SeBackupPrivilege 5008 msiexec.exe Token: SeRestorePrivilege 5008 msiexec.exe Token: SeShutdownPrivilege 5008 msiexec.exe Token: SeDebugPrivilege 5008 msiexec.exe Token: SeAuditPrivilege 5008 msiexec.exe Token: SeSystemEnvironmentPrivilege 5008 msiexec.exe Token: SeChangeNotifyPrivilege 5008 msiexec.exe Token: SeRemoteShutdownPrivilege 5008 msiexec.exe Token: SeUndockPrivilege 5008 msiexec.exe Token: SeSyncAgentPrivilege 5008 msiexec.exe Token: SeEnableDelegationPrivilege 5008 msiexec.exe Token: SeManageVolumePrivilege 5008 msiexec.exe Token: SeImpersonatePrivilege 5008 msiexec.exe Token: SeCreateGlobalPrivilege 5008 msiexec.exe Token: SeCreateTokenPrivilege 5008 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5008 msiexec.exe Token: SeLockMemoryPrivilege 5008 msiexec.exe Token: SeIncreaseQuotaPrivilege 5008 msiexec.exe Token: SeMachineAccountPrivilege 5008 msiexec.exe Token: SeTcbPrivilege 5008 msiexec.exe Token: SeSecurityPrivilege 5008 msiexec.exe Token: SeTakeOwnershipPrivilege 5008 msiexec.exe Token: SeLoadDriverPrivilege 5008 msiexec.exe Token: SeSystemProfilePrivilege 5008 msiexec.exe Token: SeSystemtimePrivilege 5008 msiexec.exe Token: SeProfSingleProcessPrivilege 5008 msiexec.exe Token: SeIncBasePriorityPrivilege 5008 msiexec.exe Token: SeCreatePagefilePrivilege 5008 msiexec.exe Token: SeCreatePermanentPrivilege 5008 msiexec.exe Token: SeBackupPrivilege 5008 msiexec.exe Token: SeRestorePrivilege 5008 msiexec.exe Token: SeShutdownPrivilege 5008 msiexec.exe Token: SeDebugPrivilege 5008 msiexec.exe Token: SeAuditPrivilege 5008 msiexec.exe Token: SeSystemEnvironmentPrivilege 5008 msiexec.exe Token: SeChangeNotifyPrivilege 5008 msiexec.exe Token: SeRemoteShutdownPrivilege 5008 msiexec.exe Token: SeUndockPrivilege 5008 msiexec.exe Token: SeSyncAgentPrivilege 5008 msiexec.exe Token: SeEnableDelegationPrivilege 5008 msiexec.exe Token: SeManageVolumePrivilege 5008 msiexec.exe Token: SeImpersonatePrivilege 5008 msiexec.exe Token: SeCreateGlobalPrivilege 5008 msiexec.exe Token: SeCreateTokenPrivilege 5008 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5008 msiexec.exe Token: SeLockMemoryPrivilege 5008 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5008 msiexec.exe 5008 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2736 wrote to memory of 2176 2736 msiexec.exe 83
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Release_FH(x64)\FH Simulator_x64.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5008
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A779CE48D1EF84F2A4373B534E5695D5 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2176
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI5CC1.tmp
- Size 222KB
- SHA256 46ac1cedf9f1383cf45704adf0a7f2128971435bdef0ab8e4ca64f681b2fd4cc
- MD5 efb1ce5e01ede07c24e93b5bb7773026
- SHA1 063a3624a740fcc63e79608ce172d79251b4c74d
- SHA512 a8ba52c383a5bdc5e39f2c56b8fe8496d3a21b4cc7dd8ba7b08a79949584bbaa0da0d881244be260e224863fed3fc144aeaef57e58535465ae1de46836cfc128
- SSDEEP 3072:7T4Du85Prvj1UYLg7EtRMRws9khfXEoMUL19vwQQBvY6+tyXEbRUr075qfFl8Cyt:+rvrgw72ws9wcUh9pFtyXuo0UfvgF
- TLSH T168246A203AE0D131D4E331B856ACE6241ABEB9B05B32C1C763941BED9D70BD1AB3474B
- MD5 SHA1 SHA512 SSDEEP TLSH