7c4708d1c6dd413ac502e9f006920585311c976ade74dd3594eb74dc7c705268

Analysis

max time kernel
899s
max time network
535s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
shhh/Toon Boom Harmony Premium & Storyboard Pro v 24/Toon Boom Harmony Premium 24/HAR24-PRM-win-23019.exe
Size 555.2MB
Sample260722-e7xjasaf37
SHA256 7c4708d1c6dd413ac502e9f006920585311c976ade74dd3594eb74dc7c705268
MD5 82ef7be5070d00b7e64b9888260c9cb1
SHA1 e07bdc2dd066101ba31630e5c107296b88aaf813
SHA512 647e7459ca2caeb04f42ff0cbba6de11ef8375bf187e9a048f5414b83dec283caf094af4d54f60fc5c1b1d2ea5a65cbfe169baa55dad35b5c23713bb25e2e734
SSDEEP 12582912:h0bTTm11MSFYp/jhu7/DkU/MZUj9ZqmMK5HNC/JOcnG7b9MgAd0/:hyTTTdYD119Io5tKNneb9MgAd6
TLSH
T1D9593345D285507CD1F1583EADCF8DB4742E69738E50D28632B4FE2A4EE8642390FB7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
32	1276	MSIEXEC.EXE
46	1276	MSIEXEC.EXE
49	1276	MSIEXEC.EXE
53	1276	MSIEXEC.EXE
57	1276	MSIEXEC.EXE
60	1276	MSIEXEC.EXE
62	1276	MSIEXEC.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	MSIEXEC.EXE
File opened (read-only)	\??\E:	MSIEXEC.EXE
File opened (read-only)	\??\H:	MSIEXEC.EXE
File opened (read-only)	\??\J:	MSIEXEC.EXE
File opened (read-only)	\??\K:	MSIEXEC.EXE
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	MSIEXEC.EXE
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	MSIEXEC.EXE
File opened (read-only)	\??\Z:	MSIEXEC.EXE
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	MSIEXEC.EXE
File opened (read-only)	\??\I:	MSIEXEC.EXE
File opened (read-only)	\??\P:	MSIEXEC.EXE
File opened (read-only)	\??\R:	MSIEXEC.EXE
File opened (read-only)	\??\S:	MSIEXEC.EXE
File opened (read-only)	\??\W:	MSIEXEC.EXE
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	MSIEXEC.EXE
File opened (read-only)	\??\U:	MSIEXEC.EXE
File opened (read-only)	\??\X:	MSIEXEC.EXE
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	MSIEXEC.EXE
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	MSIEXEC.EXE
File opened (read-only)	\??\Q:	MSIEXEC.EXE
File opened (read-only)	\??\M:	MSIEXEC.EXE
File opened (read-only)	\??\V:	MSIEXEC.EXE
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	MSIEXEC.EXE
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Downloaded Installations\{D82D8E8B-43C1-491B-8BC3-A41197E1C65B}\Toon Boom Harmony 24 Premium.msi	HAR24-PRM-win-23019.exe
File created	C:\Windows\Downloaded Installations\{D82D8E8B-43C1-491B-8BC3-A41197E1C65B}\1033.MST	HAR24-PRM-win-23019.exe
File created	C:\Windows\Downloaded Installations\{D82D8E8B-43C1-491B-8BC3-A41197E1C65B}\Toon Boom Harmony 24 Premium.msi	HAR24-PRM-win-23019.exe

Executes dropped EXE 1 IoCs

pid	Process
4772	HAR24-PRM-win-23019.exe

Loads dropped DLL 1 IoCs

pid	Process
2216	MsiExec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HAR24-PRM-win-23019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HAR24-PRM-win-23019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1276	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	1276	MSIEXEC.EXE
Token: SeSecurityPrivilege	4580	msiexec.exe
Token: SeCreateTokenPrivilege	1276	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	1276	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	1276	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	1276	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	1276	MSIEXEC.EXE
Token: SeTcbPrivilege	1276	MSIEXEC.EXE
Token: SeSecurityPrivilege	1276	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	1276	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	1276	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	1276	MSIEXEC.EXE
Token: SeSystemtimePrivilege	1276	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	1276	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	1276	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	1276	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	1276	MSIEXEC.EXE
Token: SeBackupPrivilege	1276	MSIEXEC.EXE
Token: SeRestorePrivilege	1276	MSIEXEC.EXE
Token: SeShutdownPrivilege	1276	MSIEXEC.EXE
Token: SeDebugPrivilege	1276	MSIEXEC.EXE
Token: SeAuditPrivilege	1276	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	1276	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	1276	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	1276	MSIEXEC.EXE
Token: SeUndockPrivilege	1276	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	1276	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	1276	MSIEXEC.EXE
Token: SeManageVolumePrivilege	1276	MSIEXEC.EXE
Token: SeImpersonatePrivilege	1276	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	1276	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	1276	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	1276	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	1276	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	1276	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	1276	MSIEXEC.EXE
Token: SeTcbPrivilege	1276	MSIEXEC.EXE
Token: SeSecurityPrivilege	1276	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	1276	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	1276	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	1276	MSIEXEC.EXE
Token: SeSystemtimePrivilege	1276	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	1276	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	1276	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	1276	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	1276	MSIEXEC.EXE
Token: SeBackupPrivilege	1276	MSIEXEC.EXE
Token: SeRestorePrivilege	1276	MSIEXEC.EXE
Token: SeShutdownPrivilege	1276	MSIEXEC.EXE
Token: SeDebugPrivilege	1276	MSIEXEC.EXE
Token: SeAuditPrivilege	1276	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	1276	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	1276	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	1276	MSIEXEC.EXE
Token: SeUndockPrivilege	1276	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	1276	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	1276	MSIEXEC.EXE
Token: SeManageVolumePrivilege	1276	MSIEXEC.EXE
Token: SeImpersonatePrivilege	1276	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	1276	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	1276	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	1276	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	1276	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1276	MSIEXEC.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 4772	632	HAR24-PRM-win-23019.exe	82
PID 4772 wrote to memory of 1276	4772	HAR24-PRM-win-23019.exe	94
PID 4580 wrote to memory of 2216	4580	msiexec.exe	109

C:\Users\Admin\AppData\Local\Temp\shhh\Toon Boom Harmony Premium & Storyboard Pro v 24\Toon Boom Harmony Premium 24\HAR24-PRM-win-23019.exe
"C:\Users\Admin\AppData\Local\Temp\shhh\Toon Boom Harmony Premium & Storyboard Pro v 24\Toon Boom Harmony Premium 24\HAR24-PRM-win-23019.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:632
- C:\Users\Admin\AppData\Local\Temp\{AA55D0CC-04AE-485A-919F-DBDEA0197C97}\HAR24-PRM-win-23019.exe
  C:\Users\Admin\AppData\Local\Temp\{AA55D0CC-04AE-485A-919F-DBDEA0197C97}\HAR24-PRM-win-23019.exe /q"C:\Users\Admin\AppData\Local\Temp\shhh\Toon Boom Harmony Premium & Storyboard Pro v 24\Toon Boom Harmony Premium 24\HAR24-PRM-win-23019.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{AA55D0CC-04AE-485A-919F-DBDEA0197C97}" /IS_temp
  2⤵
  - Drops file in Windows directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\SysWOW64\MSIEXEC.EXE
    "C:\Windows\system32\MSIEXEC.EXE" /i "C:\Windows\Downloaded Installations\{D82D8E8B-43C1-491B-8BC3-A41197E1C65B}\Toon Boom Harmony 24 Premium.msi" TRANSFORMS="C:\Windows\Downloaded Installations\{D82D8E8B-43C1-491B-8BC3-A41197E1C65B}\1033.MST" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\shhh\Toon Boom Harmony Premium & Storyboard Pro v 24\Toon Boom Harmony Premium 24" SETUPEXENAME="HAR24-PRM-win-23019.exe"
    3⤵
    - Badlisted process makes network request
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1276

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6A8C61617A01D7C910FC9954D1777F34 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSI3A0D.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI3A0D.tmp
Size 166KB
SHA256 d4b028c81ed4d593240afad9db36565ffe2c26d4dc4edf025655dd1d338168eb
MD5 791c89209ece2aaafff0cf28d42763aa
SHA1 862c87e5920640c5c825d54740c15d0cc99e1120
SHA512 0e5d037cdd0df3cf5caad2c9f973e57dd70512f9d382beb7ec39aca15aba5f43764b7b075c8a9bbfac3154d274469f18db9dd8f3dd9bc22e03b567873d552e7b
SSDEEP 3072:jq3oP/44Yvge5XKhpKJJdu+ew+BZPHbNz8+nGq:jQg/ve5XKhMVJSRLn9
TLSH
T1A2F3281177E18034E5EF1A3A69749A264B7F7C72CB7489CBB384464E1D70AC1AE35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0x0409.ini

Path C:\Users\Admin\AppData\Local\Temp\{AA55D0CC-04AE-485A-919F-DBDEA0197C97}\0x0409.ini
Size 21KB
SHA256 8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948
MD5 a108f0030a2cda00405281014f897241
SHA1 d112325fa45664272b08ef5e8ff8c85382ebb991
SHA512 d83894b039316c38915a789920758664257680dcb549a9b740cf5361addbee4d4a96a3ff2999b5d8acfb1d9336da055ec20012d29a9f83ee5459f103fbeec298
SSDEEP 384:CTmyuV//BiTbh/YgAwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/t/lWr0aa0Mhs+XVgv
TLSH
T1BBA2B95667F94219F6F77F50FDB812221E7ABC82AC38D25C1280499D09F1E84D8B1B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.INI

Path C:\Users\Admin\AppData\Local\Temp\{AA55D0CC-04AE-485A-919F-DBDEA0197C97}\Setup.INI
Size 5KB
SHA256 ade9e65b36baeff60a762bde75374cea0e3b8298f54e44fa0f94ad54a5d30c00
MD5 8620ae32cce034169e671afd57d78c82
SHA1 a30843dbe5c4952cc34dbd6d85585f64254affec
SHA512 28ed03f6ef71e75b2980e6412686a1dc68d10aba282cebcfd025b173e7accb9724911adc898a769685798b56376640818e177c92523cba16b68c0253878c6da3
SSDEEP 96:rEhkMaEZGLbONfPXXsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05w7tCYOvlnAM2:YhcrKcuQaEZhdxoIWRGcQbPr/p0050tZ
TLSH
T1C3C19A172BFA001EF6F35B45DAF4443787263C12292CCA1C55D0875A19F2E828A67BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ISMSIDEL.INI

Path C:\Users\Admin\AppData\Local\Temp\{AA55D0CC-04AE-485A-919F-DBDEA0197C97}\_ISMSIDEL.INI
Size 452B
SHA256 6a67776b0968d8825f1b3ce485a2b3eb6d19832aeac66fa79628272b036264be
MD5 eaa558404f09ea3693365189346d6cda
SHA1 7bbf224726ba3d46f03ee5ae38be8a9d1ab5318f
SHA512 c901764036ed0702a785b6e8de1025d90fbedef77d1725f44408eaee4bffeb81a0d62e3b7c38e4c113fdb2665f1256852526183cb5b56367638b4ac1e18e8ef6
TLSH
T1D9F02B633CDC0036F37BE790EFF444DEC2A8B2324805AE0F0081830A0673A154920F6D
MD5 SHA1 SHA512 TLSH

Submit Download

1033.MST

Path C:\Windows\Downloaded Installations\{D82D8E8B-43C1-491B-8BC3-A41197E1C65B}\1033.MST
Size 32KB
SHA256 9077110a5741c276fd59b4014899ac5723679f10f1f28df85d88e474eff584b2
MD5 56fe1c163c64693de539070f35c8b651
SHA1 2f143f1f59fa27e09abc4d76dec53abfb23cf505
SHA512 e191176fddd68817c177e60f28af98334e0e31f888deac1ebea8e7923f9a34a1fd2b8167f61ddad6f01a1d32ff1772558a99640729d36dda9a67d98842e8b3a3
SSDEEP 192:SF5YqCYdu5huwcfBC7+fjJFQqlMHA5K+o/y2sE9jBF0NyxaiKM:SzLdEgwcJCwFLiHAM+o/8E9VF0Nysn
TLSH
T1FBE24992AA18EC40EE474D35BDC8CA6B9D32BE859E8080D33159F30D4BB47917B8B179
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads