Overview
overview
7Static
static
3Release_FH...64.msi
windows10-2004-x64
7Release_FH...64.msi
windows11-21h2-x64
7Release_FH...up.exe
windows10-2004-x64
7Release_FH...up.exe
windows11-21h2-x64
7Release_La...er.msi
windows10-2004-x64
7Release_La...er.msi
windows11-21h2-x64
7Release_La...up.exe
windows10-2004-x64
7Release_La...up.exe
windows11-21h2-x64
7Simulation...4B.pdf
windows10-2004-x64
3Simulation...4B.pdf
windows11-21h2-x64
3Simulation...8.docx
windows10-2004-x64
1Simulation...8.docx
windows11-21h2-x64
1Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/05/2026, 12:14
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Release_FH(x64)/FH Simulator_x64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Release_FH(x64)/FH Simulator_x64.msi
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Release_FH(x64)/setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
Release_FH(x64)/setup.exe
Resource
win11-20260513-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
Release_Launcher/FH_FHV Launcher.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral6
Sample
Release_Launcher/FH_FHV Launcher.msi
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral7
Sample
Release_Launcher/setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral8
Sample
Release_Launcher/setup.exe
Resource
win11-20260513-en
windows11-21h2-x64
13 signatures
150 seconds
Behavioral task
behavioral9
Sample
Simulation software_v640_64bit/FZ_FH_FJ_Launcher_Instruction_manual_S2D-175074B.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral10
Sample
Simulation software_v640_64bit/FZ_FH_FJ_Launcher_Instruction_manual_S2D-175074B.pdf
Resource
win11-20260513-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
Simulation software_v640_64bit/How to use simulation software_201808.docx
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
Simulation software_v640_64bit/How to use simulation software_201808.docx
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target Release_Launcher/setup.exe
- Size 370KB
- Sample260530-pellfady6k
- SHA256 4f590f0b3e2118b48736949c6a630858347e766052edbeaf41b1dc18bc8d63ad
- MD5 2092c29fc05ae7abda6c3e88814664e4
- SHA1 31319c520e8e0cb69a62f84123e5978ce4004b0f
- SHA512 3452a8ba46ae0dc8fdc2d556423b136a4d7c9e2b078f83d55f7c057aaf709abe135b3621742f30becf08981a7a9588c17ea517975f6cbba02593f1e014079559
- SSDEEP 6144:VXaNjt6LuPHmLyiBvuJiFkJ+2Qw+MMq6FlOUeKJ6qjaeojDuUly1:lYYuUx65QwDMq6TOUreDuUlU
- TLSH T1B0845A227694D031E8A312B44A6D63315ABEEC74173586C7A7C423EEDDB07D29E3078B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation setup.exe - Loads dropped DLL 10 IoCs
pid Process 5900 MsiExec.exe 5900 MsiExec.exe 1552 MsiExec.exe 1552 MsiExec.exe 5428 MsiExec.exe 5428 MsiExec.exe 5428 MsiExec.exe 5428 MsiExec.exe 5428 MsiExec.exe 5428 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Drops file in Windows directory 16 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\{909FEF75-5C13-48F8-B1AB-8BE788021472}\_8B41BE6FA1441BD7E60CE1.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI1AF.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIFE50.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFFB9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI56.tmp msiexec.exe File created C:\Windows\Installer\{909FEF75-5C13-48F8-B1AB-8BE788021472}\_0DB1106DB6483709D71407.exe msiexec.exe File opened for modification C:\Windows\Installer\{909FEF75-5C13-48F8-B1AB-8BE788021472}\_0DB1106DB6483709D71407.exe msiexec.exe File created C:\Windows\Installer\e58fdd3.msi msiexec.exe File opened for modification C:\Windows\Installer\e58fdd3.msi msiexec.exe File created C:\Windows\Installer\SourceHash{909FEF75-5C13-48F8-B1AB-8BE788021472} msiexec.exe File created C:\Windows\Installer\{909FEF75-5C13-48F8-B1AB-8BE788021472}\_8B41BE6FA1441BD7E60CE1.exe msiexec.exe File created C:\Windows\Installer\e58fdd5.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3B3.