Overview
overview
7Static
static
3Release_FH...64.msi
windows10-2004-x64
7Release_FH...64.msi
windows11-21h2-x64
7Release_FH...up.exe
windows10-2004-x64
7Release_FH...up.exe
windows11-21h2-x64
7Release_La...er.msi
windows10-2004-x64
7Release_La...er.msi
windows11-21h2-x64
7Release_La...up.exe
windows10-2004-x64
7Release_La...up.exe
windows11-21h2-x64
7Simulation...4B.pdf
windows10-2004-x64
3Simulation...4B.pdf
windows11-21h2-x64
3Simulation...8.docx
windows10-2004-x64
1Simulation...8.docx
windows11-21h2-x64
1Analysis
- max time kernel
149s - max time network
98s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
30/05/2026, 12:14
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Release_FH(x64)/FH Simulator_x64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Release_FH(x64)/FH Simulator_x64.msi
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Release_FH(x64)/setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
Release_FH(x64)/setup.exe
Resource
win11-20260513-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
Release_Launcher/FH_FHV Launcher.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral6
Sample
Release_Launcher/FH_FHV Launcher.msi
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral7
Sample
Release_Launcher/setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral8
Sample
Release_Launcher/setup.exe
Resource
win11-20260513-en
windows11-21h2-x64
13 signatures
150 seconds
Behavioral task
behavioral9
Sample
Simulation software_v640_64bit/FZ_FH_FJ_Launcher_Instruction_manual_S2D-175074B.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral10
Sample
Simulation software_v640_64bit/FZ_FH_FJ_Launcher_Instruction_manual_S2D-175074B.pdf
Resource
win11-20260513-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
Simulation software_v640_64bit/How to use simulation software_201808.docx
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
Simulation software_v640_64bit/How to use simulation software_201808.docx
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target Release_Launcher/FH_FHV Launcher.msi
- Size 553KB
- Sample260530-pellfady6k
- SHA256 34a09c28f623d1048711a38e14de0e09178e97940dd0c8146bb7e646b2acc90c
- MD5 b894e07ff9debdd0fc44810cae58843c
- SHA1 f2850955976c50d31e87dba54555f39336eada49
- SHA512 d94f3a78ce6666dd50a48c4e38bc46525572439ef2ad9d77aa357bc39fe85345264b2b0063ecf7c7545099ca41c6a89ee297792c1aa916e3b909ff3276c2e841
- SSDEEP 12288:qEIrDgw7s9wBhnyXuobvgLoW3bdvacv2:qEqThCuob4LoWx
- TLSH T176C4AD217AC3C631C4932235559FE7644B7ABC201B7682C772983B8E6DB2BE07735786
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 10 IoCs
pid Process 4904 MsiExec.exe 4904 MsiExec.exe 2232 MsiExec.exe 2232 MsiExec.exe 1452 MsiExec.exe 1452 MsiExec.exe 1452 MsiExec.exe 1452 MsiExec.exe 1452 MsiExec.exe 1452 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Drops file in Windows directory 20 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DF92A236F860FBBE0D.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF22A5936E1134DA87.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{909FEF75-5C13-48F8-B1AB-8BE788021472} msiexec.exe File opened for modification C:\Windows\Installer\{909FEF75-5C13-48F8-B1AB-8BE788021472}\_0DB1106DB6483709D71407.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIC4E4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC756.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF6406D8D440310E99.TMP msiexec.exe File created C:\Windows\Installer\{909FEF75-5C13-48F8-B1AB-8BE788021472}\_8B41BE6FA1441BD7E60CE1.exe msiexec.exe File created C:\Windows\Installer\e58c1b5.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC213.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF2EFAA4D5E2CC94F5.TMP msiexec.exe File opened for modification C:\Windows\Installer\{909FEF75-5C13-48F8-B1AB-8BE788021472}\_8B41BE6FA1441BD7E60CE1.exe msiexec.exe File opened for modification C:\Windows\Installer\e58c1b5.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC32D.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIC3BA.tmp msiexec.exe File created C:\Windows\Installer\{909FEF75-5C13-48F8-B1AB-8BE788021472}\_0DB1106DB6483709D71407.exe msiexec.exe File created C:\Windows\Installer\e58c1b7.msi msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000588ba66725cf3d120000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000588ba6670000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900588ba667000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a588ba667000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d588ba667000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 28 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\SourceList\PackageName = "FH_FHV Launcher.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Release_Launcher\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|OMRON|FZ_FH_FJ_SimulatorLauncher|FH-SimulatorLauncher.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|OMRON|FZ_FH_FJ_SimulatorLauncher|Licence|FH_FHV License Tool.exe msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|OMRON|FZ_FH_FJ_SimulatorLauncher|CustomAction.dll\CustomAction,Version="1.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 69007e007d005000560029004d004f004e003f004e004a0058004b00730035005a00510061004c003e00710066004e007a0064003800320079007800530067004f0027006d007100390045005a006e00410000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3DC694A1CC909FC4DA0941119E52C3FD\57FEF90931C58F841BBAB87E88204127 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\ProductName = "FH/FHV Launcher" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3DC694A1CC909FC4DA0941119E52C3FD msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\Release_Launcher\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|OMRON|FZ_FH_FJ_SimulatorLauncher|FH-SimulatorLauncher.exe\FH-SimulatorLauncher,Version="1.2.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 69007e007d005000560029004d004f004e003f004e004a0058004b00730035005a00510061004c003e004400440065007b0056007a0067006900780038006300600028002c006d007600470031002e00550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\57FEF90931C58F841BBAB87E88204127\DefaultFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\SourceList msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|OMRON|FZ_FH_FJ_SimulatorLauncher|Licence|FH_FHV License Tool.exe\FH_FHV License Tool,Version="1.0.0.0",Culture="neutral",ProcessorArchitecture="x86" = 69007e007d005000560029004d004f004e003f004e004a0058004b00730035005a00510061004c003e003000310028005f002a004b0045003f00740039007500430066007e006c006c006c0039005400540000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|OMRON|FZ_FH_FJ_SimulatorLauncher|CustomAction.dll msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\57FEF90931C58F841BBAB87E88204127 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\PackageCode = "443E9BF6A15104942925DDB9A6BAFF2C" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\Version = "16908288" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2408 msiexec.exe 2408 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 656 msiexec.exe Token: SeIncreaseQuotaPrivilege 656 msiexec.exe Token: SeSecurityPrivilege 2408 msiexec.exe Token: SeCreateTokenPrivilege 656 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 656 msiexec.exe Token: SeLockMemoryPrivilege 656 msiexec.exe Token: SeIncreaseQuotaPrivilege 656 msiexec.exe Token: SeMachineAccountPrivilege 656 msiexec.exe Token: SeTcbPrivilege 656 msiexec.exe Token: SeSecurityPrivilege 656 msiexec.exe Token: SeTakeOwnershipPrivilege 656 msiexec.exe Token: SeLoadDriverPrivilege 656 msiexec.exe Token: SeSystemProfilePrivilege 656 msiexec.exe Token: SeSystemtimePrivilege 656 msiexec.exe Token: SeProfSingleProcessPrivilege 656 msiexec.exe Token: SeIncBasePriorityPrivilege 656 msiexec.exe Token: SeCreatePagefilePrivilege 656 msiexec.exe Token: SeCreatePermanentPrivilege 656 msiexec.exe Token: SeBackupPrivilege 656 msiexec.exe Token: SeRestorePrivilege 656 msiexec.exe Token: SeShutdownPrivilege 656 msiexec.exe Token: SeDebugPrivilege 656 msiexec.exe Token: SeAuditPrivilege 656 msiexec.exe Token: SeSystemEnvironmentPrivilege 656 msiexec.exe Token: SeChangeNotifyPrivilege 656 msiexec.exe Token: SeRemoteShutdownPrivilege 656 msiexec.exe Token: SeUndockPrivilege 656 msiexec.exe Token: SeSyncAgentPrivilege 656 msiexec.exe Token: SeEnableDelegationPrivilege 656 msiexec.exe Token: SeManageVolumePrivilege 656 msiexec.exe Token: SeImpersonatePrivilege 656 msiexec.exe Token: SeCreateGlobalPrivilege 656 msiexec.exe Token: SeCreateTokenPrivilege 656 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 656 msiexec.exe Token: SeLockMemoryPrivilege 656 msiexec.exe Token: SeIncreaseQuotaPrivilege 656 msiexec.exe Token: SeMachineAccountPrivilege 656 msiexec.exe Token: SeTcbPrivilege 656 msiexec.exe Token: SeSecurityPrivilege 656 msiexec.exe Token: SeTakeOwnershipPrivilege 656 msiexec.exe Token: SeLoadDriverPrivilege 656 msiexec.exe Token: SeSystemProfilePrivilege 656 msiexec.exe Token: SeSystemtimePrivilege 656 msiexec.exe Token: SeProfSingleProcessPrivilege 656 msiexec.exe Token: SeIncBasePriorityPrivilege 656 msiexec.exe Token: SeCreatePagefilePrivilege 656 msiexec.exe Token: SeCreatePermanentPrivilege 656 msiexec.exe Token: SeBackupPrivilege 656 msiexec.exe Token: SeRestorePrivilege 656 msiexec.exe Token: SeShutdownPrivilege 656 msiexec.exe Token: SeDebugPrivilege 656 msiexec.exe Token: SeAuditPrivilege 656 msiexec.exe Token: SeSystemEnvironmentPrivilege 656 msiexec.exe Token: SeChangeNotifyPrivilege 656 msiexec.exe Token: SeRemoteShutdownPrivilege 656 msiexec.exe Token: SeUndockPrivilege 656 msiexec.exe Token: SeSyncAgentPrivilege 656 msiexec.exe Token: SeEnableDelegationPrivilege 656 msiexec.exe Token: SeManageVolumePrivilege 656 msiexec.exe Token: SeImpersonatePrivilege 656 msiexec.exe Token: SeCreateGlobalPrivilege 656 msiexec.exe Token: SeCreateTokenPrivilege 656 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 656 msiexec.exe Token: SeLockMemoryPrivilege 656 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 656 msiexec.exe 656 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2408 wrote to memory of 4904 2408 msiexec.exe 81 PID 2408 wrote to memory of 1352 2408 msiexec.exe 85 PID 2408 wrote to memory of 2232 2408 msiexec.exe 87 PID 2408 wrote to memory of 1452 2408 msiexec.exe 88 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Release_Launcher\FH_FHV Launcher.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:656
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 134BB77D52ACB3C3D0CC2ABA61488EF2 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4904
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1352
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 96FBA558B287867A5C33F2B91C7077A02⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2232
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B149B5169FBC43F154718632B0B4D775 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1452
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1816
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58c1b6.rbs
- Size 133KB
- SHA256 1f946bbfc3b48f09b6a7598b43992cc09d8814c72d18e3a294f873bca67e9bbf
- MD5 c9ccd2c1ea5155c2b2526f0bbbba8b91
- SHA1 b91f06ceb2e19cf55ef1d873e915aec9f2ad8134
- SHA512 a705f26a663b653ec08c732c0d2013df330868a097e77ff772edfa538383ad5beb9ea4a5d89ef8649c562c063f2e6a7e211045da73279c13e4d5caa07b62968f
- SSDEEP 1536:m4SFJ9IC6WRtBzgv6IvCKt72WU+z4SFJ9IC6WRtBzgv6IvCKt72WU+Xd:m44EZtCoz44EZtCot
- TLSH T133D39D2175A0C0F2D49B477D459AE70E6BBAB7826F35904337DE028D0E723D4AB3A309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\OMRON\FZ_FH_FJ_SimulatorLauncher\CustomAction.dll
- Size 11KB
- SHA256 1850d64471a08a9e6f6060e8e0a9195fc4ba70d0ba029bd32908026b9f2813dd
- MD5 d7af3177590cc65e227622e2f0b19dd9
- SHA1 a1b0329b6d9365293d6ae6f5d3cd41c1ec7633ae
- SHA512 c0373e8484305a42e7dc7d183a982a88adaa109e1ddc213f6f0cebec33d054a6d0b28d8dbbd2fd3b36dd4c116ce3b9292da0853df303f56dc5acca8b96f27eec
- SSDEEP 192:HKAX8zK/XOZV4nlYJL/erp0tIDLR3azEEF3Je5:HK28zK/Xmvqrpw+LR3aHFZq
- TLSH T12E32D71693E2C276DE2A8B32498393A10632EF44C563AF7F5554726E6CF32440F93B79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\OMRON\FZ_FH_FJ_SimulatorLauncher\FH-SimulatorLauncher.ini
- Size 234B
- SHA256 32fcb7eb994dfc5d2188e6d67357cca96a12e02d761394eb46432524cd4efb2e
- MD5 48c55a70f7dc8082fe58b6090e4f08c1
- SHA1 e3157c2f72136d4ee14e595fd24ea0de4eef93bd
- SHA512 ef7afe6388a0c9ccc25f9de10e0f97bfe7dfceb0f52a0d603565f5921d251ebdd59390e4d64f5c20cadc7b0fdaa91889a0b9a2a173fe755ec4f972abcb657cc1
- TLSH T18DD0922B03B8011CBAB3FA85EDB5252D5627B987B81AE52C13A4410E80F60048C13BA3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\CFGC31C.tmp
- Size 123B
- SHA256 a558dbe555749cd3bdd62060fdbba72720c4f4a186d5870b977ed2acf9721d9e
- MD5 17af548f88a3199aa8a63a72201f470f
- SHA1 4e64bb20a2f54d778ed684aa21abebad63a5c2c0
- SHA512 08bdbc75f5fd4d9ec85c53253e4030ce7245b20ecc95e032835609c7c43a07d6c9e7776f48c5494a788a543240c0649a9f1a34a0e514ebc4dda5730953647338
- TLSH T1D9B092464628BD2B7C230F6797660E41BF7402A1527A000CD09F3B2726020AEA35A306
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI2517.tmp
- Size 222KB
- SHA256 46ac1cedf9f1383cf45704adf0a7f2128971435bdef0ab8e4ca64f681b2fd4cc
- MD5 efb1ce5e01ede07c24e93b5bb7773026
- SHA1 063a3624a740fcc63e79608ce172d79251b4c74d
- SHA512 a8ba52c383a5bdc5e39f2c56b8fe8496d3a21b4cc7dd8ba7b08a79949584bbaa0da0d881244be260e224863fed3fc144aeaef57e58535465ae1de46836cfc128
- SSDEEP 3072:7T4Du85Prvj1UYLg7EtRMRws9khfXEoMUL19vwQQBvY6+tyXEbRUr075qfFl8Cyt:+rvrgw72ws9wcUh9pFtyXuo0UfvgF
- TLSH T168246A203AE0D131D4E331B856ACE6241ABEB9B05B32C1C763941BED9D70BD1AB3474B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIC4E4.tmp
- Size 61KB
- SHA256 e7b15de9d5458d886f7f9f06dec88e41fbe776379c342033df157c5c3be4ce67
- MD5 4bd22c6050cbbe090c3d28ff6ca20a6b
- SHA1 b743f1815b3bb7767b80ac200366d0c02ab84afa
- SHA512 fca9d3194f3faa7bb1a25799e8d892f23424e8e172e9fde1dc1f3ea44fe4c82b9a807356a6f88c058d02eec62a4263a2236efe75183018c1e926833bf468ff0a
- SSDEEP 768:fi4TGmiFbNq6ICrOWjySxrDNBzLMv6IvNHUjf+5dt72wqkU+iw:K4SFJ9IC6WRtBzgv6IvCKt72WU+/
- TLSH T1B1539D2135B0C4B2D4574A7D14EAE70A6B7ABA437E76D443379A12CD0E723D1A73E30A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58c1b5.msi
- Size 553KB
- SHA256 34a09c28f623d1048711a38e14de0e09178e97940dd0c8146bb7e646b2acc90c
- MD5 b894e07ff9debdd0fc44810cae58843c
- SHA1 f2850955976c50d31e87dba54555f39336eada49
- SHA512 d94f3a78ce6666dd50a48c4e38bc46525572439ef2ad9d77aa357bc39fe85345264b2b0063ecf7c7545099ca41c6a89ee297792c1aa916e3b909ff3276c2e841
- SSDEEP 12288:qEIrDgw7s9wBhnyXuobvgLoW3bdvacv2:qEqThCuob4LoWx
- TLSH T176C4AD217AC3C631C4932235559FE7644B7ABC201B7682C772983B8E6DB2BE07735786
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 fe5ff0659fddc0f272a471b487c3132e55a9fa4b044a584dc5164e38fad082cb
- MD5 b1ed20b238262b39063a85d65b1491db
- SHA1 89488e7614380dfa0745ec0fdb33e51d3ca8987e
- SHA512 4847e86b5fc0af2ec285f5e3cd932089b3bb2ace5d4d147b1c03f5d033c34fcad7ff703aed9616af3231337f705dae404ad8f7f78b1cefcb6e494c081efc00a1
- SSDEEP 24576:W2gmSp14doO/vvTLcW3OhkXafKJ8A4jt22kt3JkH+M64ErjS48mwLqtwx:v
- TLSH T1A047072436F92100E7F79E3CB8F06A27593A7D579C15EE8D05411B8D0922FB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{67a68b58-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6784bab9-3a7c-4cdb-bd1d-52d5699d9363}_OnDiskSnapshotProp
- Size 6KB
- SHA256 d7055c4c93dcdaf88b58af685f0ae50cdbf4c35bcabd8f611ca7df7fabf5728f
- MD5 6e9c097d7bcfd4b200dd7f76cfc1d37d
- SHA1 16a27c3e2f75cad0f97f3a3a516fc638b3cabbd6
- SHA512 f255f3ac9702605aaca914018b45148ccf1919448ce580c3464239f04ac9fc27074efc723f301d5f7a1375041df776722dece7db8e0cd193d3bf265fba9fdb49
- SSDEEP 96:FPhWNzCvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:6eb++ZVm
- TLSH T128D18A185AE54711E2B3AB3228F14557A877B811EF33CB8E0198638E2671A10F875F6F
- MD5 SHA1 SHA512 SSDEEP TLSH