Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 00:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Install_28n002.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
Install_28n002.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target Install_28n002.msi
- Size 5.7MB
- Sample260730-afyj3aha92
- SHA256 c53d877ad301a09547c431c07e1f114a393c246724f31f0827ada95b930ec0fb
- MD5 648f28ac4d782d7d0257e50efdd076e9
- SHA1 43ba548c52bd8807103dc588ba92d220c4201799
- SHA512 c25a3639170b5a61663f5e024b91fe1ca52ddf3f5a69d32dfb304991518e0930f9015d3ed6d881c09747e06a87b7188c0df2a8095da9c6a767bb91eaffba3f4b
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHl0:8dCis4BEoZJLm4Kv8w+Gzer6
- TLSH T1755633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0" reg.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2708 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 1944 54e0GS.exe - Loads dropped DLL 2 IoCs
pid Process 1472 MsiExec.exe 1944 54e0GS.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\TEBoJM\\54e0GS.exe\"" 54e0GS.exe - Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 1472 MsiExec.exe 3 1472 MsiExec.exe 4 1472 MsiExec.exe 5 1472 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 5692 cmd.exe 4560 cmd.exe 260 cmd.exe 248 cmd.exe 4648 cmd.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b 54e0GS.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\e59aa6f.msi msiexec.exe File opened for modification C:\Windows\Installer\e59aa6f.msi msiexec.exe File created C:\Windows\SystemTemp\~DF2C0D2B12807143FF.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIAF70.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAFFE.tmp msiexec.exe File created C:\Windows\Installer\e59aa71.msi msiexec.exe File created C:\Windows\SystemTemp\~DFE2CC9D0EC05CA456.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF1AF30B394542FD6B.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{1A6C27A2-FA3D-F13A-46E4-B05FDEE281FB} msiexec.exe File created C:\Windows\SystemTemp\~DF2B2B4939C32CA4FF.TMP msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5792 msiexec.exe - Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2272 cmd.exe 5752 cmd.exe 5748 cmd.exe 3636 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005b2aeec40121f1360000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838015b2aeec40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841015b2aeec4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e35b2aeec400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e65b2aeec400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\PackageName = "Install_28n002.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\PackageCode = "DDBDB3AAAA3DFAD46BC0B0DC3E8339EA" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF\UuueatYAD msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\ProductName = "CNAPP Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AdvertiseFlags = "388" msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2084 schtasks.exe 3160 schtasks.exe 5720 schtasks.exe 4860 schtasks.exe 3860 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3896 msiexec.exe 3896 msiexec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe 1944 54e0GS.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5792 msiexec.exe Token: SeIncreaseQuotaPrivilege 5792 msiexec.exe Token: SeSecurityPrivilege 3896 msiexec.exe Token: SeCreateTokenPrivilege 5792 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5792 msiexec.exe Token: SeLockMemoryPrivilege 5792 msiexec.exe Token: SeIncreaseQuotaPrivilege 5792 msiexec.exe Token: SeMachineAccountPrivilege 5792 msiexec.exe Token: SeTcbPrivilege 5792 msiexec.exe Token: SeSecurityPrivilege 5792 msiexec.exe Token: SeTakeOwnershipPrivilege 5792 msiexec.exe Token: SeLoadDriverPrivilege 5792 msiexec.exe Token: SeSystemProfilePrivilege 5792 msiexec.exe Token: SeSystemtimePrivilege 5792 msiexec.exe Token: SeProfSingleProcessPrivilege 5792 msiexec.exe Token: SeIncBasePriorityPrivilege 5792 msiexec.exe Token: SeCreatePagefilePrivilege 5792 msiexec.exe Token: SeCreatePermanentPrivilege 5792 msiexec.exe Token: SeBackupPrivilege 5792 msiexec.exe Token: SeRestorePrivilege 5792 msiexec.exe Token: SeShutdownPrivilege 5792 msiexec.exe Token: SeDebugPrivilege 5792 msiexec.exe Token: SeAuditPrivilege 5792 msiexec.exe Token: SeSystemEnvironmentPrivilege 5792 msiexec.exe Token: SeChangeNotifyPrivilege 5792 msiexec.exe Token: SeRemoteShutdownPrivilege 5792 msiexec.exe Token: SeUndockPrivilege 5792 msiexec.exe Token: SeSyncAgentPrivilege 5792 msiexec.exe Token: SeEnableDelegationPrivilege 5792 msiexec.exe Token: SeManageVolumePrivilege 5792 msiexec.exe Token: SeImpersonatePrivilege 5792 msiexec.exe Token: SeCreateGlobalPrivilege 5792 msiexec.exe Token: SeBackupPrivilege 5244 vssvc.exe Token: SeRestorePrivilege 5244 vssvc.exe Token: SeAuditPrivilege 5244 vssvc.exe Token: SeBackupPrivilege 3896 msiexec.exe Token: SeRestorePrivilege 3896 msiexec.exe Token: SeRestorePrivilege 3896 msiexec.exe Token: SeTakeOwnershipPrivilege 3896 msiexec.exe Token: SeRestorePrivilege 3896 msiexec.exe Token: SeTakeOwnershipPrivilege 3896 msiexec.exe Token: SeRestorePrivilege 3896 msiexec.exe Token: SeTakeOwnershipPrivilege 3896 msiexec.exe Token: SeBackupPrivilege 4560 srtasks.exe Token: SeRestorePrivilege 4560 srtasks.exe Token: SeSecurityPrivilege 4560 srtasks.exe Token: SeTakeOwnershipPrivilege 4560 srtasks.exe Token: SeBackupPrivilege 4560 srtasks.exe Token: SeRestorePrivilege 4560 srtasks.exe Token: SeSecurityPrivilege 4560 srtasks.exe Token: SeTakeOwnershipPrivilege 4560 srtasks.exe Token: SeRestorePrivilege 3896 msiexec.exe Token: SeTakeOwnershipPrivilege 3896 msiexec.exe Token: SeRestorePrivilege 3896 msiexec.exe Token: SeTakeOwnershipPrivilege 3896 msiexec.exe Token: SeRestorePrivilege 3896 msiexec.exe Token: SeTakeOwnershipPrivilege 3896 msiexec.exe Token: SeRestorePrivilege 3896 msiexec.exe Token: SeTakeOwnershipPrivilege 3896 msiexec.exe Token: SeRestorePrivilege 3896 msiexec.exe Token: SeTakeOwnershipPrivilege 3896 msiexec.exe Token: SeRestorePrivilege 3896 msiexec.exe Token: SeTakeOwnershipPrivilege 3896 msiexec.exe Token: SeRestorePrivilege 3896 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5792 msiexec.exe 5792 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5792 msiexec.exe 3896 msiexec.exe 1472 MsiExec.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3896 wrote to memory of 4560 3896 msiexec.exe 95 PID 3896 wrote to memory of 1472 3896 msiexec.exe 97 PID 1944 wrote to memory of 2708 1944 54e0GS.exe 101 PID 1944 wrote to memory of 260 1944 54e0GS.exe 103 PID 1944 wrote to memory of 248 1944 54e0GS.exe 106 PID 260 wrote to memory of 3160 260 cmd.exe 108 PID 260 wrote to memory of 5016 260 cmd.exe 110 PID 260 wrote to memory of 2380 260 cmd.exe 114 PID 1944 wrote to memory of 4648 1944 54e0GS.exe 117 PID 4648 wrote to memory of 4860 4648 cmd.exe 119 PID 4648 wrote to memory of 4604 4648 cmd.exe 121 PID 4648 wrote to memory of 5488 4648 cmd.exe 123 PID 1944 wrote to memory of 5692 1944 54e0GS.exe 124 PID 5692 wrote to memory of 3860 5692 cmd.exe 126 PID 5692 wrote to memory of 4704 5692 cmd.exe 127 PID 5692 wrote to memory of 628 5692 cmd.exe 129 PID 1944 wrote to memory of 4560 1944 54e0GS.exe 132 PID 4560 wrote to memory of 2084 4560 cmd.exe 134 PID 4560 wrote to memory of 5636 4560 cmd.exe 135 PID 4560 wrote to memory of 4668 4560 cmd.exe 137 PID 3636 wrote to memory of 4952 3636 cmd.exe 139 PID 2272 wrote to memory of 5792 2272 cmd.exe 140 PID 5752 wrote to memory of 5612 5752 cmd.exe 142 PID 5748 wrote to memory of 1716 5748 cmd.exe 143 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Install_28n002.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5792
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 6DD322F301A1189DCF5C5681094434DC E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1472
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5244
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1808
-
C:\Users\Public\TEBoJM\54e0GS.exe"C:\Users\Public\TEBoJM\54e0GS.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force2⤵
- Command and Scripting Interpreter: PowerShell
PID:2708
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\TEBoJM\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\TEBoJM\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3160
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:5016
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:2380
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
PID:248 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5720
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:3108
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:5776
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4860
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4604
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:5488
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3860
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4704
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:628
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2084
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:5636
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4668
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4952
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:3036
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:5792
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:5612
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:1716
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59aa70.rbs
- Size 7KB
- SHA256 aedfd2b46dbafb63818a97a66570a068a208c68c98e253c8bd630f7df331048c
- MD5 c7db20f89d47cb8b2921bbf0e1fddce5
- SHA1 dfddf206ab1ba5fc436b665f8c8ccbcc3542cd47
- SHA512 b0861b882bf8796bb0318ea5264df052dd5de5896b485510556edc725b5ce33aa455c583d6c652378252e0934280887be5815d6220e048e57034cc705378caf0
- SSDEEP 96:mKGVBiGgu0C+femrxUUpdD21CsThqK/UpdD21C6jdAsDThqKjHKIK5RPWELEyE/m:mKGVoXCOzfD2IIBsfD2ISBaHtI5csKpB
- TLSH T1D3F10146B20481E2F9977730CF271B263BB3D3E4931463470ADE84749E4738D6EA619E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\TEBoJM\54e0GS.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\TEBoJM\UxEnhance64.dll
- Size 3.1MB
- SHA256 4b7d6f4fcaf5eebb5a50dfede7a2c72bfdf4b3b4af46d5181eba58542c4c076d
- MD5 8d5292ceaf7846893563418cdbefff27
- SHA1 eb094c15410fbad09fca1ebcd0ae56c1d01475be
- SHA512 072c7fe96bbac77d1c2a3876c534da171c549ece0fe882cd3a13f9c9144d81a9744c6f6aee4b40c99d096bae8fa63d5a8cc9527a7331b6f589a05d10208566ad
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+l:P9m29xx3Tiqt06ox6+z2rNNrKol
- TLSH T1D8E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\TEBoJM\adoresd.dat
- Size 4.8MB
- SHA256 7964e005438010c6746822b03a57915b809a48bc0716f91c60b5a9e5ef623867
- MD5 bfd3a1b7b53625ab83ba5e3036c80910
- SHA1 6b4ff67ec1acff3997d4467f3d9a90b740af2d4a
- SHA512 01863a618f7a1e9eebd6f5dc27808c0a59e6e16dfa18eb85e2d0ae4f3fd17f67323d8f9e097654f6fa93b3a6593d13092503fdd2bb72d94aef60acba8deb3a2a
- SSDEEP 98304:yuZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:vQDPnORb7AdPEm7Y7ltlVgxs
- TLSH T147363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\TEBoJM\msadox.tb
- Size 8KB
- SHA256 a7711e4bade7c6ca3fd781294b94b893b70428d565a126f2896706a70ad6f2dd
- MD5 b85c0fbc822d44364bebe26d653a8f3d
- SHA1 661bdb8fd2c2f7d6287efc6e35993e8ae6142f71
- SHA512 7ce9efa0829a094212a5804aecaa4a75e61e5935b3f5bf78f7b0e3dbce238ad0c69e12a5fee47a505f1bfe6a7a466698e401cc07789f4068dcbce5ae2b388c2e
- SSDEEP 192:EqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:EsZqZOXQ3uqvR2Kfzp
- TLSH T1BE029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C16B072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIAFFE.tmp
- Size 5.7MB
- SHA256 f2f0cc6f7b1e3334ca03256781a86ab7c7c728a28de49714dde0e915fa4eb146
- MD5 528e32e0083a77b685012405a91c6492
- SHA1 beb6b6d191c2772b2e10dc17e4ab2416b6810858
- SHA512 8195a58ee3cb5b2d33bff4694aefb266551e45a17acad33ab84133cb5f2b43c854f5fa3791b340b813ff61757d68df07b652857d502d1a726a8eee2a889b891b
- SSDEEP 98304:w6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVLS6dYXzIrrrHlG:TdCis4BEoZJLm4Kv8wWGzerI
- TLSH T14A5633D139C66F70D1A3CBF4665A391D3CAE3BD5B9728C0A67D43A00AE73615DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59aa6f.msi
- Size 5.7MB
- SHA256 c53d877ad301a09547c431c07e1f114a393c246724f31f0827ada95b930ec0fb
- MD5 648f28ac4d782d7d0257e50efdd076e9
- SHA1 43ba548c52bd8807103dc588ba92d220c4201799
- SHA512 c25a3639170b5a61663f5e024b91fe1ca52ddf3f5a69d32dfb304991518e0930f9015d3ed6d881c09747e06a87b7188c0df2a8095da9c6a767bb91eaffba3f4b
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHl0:8dCis4BEoZJLm4Kv8w+Gzer6
- TLSH T1755633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 c1a916752d4a750a7dde6a72727f2240c8e9974394c733f5932a0f36cbd3afe7
- MD5 f87ee7287d88dffe784916a35304210e
- SHA1 2ca8da2bbc2af4ee1a3f7a156a7137f60ae4768c
- SHA512 c4aa218c8aca8985846f156ce3438379f692f75e8f06e0dc3924bee32079aa0b4deba66f48572d65c5f0cc977c0f05afa168a634aa2dda89269d1a219f2ec41a
- SSDEEP 24576:QFo3DMPEdoO/vvTL/yghRClw/LubKr2iEMHD9MvZHkP6pWQRsYx2RILAVe9:NH8
- TLSH T1E257D12436F92210E7B79E7CB8F06A634D3A7D5B9C15DE8D05411B4E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c4ee2a5b-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{b2b04fa8-5d75-46db-9ea0-55ac8847c69a}_OnDiskSnapshotProp
- Size 6KB
- SHA256 1d6a3dbd814c9579e94b70fcc429f1554d5c4d11e726d1a1c7b0babb73ea3e54
- MD5 b770c42517868e65dbbe36483a8cec21
- SHA1 e98a662dbde4ad19b606cbb6a7a32f0c993f5435
- SHA512 a594f00abe2e2c45b8de660a19328895b6ff6b4bcbd5318f7ee1c584006ba9826aad614a34f771fb2e0e57ca665f71b947828cd0fdaf04dbc2aafda2687a59d4
- SSDEEP 96:F8x2Eutkvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:2C4b++uVm
- TLSH T1DBD196085AF54711E2B3AB7229F18557A837B911EF33CB8E0198638E6670910F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH