Overview
overview
7Static
static
3Release_FH...64.msi
windows10-2004-x64
7Release_FH...64.msi
windows11-21h2-x64
7Release_FH...up.exe
windows10-2004-x64
7Release_FH...up.exe
windows11-21h2-x64
7Release_La...er.msi
windows10-2004-x64
7Release_La...er.msi
windows11-21h2-x64
7Release_La...up.exe
windows10-2004-x64
7Release_La...up.exe
windows11-21h2-x64
7Simulation...4B.pdf
windows10-2004-x64
3Simulation...4B.pdf
windows11-21h2-x64
3Simulation...8.docx
windows10-2004-x64
1Simulation...8.docx
windows11-21h2-x64
1Analysis
- max time kernel
149s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/05/2026, 12:14
Static task
static1
Behavioral task
behavioral1
Sample
Release_FH(x64)/FH Simulator_x64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Release_FH(x64)/FH Simulator_x64.msi
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
Release_FH(x64)/setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Release_FH(x64)/setup.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
Release_Launcher/FH_FHV Launcher.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Release_Launcher/FH_FHV Launcher.msi
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
Release_Launcher/setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Release_Launcher/setup.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
Simulation software_v640_64bit/FZ_FH_FJ_Launcher_Instruction_manual_S2D-175074B.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Simulation software_v640_64bit/FZ_FH_FJ_Launcher_Instruction_manual_S2D-175074B.pdf
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
Simulation software_v640_64bit/How to use simulation software_201808.docx
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Simulation software_v640_64bit/How to use simulation software_201808.docx
Resource
win11-20260513-en
windows11-21h2-x64
General
- Target Release_FH(x64)/setup.exe
- Size 466KB
- Sample260530-pellfady6k
- SHA256 7a1e25df384972e312f84323fc501ccae05ea425a7776f57beffc33b8fdabdd2
- MD5 525a7e4f1897391deb1c0f9ad9a13121
- SHA1 83acf366d836fd463a293b920db11910b286bc2f
- SHA512 870af5a35dbb9c3ba2917154e420b0e1940fb5adf60394acced53f00be89a3af7628eecbad13fe31bdf028e347800a994b2bd7dbe83a38b5f932fc02b56d2fb5
- SSDEEP 6144:TXaNjt6LuPHmLyiBvuJiFkJ+2Qw+MMq6FlOUeKJ6qjaGojDuUlI1:zYYuUx65QwDMq6TOUzeDuUlO
- TLSH T12CA4E73919E84136D6B7C1F0CBD95133A678E87A33214CF752C1938D8A63AD3796236E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation setup.exe - Loads dropped DLL 2 IoCs
pid Process 3172 MsiExec.exe 3172 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 756 msiexec.exe Token: SeIncreaseQuotaPrivilege 756 msiexec.exe Token: SeSecurityPrivilege 5112 msiexec.exe Token: SeCreateTokenPrivilege 756 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 756 msiexec.exe Token: SeLockMemoryPrivilege 756 msiexec.exe Token: SeIncreaseQuotaPrivilege 756 msiexec.exe Token: SeMachineAccountPrivilege 756 msiexec.exe Token: SeTcbPrivilege 756 msiexec.exe Token: SeSecurityPrivilege 756 msiexec.exe Token: SeTakeOwnershipPrivilege 756 msiexec.exe Token: SeLoadDriverPrivilege 756 msiexec.exe Token: SeSystemProfilePrivilege 756 msiexec.exe Token: SeSystemtimePrivilege 756 msiexec.exe Token: SeProfSingleProcessPrivilege 756 msiexec.exe Token: SeIncBasePriorityPrivilege 756 msiexec.exe Token: SeCreatePagefilePrivilege 756 msiexec.exe Token: SeCreatePermanentPrivilege 756 msiexec.exe Token: SeBackupPrivilege 756 msiexec.exe Token: SeRestorePrivilege 756 msiexec.exe Token: SeShutdownPrivilege 756 msiexec.exe Token: SeDebugPrivilege 756 msiexec.exe Token: SeAuditPrivilege 756 msiexec.exe Token: SeSystemEnvironmentPrivilege 756 msiexec.exe Token: SeChangeNotifyPrivilege 756 msiexec.exe Token: SeRemoteShutdownPrivilege 756 msiexec.exe Token: SeUndockPrivilege 756 msiexec.exe Token: SeSyncAgentPrivilege 756 msiexec.exe Token: SeEnableDelegationPrivilege 756 msiexec.exe Token: SeManageVolumePrivilege 756 msiexec.exe Token: SeImpersonatePrivilege 756 msiexec.exe Token: SeCreateGlobalPrivilege 756 msiexec.exe Token: SeCreateTokenPrivilege 756 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 756 msiexec.exe Token: SeLockMemoryPrivilege 756 msiexec.exe Token: SeIncreaseQuotaPrivilege 756 msiexec.exe Token: SeMachineAccountPrivilege 756 msiexec.exe Token: SeTcbPrivilege 756 msiexec.exe Token: SeSecurityPrivilege 756 msiexec.exe Token: SeTakeOwnershipPrivilege 756 msiexec.exe Token: SeLoadDriverPrivilege 756 msiexec.exe Token: SeSystemProfilePrivilege 756 msiexec.exe Token: SeSystemtimePrivilege 756 msiexec.exe Token: SeProfSingleProcessPrivilege 756 msiexec.exe Token: SeIncBasePriorityPrivilege 756 msiexec.exe Token: SeCreatePagefilePrivilege 756 msiexec.exe Token: SeCreatePermanentPrivilege 756 msiexec.exe Token: SeBackupPrivilege 756 msiexec.exe Token: SeRestorePrivilege 756 msiexec.exe Token: SeShutdownPrivilege 756 msiexec.exe Token: SeDebugPrivilege 756 msiexec.exe Token: SeAuditPrivilege 756 msiexec.exe Token: SeSystemEnvironmentPrivilege 756 msiexec.exe Token: SeChangeNotifyPrivilege 756 msiexec.exe Token: SeRemoteShutdownPrivilege 756 msiexec.exe Token: SeUndockPrivilege 756 msiexec.exe Token: SeSyncAgentPrivilege 756 msiexec.exe Token: SeEnableDelegationPrivilege 756 msiexec.exe Token: SeManageVolumePrivilege 756 msiexec.exe Token: SeImpersonatePrivilege 756 msiexec.exe Token: SeCreateGlobalPrivilege 756 msiexec.exe Token: SeCreateTokenPrivilege 756 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 756 msiexec.exe Token: SeLockMemoryPrivilege 756 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 756 msiexec.exe 756 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1800 wrote to memory of 756 1800 setup.exe 87 PID 5112 wrote to memory of 3172 5112 msiexec.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\Release_FH(x64)\setup.exe"C:\Users\Admin\AppData\Local\Temp\Release_FH(x64)\setup.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\Admin\AppData\Local\Temp\Release_FH(x64)\FH Simulator_x64.msi"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:756
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B5C51C07C6E3C02EE092A71060B2B80F C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3172
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI47E1.tmp
- Size 222KB
- SHA256 46ac1cedf9f1383cf45704adf0a7f2128971435bdef0ab8e4ca64f681b2fd4cc
- MD5 efb1ce5e01ede07c24e93b5bb7773026
- SHA1 063a3624a740fcc63e79608ce172d79251b4c74d
- SHA512 a8ba52c383a5bdc5e39f2c56b8fe8496d3a21b4cc7dd8ba7b08a79949584bbaa0da0d881244be260e224863fed3fc144aeaef57e58535465ae1de46836cfc128
- SSDEEP 3072:7T4Du85Prvj1UYLg7EtRMRws9khfXEoMUL19vwQQBvY6+tyXEbRUr075qfFl8Cyt:+rvrgw72ws9wcUh9pFtyXuo0UfvgF
- TLSH T168246A203AE0D131D4E331B856ACE6241ABEB9B05B32C1C763941BED9D70BD1AB3474B
- MD5 SHA1 SHA512 SSDEEP TLSH