Overview
overview
7Static
static
3Release_FH...64.msi
windows10-2004-x64
7Release_FH...64.msi
windows11-21h2-x64
7Release_FH...up.exe
windows10-2004-x64
7Release_FH...up.exe
windows11-21h2-x64
7Release_La...er.msi
windows10-2004-x64
7Release_La...er.msi
windows11-21h2-x64
7Release_La...up.exe
windows10-2004-x64
7Release_La...up.exe
windows11-21h2-x64
7Simulation...4B.pdf
windows10-2004-x64
3Simulation...4B.pdf
windows11-21h2-x64
3Simulation...8.docx
windows10-2004-x64
1Simulation...8.docx
windows11-21h2-x64
1Analysis
- max time kernel
149s - max time network
156s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
30/05/2026, 12:14
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Release_FH(x64)/FH Simulator_x64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Release_FH(x64)/FH Simulator_x64.msi
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Release_FH(x64)/setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
Release_FH(x64)/setup.exe
Resource
win11-20260513-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
Release_Launcher/FH_FHV Launcher.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral6
Sample
Release_Launcher/FH_FHV Launcher.msi
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral7
Sample
Release_Launcher/setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral8
Sample
Release_Launcher/setup.exe
Resource
win11-20260513-en
windows11-21h2-x64
13 signatures
150 seconds
Behavioral task
behavioral9
Sample
Simulation software_v640_64bit/FZ_FH_FJ_Launcher_Instruction_manual_S2D-175074B.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral10
Sample
Simulation software_v640_64bit/FZ_FH_FJ_Launcher_Instruction_manual_S2D-175074B.pdf
Resource
win11-20260513-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
Simulation software_v640_64bit/How to use simulation software_201808.docx
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
Simulation software_v640_64bit/How to use simulation software_201808.docx
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target Release_Launcher/setup.exe
- Size 370KB
- Sample260530-pellfady6k
- SHA256 4f590f0b3e2118b48736949c6a630858347e766052edbeaf41b1dc18bc8d63ad
- MD5 2092c29fc05ae7abda6c3e88814664e4
- SHA1 31319c520e8e0cb69a62f84123e5978ce4004b0f
- SHA512 3452a8ba46ae0dc8fdc2d556423b136a4d7c9e2b078f83d55f7c057aaf709abe135b3621742f30becf08981a7a9588c17ea517975f6cbba02593f1e014079559
- SSDEEP 6144:VXaNjt6LuPHmLyiBvuJiFkJ+2Qw+MMq6FlOUeKJ6qjaeojDuUly1:lYYuUx65QwDMq6TOUreDuUlU
- TLSH T1B0845A227694D031E8A312B44A6D63315ABEEC74173586C7A7C423EEDDB07D29E3078B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 10 IoCs
pid Process 3328 MsiExec.exe 3328 MsiExec.exe 5088 MsiExec.exe 5088 MsiExec.exe 4216 MsiExec.exe 4216 MsiExec.exe 4216 MsiExec.exe 4216 MsiExec.exe 4216 MsiExec.exe 4216 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe - Drops file in Windows directory 20 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\e58f385.msi msiexec.exe File created C:\Windows\SystemTemp\~DF13E04218C1ED0E23.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DFE68D58C4BE04BD5D.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIF54A.tmp msiexec.exe File created C:\Windows\Installer\{909FEF75-5C13-48F8-B1AB-8BE788021472}\_8B41BE6FA1441BD7E60CE1.exe msiexec.exe File opened for modification C:\Windows\Installer\{909FEF75-5C13-48F8-B1AB-8BE788021472}\_8B41BE6FA1441BD7E60CE1.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIF6F1.tmp msiexec.exe File created C:\Windows\Installer\e58f383.msi msiexec.exe File opened for modification C:\Windows\Installer\e58f383.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF400.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF126A2095A7351A21.TMP msiexec.exe File created C:\Windows\Installer\{909FEF75-5C13-48F8-B1AB-8BE788021472}\_0DB1106DB6483709D71407.exe msiexec.exe File opened for modification C:\Windows\Installer\{909FEF75-5C13-48F8-B1AB-8BE788021472}\_0DB1106DB6483709D71407.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIF905.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{909FEF75-5C13-48F8-B1AB-8BE788021472} msiexec.exe File created C:\Windows\SystemTemp\~DFB2B79F4632CD1DEC.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIF4AD.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000643a9eb9192046c00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000643a9eb90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900643a9eb9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a643a9eb9000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d643a9eb9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe - Modifies registry class 28 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\Version = "16908288" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\SourceList\PackageName = "FH_FHV Launcher.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Release_Launcher\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\PackageCode = "443E9BF6A15104942925DDB9A6BAFF2C" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3DC694A1CC909FC4DA0941119E52C3FD msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|OMRON|FZ_FH_FJ_SimulatorLauncher|Licence|FH_FHV License Tool.exe\FH_FHV License Tool,Version="1.0.0.0",Culture="neutral",ProcessorArchitecture="x86" = 69007e007d005000560029004d004f004e003f004e004a0058004b00730035005a00510061004c003e003000310028005f002a004b0045003f00740039007500430066007e006c006c006c0039005400540000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\57FEF90931C58F841BBAB87E88204127 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3DC694A1CC909FC4DA0941119E52C3FD\57FEF90931C58F841BBAB87E88204127 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\SourceList msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\Release_Launcher\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|OMRON|FZ_FH_FJ_SimulatorLauncher|Licence|FH_FHV License Tool.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|OMRON|FZ_FH_FJ_SimulatorLauncher|CustomAction.dll msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|OMRON|FZ_FH_FJ_SimulatorLauncher|CustomAction.dll\CustomAction,Version="1.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 69007e007d005000560029004d004f004e003f004e004a0058004b00730035005a00510061004c003e00710066004e007a0064003800320079007800530067004f0027006d007100390045005a006e00410000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\57FEF90931C58F841BBAB87E88204127\DefaultFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|OMRON|FZ_FH_FJ_SimulatorLauncher|FH-SimulatorLauncher.exe msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|OMRON|FZ_FH_FJ_SimulatorLauncher|FH-SimulatorLauncher.exe\FH-SimulatorLauncher,Version="1.2.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 69007e007d005000560029004d004f004e003f004e004a0058004b00730035005a00510061004c003e004400440065007b0056007a0067006900780038006300600028002c006d007600470031002e00550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57FEF90931C58F841BBAB87E88204127\ProductName = "FH/FHV Launcher" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3632 msiexec.exe 3632 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2072 msiexec.exe Token: SeIncreaseQuotaPrivilege 2072 msiexec.exe Token: SeSecurityPrivilege 3632 msiexec.exe Token: SeCreateTokenPrivilege 2072 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2072 msiexec.exe Token: SeLockMemoryPrivilege 2072 msiexec.exe Token: SeIncreaseQuotaPrivilege 2072 msiexec.exe Token: SeMachineAccountPrivilege 2072 msiexec.exe Token: SeTcbPrivilege 2072 msiexec.exe Token: SeSecurityPrivilege 2072 msiexec.exe Token: SeTakeOwnershipPrivilege 2072 msiexec.exe Token: SeLoadDriverPrivilege 2072 msiexec.exe Token: SeSystemProfilePrivilege 2072 msiexec.exe Token: SeSystemtimePrivilege 2072 msiexec.exe Token: SeProfSingleProcessPrivilege 2072 msiexec.exe Token: SeIncBasePriorityPrivilege 2072 msiexec.exe Token: SeCreatePagefilePrivilege 2072 msiexec.exe Token: SeCreatePermanentPrivilege 2072 msiexec.exe Token: SeBackupPrivilege 2072 msiexec.exe Token: SeRestorePrivilege 2072 msiexec.exe Token: SeShutdownPrivilege 2072 msiexec.exe Token: SeDebugPrivilege 2072 msiexec.exe Token: SeAuditPrivilege 2072 msiexec.exe Token: SeSystemEnvironmentPrivilege 2072 msiexec.exe Token: SeChangeNotifyPrivilege 2072 msiexec.exe Token: SeRemoteShutdownPrivilege 2072 msiexec.exe Token: SeUndockPrivilege 2072 msiexec.exe Token: SeSyncAgentPrivilege 2072 msiexec.exe Token: SeEnableDelegationPrivilege 2072 msiexec.exe Token: SeManageVolumePrivilege 2072 msiexec.exe Token: SeImpersonatePrivilege 2072 msiexec.exe Token: SeCreateGlobalPrivilege 2072 msiexec.exe Token: SeCreateTokenPrivilege 2072 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2072 msiexec.exe Token: SeLockMemoryPrivilege 2072 msiexec.exe Token: SeIncreaseQuotaPrivilege 2072 msiexec.exe Token: SeMachineAccountPrivilege 2072 msiexec.exe Token: SeTcbPrivilege 2072 msiexec.exe Token: SeSecurityPrivilege 2072 msiexec.exe Token: SeTakeOwnershipPrivilege 2072 msiexec.exe Token: SeLoadDriverPrivilege 2072 msiexec.exe Token: SeSystemProfilePrivilege 2072 msiexec.exe Token: SeSystemtimePrivilege 2072 msiexec.exe Token: SeProfSingleProcessPrivilege 2072 msiexec.exe Token: SeIncBasePriorityPrivilege 2072 msiexec.exe Token: SeCreatePagefilePrivilege 2072 msiexec.exe Token: SeCreatePermanentPrivilege 2072 msiexec.exe Token: SeBackupPrivilege 2072 msiexec.exe Token: SeRestorePrivilege 2072 msiexec.exe Token: SeShutdownPrivilege 2072 msiexec.exe Token: SeDebugPrivilege 2072 msiexec.exe Token: SeAuditPrivilege 2072 msiexec.exe Token: SeSystemEnvironmentPrivilege 2072 msiexec.exe Token: SeChangeNotifyPrivilege 2072 msiexec.exe Token: SeRemoteShutdownPrivilege 2072 msiexec.exe Token: SeUndockPrivilege 2072 msiexec.exe Token: SeSyncAgentPrivilege 2072 msiexec.exe Token: SeEnableDelegationPrivilege 2072 msiexec.exe Token: SeManageVolumePrivilege 2072 msiexec.exe Token: SeImpersonatePrivilege 2072 msiexec.exe Token: SeCreateGlobalPrivilege 2072 msiexec.exe Token: SeCreateTokenPrivilege 2072 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2072 msiexec.exe Token: SeLockMemoryPrivilege 2072 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2072 msiexec.exe 2072 msiexec.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1176 wrote to memory of 2072 1176 setup.exe 82 PID 3632 wrote to memory of 3328 3632 msiexec.exe 84 PID 3632 wrote to memory of 1756 3632 msiexec.exe 88 PID 3632 wrote to memory of 5088 3632 msiexec.exe 90 PID 3632 wrote to memory of 4216 3632 msiexec.exe 91 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Release_Launcher\setup.exe"C:\Users\Admin\AppData\Local\Temp\Release_Launcher\setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\Admin\AppData\Local\Temp\Release_Launcher\FH_FHV Launcher.msi"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2072
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7D1C97D0B0BA0A0B2DD9BC90DE6D0AF9 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3328
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1756
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E465A12C66622855DF047E46C4D780CF2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5088
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4E342F7397BD05B356446B061B8954ED E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4216
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3720
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58f384.rbs
- Size 133KB
- SHA256 75aaf3a44b536c723d1bc824a9dd95cbf15c3f14432570536e92771066b124a2
- MD5 bf88dbb11d600dc2ef8127cb85fd3b1e
- SHA1 656ad70a027e777d02d4cb206a0a4a866f24ecc9
- SHA512 ec04fd9f179d4ee85533ef6d4aed7ca9b46bbe6b0d743bab997c16dff9fccbad38c0f009580c9ec54219cc311fdf22d85f4cd71b205836cb5fd49529305a2c3c
- SSDEEP 1536:Y4SFJ9IC6WRtBzgv6IvCKt72WU+G4SFJ9IC6WRtBzgv6IvCKt72WU+rd:Y44EZtCoG44EZtCop
- TLSH T18DD39D2175A0C0F2D49B477D459AE70E6BBAB7826F35904337DE028D0E723D4AB3A309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\OMRON\FZ_FH_FJ_SimulatorLauncher\CustomAction.dll
- Size 11KB
- SHA256 1850d64471a08a9e6f6060e8e0a9195fc4ba70d0ba029bd32908026b9f2813dd
- MD5 d7af3177590cc65e227622e2f0b19dd9
- SHA1 a1b0329b6d9365293d6ae6f5d3cd41c1ec7633ae
- SHA512 c0373e8484305a42e7dc7d183a982a88adaa109e1ddc213f6f0cebec33d054a6d0b28d8dbbd2fd3b36dd4c116ce3b9292da0853df303f56dc5acca8b96f27eec
- SSDEEP 192:HKAX8zK/XOZV4nlYJL/erp0tIDLR3azEEF3Je5:HK28zK/Xmvqrpw+LR3aHFZq
- TLSH T12E32D71693E2C276DE2A8B32498393A10632EF44C563AF7F5554726E6CF32440F93B79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\OMRON\FZ_FH_FJ_SimulatorLauncher\FH-SimulatorLauncher.ini
- Size 234B
- SHA256 32fcb7eb994dfc5d2188e6d67357cca96a12e02d761394eb46432524cd4efb2e
- MD5 48c55a70f7dc8082fe58b6090e4f08c1
- SHA1 e3157c2f72136d4ee14e595fd24ea0de4eef93bd
- SHA512 ef7afe6388a0c9ccc25f9de10e0f97bfe7dfceb0f52a0d603565f5921d251ebdd59390e4d64f5c20cadc7b0fdaa91889a0b9a2a173fe755ec4f972abcb657cc1
- TLSH T18DD0922B03B8011CBAB3FA85EDB5252D5627B987B81AE52C13A4410E80F60048C13BA3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\CFGF48C.tmp
- Size 123B
- SHA256 a558dbe555749cd3bdd62060fdbba72720c4f4a186d5870b977ed2acf9721d9e
- MD5 17af548f88a3199aa8a63a72201f470f
- SHA1 4e64bb20a2f54d778ed684aa21abebad63a5c2c0
- SHA512 08bdbc75f5fd4d9ec85c53253e4030ce7245b20ecc95e032835609c7c43a07d6c9e7776f48c5494a788a543240c0649a9f1a34a0e514ebc4dda5730953647338
- TLSH T1D9B092464628BD2B7C230F6797660E41BF7402A1527A000CD09F3B2726020AEA35A306
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI508C.tmp
- Size 222KB
- SHA256 46ac1cedf9f1383cf45704adf0a7f2128971435bdef0ab8e4ca64f681b2fd4cc
- MD5 efb1ce5e01ede07c24e93b5bb7773026
- SHA1 063a3624a740fcc63e79608ce172d79251b4c74d
- SHA512 a8ba52c383a5bdc5e39f2c56b8fe8496d3a21b4cc7dd8ba7b08a79949584bbaa0da0d881244be260e224863fed3fc144aeaef57e58535465ae1de46836cfc128
- SSDEEP 3072:7T4Du85Prvj1UYLg7EtRMRws9khfXEoMUL19vwQQBvY6+tyXEbRUr075qfFl8Cyt:+rvrgw72ws9wcUh9pFtyXuo0UfvgF
- TLSH T168246A203AE0D131D4E331B856ACE6241ABEB9B05B32C1C763941BED9D70BD1AB3474B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIF6F1.tmp
- Size 61KB
- SHA256 e7b15de9d5458d886f7f9f06dec88e41fbe776379c342033df157c5c3be4ce67
- MD5 4bd22c6050cbbe090c3d28ff6ca20a6b
- SHA1 b743f1815b3bb7767b80ac200366d0c02ab84afa
- SHA512 fca9d3194f3faa7bb1a25799e8d892f23424e8e172e9fde1dc1f3ea44fe4c82b9a807356a6f88c058d02eec62a4263a2236efe75183018c1e926833bf468ff0a
- SSDEEP 768:fi4TGmiFbNq6ICrOWjySxrDNBzLMv6IvNHUjf+5dt72wqkU+iw:K4SFJ9IC6WRtBzgv6IvCKt72WU+/
- TLSH T1B1539D2135B0C4B2D4574A7D14EAE70A6B7ABA437E76D443379A12CD0E723D1A73E30A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58f383.msi
- Size 553KB
- SHA256 34a09c28f623d1048711a38e14de0e09178e97940dd0c8146bb7e646b2acc90c
- MD5 b894e07ff9debdd0fc44810cae58843c
- SHA1 f2850955976c50d31e87dba54555f39336eada49
- SHA512 d94f3a78ce6666dd50a48c4e38bc46525572439ef2ad9d77aa357bc39fe85345264b2b0063ecf7c7545099ca41c6a89ee297792c1aa916e3b909ff3276c2e841
- SSDEEP 12288:qEIrDgw7s9wBhnyXuobvgLoW3bdvacv2:qEqThCuob4LoWx
- TLSH T176C4AD217AC3C631C4932235559FE7644B7ABC201B7682C772983B8E6DB2BE07735786
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 bc1a2e3fd7b61b8e77acda2d30dfba60537a7cfbfaebae4803b2207ea33fa1c9
- MD5 de060fc8c074d0345c6348cba556318f
- SHA1 b1e7fa061da952a1e72665b6d1a35bec26e3cc95
- SHA512 2541fa2071d07491e7559efae95aa0e6e87fe42d4be8a71b7790040d062ea717679bf6ceb7fa3c7b0acd6988b00beba6aa8d4d7b56fe176573692b88e8298b28
- SSDEEP 24576:Q2gmSp1LdoO/vvTLaWxOBk3afqpaA4Fr22CN3JEBYK6YktF046AWrMr2x:u
- TLSH T1C647C22436F92210E7F79E3CA8F06A234A3E7D5B9C15DE8D45451B4E0921FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{b99e3a64-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6bbd1e30-d7cd-426a-8fbd-6700d01a6c13}_OnDiskSnapshotProp
- Size 6KB
- SHA256 04b7e6af26e6d802ae7058dc4e370012460f599a84015d50109ff053052dc11e
- MD5 8523045227b65184979c636411a666e1
- SHA1 fc2664a86a1b2f30980e7f4e57bb0723c068c274
- SHA512 ac2717197ffc4a3ebe70279ebae22f117ad9b0d3323070c1dffae226c95d10c871ebdd08e3a0a9d7076eff9a57830f550eb44a7c7d3198491c13e1b757e4f9c5
- SSDEEP 96:FHNtJ5vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:1hTb++ZVm
- TLSH T163D199085AE54711E2B3AB3129F54557A877B811EF33CB8E0198638F2670A10F936F5F
- MD5 SHA1 SHA512 SSDEEP TLSH