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000041efd9123c6b0a670000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000041efd9120000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090041efd912000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a41efd912000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d41efd912000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 28 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\Release_Launcher\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|OMRON|FZ_FH_FJ_SimulatorLauncher|FH-SimulatorLauncher.exe\FH-SimulatorLauncher,Version="1.2.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 69007e007d005000560029004d004f004e003f004e004a0058004b00730035005a00510061004c003e004400440065007b0056007a0067006900780038006300600028002c006d007600470031002e00550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\SourceList\PackageName = "FH_FHV Launcher.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Release_Launcher\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|OMRON|FZ_FH_FJ_SimulatorLauncher|Licence|FH_FHV License Tool.exe\FH_FHV License Tool,Version="1.0.0.0",Culture="neutral",ProcessorArchitecture="x86" = 69007e007d005000560029004d004f004e003f004e004a0058004b00730035005a00510061004c003e003000310028005f002a004b0045003f00740039007500430066007e006c006c006c0039005400540000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\PackageCode = "443E9BF6A15104942925DDB9A6BAFF2C" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\Version = "16908288" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|OMRON|FZ_FH_FJ_SimulatorLauncher|Licence|FH_FHV License Tool.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|OMRON|FZ_FH_FJ_SimulatorLauncher|CustomAction.dll msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|OMRON|FZ_FH_FJ_SimulatorLauncher|CustomAction.dll\CustomAction,Version="1.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 69007e007d005000560029004d004f004e003f004e004a0058004b00730035005a00510061004c003e00710066004e007a0064003800320079007800530067004f0027006d007100390045005a006e00410000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\57FEF90931C58F841BBAB87E88204127 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3DC694A1CC909FC4DA0941119E52C3FD\57FEF90931C58F841BBAB87E88204127 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|OMRON|FZ_FH_FJ_SimulatorLauncher|FH-SimulatorLauncher.exe msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\57FEF90931C58F841BBAB87E88204127\DefaultFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\ProductName = "FH/FHV Launcher" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3DC694A1CC909FC4DA0941119E52C3FD msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5696 msiexec.exe 5696 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5652 msiexec.exe Token: SeIncreaseQuotaPrivilege 5652 msiexec.exe Token: SeSecurityPrivilege 5696 msiexec.exe Token: SeCreateTokenPrivilege 5652 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5652 msiexec.exe Token: SeLockMemoryPrivilege 5652 msiexec.exe Token: SeIncreaseQuotaPrivilege 5652 msiexec.exe Token: SeMachineAccountPrivilege 5652 msiexec.exe Token: SeTcbPrivilege 5652 msiexec.exe Token: SeSecurityPrivilege 5652 msiexec.exe Token: SeTakeOwnershipPrivilege 5652 msiexec.exe Token: SeLoadDriverPrivilege 5652 msiexec.exe Token: SeSystemProfilePrivilege 5652 msiexec.exe Token: SeSystemtimePrivilege 5652 msiexec.exe Token: SeProfSingleProcessPrivilege 5652 msiexec.exe Token: SeIncBasePriorityPrivilege 5652 msiexec.exe Token: SeCreatePagefilePrivilege 5652 msiexec.exe Token: SeCreatePermanentPrivilege 5652 msiexec.exe Token: SeBackupPrivilege 5652 msiexec.exe Token: SeRestorePrivilege 5652 msiexec.exe Token: SeShutdownPrivilege 5652 msiexec.exe Token: SeDebugPrivilege 5652 msiexec.exe Token: SeAuditPrivilege 5652 msiexec.exe Token: SeSystemEnvironmentPrivilege 5652 msiexec.exe Token: SeChangeNotifyPrivilege 5652 msiexec.exe Token: SeRemoteShutdownPrivilege 5652 msiexec.exe Token: SeUndockPrivilege 5652 msiexec.exe Token: SeSyncAgentPrivilege 5652 msiexec.exe Token: SeEnableDelegationPrivilege 5652 msiexec.exe Token: SeManageVolumePrivilege 5652 msiexec.exe Token: SeImpersonatePrivilege 5652 msiexec.exe Token: SeCreateGlobalPrivilege 5652 msiexec.exe Token: SeCreateTokenPrivilege 5652 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5652 msiexec.exe Token: SeLockMemoryPrivilege 5652 msiexec.exe Token: SeIncreaseQuotaPrivilege 5652 msiexec.exe Token: SeMachineAccountPrivilege 5652 msiexec.exe Token: SeTcbPrivilege 5652 msiexec.exe Token: SeSecurityPrivilege 5652 msiexec.exe Token: SeTakeOwnershipPrivilege 5652 msiexec.exe Token: SeLoadDriverPrivilege 5652 msiexec.exe Token: SeSystemProfilePrivilege 5652 msiexec.exe Token: SeSystemtimePrivilege 5652 msiexec.exe Token: SeProfSingleProcessPrivilege 5652 msiexec.exe Token: SeIncBasePriorityPrivilege 5652 msiexec.exe Token: SeCreatePagefilePrivilege 5652 msiexec.exe Token: SeCreatePermanentPrivilege 5652 msiexec.exe Token: SeBackupPrivilege 5652 msiexec.exe Token: SeRestorePrivilege 5652 msiexec.exe Token: SeShutdownPrivilege 5652 msiexec.exe Token: SeDebugPrivilege 5652 msiexec.exe Token: SeAuditPrivilege 5652 msiexec.exe Token: SeSystemEnvironmentPrivilege 5652 msiexec.exe Token: SeChangeNotifyPrivilege 5652 msiexec.exe Token: SeRemoteShutdownPrivilege 5652 msiexec.exe Token: SeUndockPrivilege 5652 msiexec.exe Token: SeSyncAgentPrivilege 5652 msiexec.exe Token: SeEnableDelegationPrivilege 5652 msiexec.exe Token: SeManageVolumePrivilege 5652 msiexec.exe Token: SeImpersonatePrivilege 5652 msiexec.exe Token: SeCreateGlobalPrivilege 5652 msiexec.exe Token: SeCreateTokenPrivilege 5652 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5652 msiexec.exe Token: SeLockMemoryPrivilege 5652 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5652 msiexec.exe 5652 msiexec.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 860 wrote to memory of 5652 860 setup.exe 87 PID 5696 wrote to memory of 5900 5696 msiexec.exe 91 PID 5696 wrote to memory of 4068 5696 msiexec.exe 110 PID 5696 wrote to memory of 1552 5696 msiexec.exe 112 PID 5696 wrote to memory of 5428 5696 msiexec.exe 113 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Release_Launcher\setup.exe"C:\Users\Admin\AppData\Local\Temp\Release_Launcher\setup.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\Admin\AppData\Local\Temp\Release_Launcher\FH_FHV Launcher.msi"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5652
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 482CC90E1600FEAE05E8D8FBB9F48158 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5900
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4068
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C34CD12C6ABF28D48CC5398EF27B2AB32⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1552
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7A2DB43A91796FB2C995B89AF0D31E2D E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5428
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1692
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58fdd4.rbs
- Size 133KB
- SHA256 13bb5253225d8f3cb2cb1270a0a2785e9c62ba6d1390e355d5dcfb1ad95542c9
- MD5 32fd2dccaada5a4a898f8dd92fdf8e15
- SHA1 251153f0044837bbf8e02296a1e5f20bc3a53df3
- SHA512 07bec95ab19b8b70f29f0b7277ddbd2772cee3960a8589832ae2996bed4a1a51cff55cc001fb7f221af0ccff75f481c06ca66ed9a8397b44d100268df50d2b1d
- SSDEEP 1536:64SFJ9IC6WRtBzgv6IvCKt72WU+F4SFJ9IC6WRtBzgv6IvCKt72WU+Pd:644EZtCoF44EZtCoV
- TLSH T121D39D2175A0C0F2D49B477D459AE70E6BBAB7826F35905337DE428D0E723D4AB3A309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\OMRON\FZ_FH_FJ_SimulatorLauncher\CustomAction.dll
- Size 11KB
- SHA256 1850d64471a08a9e6f6060e8e0a9195fc4ba70d0ba029bd32908026b9f2813dd
- MD5 d7af3177590cc65e227622e2f0b19dd9
- SHA1 a1b0329b6d9365293d6ae6f5d3cd41c1ec7633ae
- SHA512 c0373e8484305a42e7dc7d183a982a88adaa109e1ddc213f6f0cebec33d054a6d0b28d8dbbd2fd3b36dd4c116ce3b9292da0853df303f56dc5acca8b96f27eec
- SSDEEP 192:HKAX8zK/XOZV4nlYJL/erp0tIDLR3azEEF3Je5:HK28zK/Xmvqrpw+LR3aHFZq
- TLSH T12E32D71693E2C276DE2A8B32498393A10632EF44C563AF7F5554726E6CF32440F93B79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\OMRON\FZ_FH_FJ_SimulatorLauncher\FH-SimulatorLauncher.ini
- Size 234B
- SHA256 32fcb7eb994dfc5d2188e6d67357cca96a12e02d761394eb46432524cd4efb2e
- MD5 48c55a70f7dc8082fe58b6090e4f08c1
- SHA1 e3157c2f72136d4ee14e595fd24ea0de4eef93bd
- SHA512 ef7afe6388a0c9ccc25f9de10e0f97bfe7dfceb0f52a0d603565f5921d251ebdd59390e4d64f5c20cadc7b0fdaa91889a0b9a2a173fe755ec4f972abcb657cc1
- TLSH T18DD0922B03B8011CBAB3FA85EDB5252D5627B987B81AE52C13A4410E80F60048C13BA3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\CFGFF79.tmp
- Size 123B
- SHA256 a558dbe555749cd3bdd62060fdbba72720c4f4a186d5870b977ed2acf9721d9e
- MD5 17af548f88a3199aa8a63a72201f470f
- SHA1 4e64bb20a2f54d778ed684aa21abebad63a5c2c0
- SHA512 08bdbc75f5fd4d9ec85c53253e4030ce7245b20ecc95e032835609c7c43a07d6c9e7776f48c5494a788a543240c0649a9f1a34a0e514ebc4dda5730953647338
- TLSH T1D9B092464628BD2B7C230F6797660E41BF7402A1527A000CD09F3B2726020AEA35A306
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI64D0.tmp
- Size 222KB
- SHA256 46ac1cedf9f1383cf45704adf0a7f2128971435bdef0ab8e4ca64f681b2fd4cc
- MD5 efb1ce5e01ede07c24e93b5bb7773026
- SHA1 063a3624a740fcc63e79608ce172d79251b4c74d
- SHA512 a8ba52c383a5bdc5e39f2c56b8fe8496d3a21b4cc7dd8ba7b08a79949584bbaa0da0d881244be260e224863fed3fc144aeaef57e58535465ae1de46836cfc128
- SSDEEP 3072:7T4Du85Prvj1UYLg7EtRMRws9khfXEoMUL19vwQQBvY6+tyXEbRUr075qfFl8Cyt:+rvrgw72ws9wcUh9pFtyXuo0UfvgF
- TLSH T168246A203AE0D131D4E331B856ACE6241ABEB9B05B32C1C763941BED9D70BD1AB3474B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI1AF.tmp
- Size 61KB
- SHA256 e7b15de9d5458d886f7f9f06dec88e41fbe776379c342033df157c5c3be4ce67
- MD5 4bd22c6050cbbe090c3d28ff6ca20a6b
- SHA1 b743f1815b3bb7767b80ac200366d0c02ab84afa
- SHA512 fca9d3194f3faa7bb1a25799e8d892f23424e8e172e9fde1dc1f3ea44fe4c82b9a807356a6f88c058d02eec62a4263a2236efe75183018c1e926833bf468ff0a
- SSDEEP 768:fi4TGmiFbNq6ICrOWjySxrDNBzLMv6IvNHUjf+5dt72wqkU+iw:K4SFJ9IC6WRtBzgv6IvCKt72WU+/
- TLSH T1B1539D2135B0C4B2D4574A7D14EAE70A6B7ABA437E76D443379A12CD0E723D1A73E30A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58fdd3.msi
- Size 553KB
- SHA256 34a09c28f623d1048711a38e14de0e09178e97940dd0c8146bb7e646b2acc90c
- MD5 b894e07ff9debdd0fc44810cae58843c
- SHA1 f2850955976c50d31e87dba54555f39336eada49
- SHA512 d94f3a78ce6666dd50a48c4e38bc46525572439ef2ad9d77aa357bc39fe85345264b2b0063ecf7c7545099ca41c6a89ee297792c1aa916e3b909ff3276c2e841
- SSDEEP 12288:qEIrDgw7s9wBhnyXuobvgLoW3bdvacv2:qEqThCuob4LoWx
- TLSH T176C4AD217AC3C631C4932235559FE7644B7ABC201B7682C772983B8E6DB2BE07735786
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 c64168a57fa0daf022f1d201b38ca74a282b6334fed00c917f3c806ac00b85fc
- MD5 acdd0a26317bcf7c29fa4a3404f30460
- SHA1 8270ca495c4efaf4504ea289923cc74bda36b314
- SHA512 d25bdee29e5196b91fdd38a8548b21cd67e234321a4ef57b5f721d81d979abb84bf52be436c702ca811a68b3ca3cddcc816ceded2a7858b5e0fb7f1b4475faf5
- SSDEEP 24576:iu8m+1zqdoO/vvTL7WNeImKZc00jV1dShLmtPC8Vl0aMOqkAIv1UF7GRo:X
- TLSH T14547C42437FD2210E7F79E3C68F06A27893A7D5B9C159E8D05411F8E0961BB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{12d9ef41-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{16995925-98ea-48c6-8cb3-33428901a4eb}_OnDiskSnapshotProp
- Size 6KB
- SHA256 929ebdb717e931346484e56e2da5481504786caa63a10f6a4a5711fd2690b80a
- MD5 8d4213d40b93a72b036207ef5cc78e61
- SHA1 48766f0b39670c278a900c37fa40e954a777dfec
- SHA512 71f4415b1c1f353ec649cfdd6279f9630586e7aa4d90a4321be2891cd4c0e4514788dcc9f0a6dba862cac53e5f6b05db6eb9efa636462de39eb694a94e4f2118
- SSDEEP 96:FnNn5vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:Jhb++ZVm
- TLSH T1C2D199085AF54311E2B3AB7129F18557A877B811EF33CB8E0198638E2670A10F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH