aa722e8fcb143df006d87e43c2910ee993352a3973a1b8190f0d405a97f44f71

Analysis

user interaction
yes
max time kernel
110s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
heleninstaller_3.3.msi
Size 19.9MB
Sample260804-xtmfaacm9y
SHA256 aa722e8fcb143df006d87e43c2910ee993352a3973a1b8190f0d405a97f44f71
MD5 44770b0e101f77ca062b782f36d3b477
SHA1 f2d44a8c26833259bc40396221cc5e7b87a83c45
SHA512 badeb2e34ae8f6f54329b3351173c72884385668643548b2e59d8e2ff66fee55e7a36e9efd6c9f386819a660e3aea737610655f04412ede14e96917d2dce66fe
SSDEEP 393216:V5ozr3Gt51U0CI5bsqyvSFxhfR2fsCI3iv6f2HEr5DmJM6cmyNAKT3pUFMJ:rmGtA3vmxv2+iv6f2HPSVmyBT32F
TLSH
T1EE2733925D491372ED08153DDA76BF352EA67CD204D9208A2273FF096CF7AD8C422DDA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
1928	signEmulator.exe
2036	Clean_Up.exe
2364	Custom.exe
4824	HELEN.exe
220	HELEN.exe

Loads dropped DLL 39 IoCs

pid	Process
3724	MsiExec.exe
5004	MsiExec.exe
1348	MsiExec.exe
2228	MsiExec.exe
2228	MsiExec.exe
2228	MsiExec.exe
2856	MsiExec.exe
2856	MsiExec.exe
2856	MsiExec.exe
4008	MsiExec.exe
4008	MsiExec.exe
4008	MsiExec.exe
4556	MsiExec.exe
4556	MsiExec.exe
1460	MsiExec.exe
1460	MsiExec.exe
5076	MsiExec.exe
5076	MsiExec.exe
488	MsiExec.exe
4824	HELEN.exe
4824	HELEN.exe
4824	HELEN.exe
4824	HELEN.exe
4824	HELEN.exe
4824	HELEN.exe
4824	HELEN.exe
4824	HELEN.exe
4824	HELEN.exe
4824	HELEN.exe
220	HELEN.exe
220	HELEN.exe
220	HELEN.exe
220	HELEN.exe
220	HELEN.exe
220	HELEN.exe
220	HELEN.exe
220	HELEN.exe
220	HELEN.exe
220	HELEN.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mscomct2.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\Vbar332.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msjint35.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msmapi32.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\UniSuiteFree.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\comctl32.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\msexcl35.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msrepl35.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mscomm32.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\Msxbse35.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mspdox35.dll	msiexec.exe
File created	C:\Windows\SysWOW64\comct232.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\msjet35.dll	msiexec.exe
File created	C:\Windows\SysWOW64\comct332.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\comdlg32.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\mscomctl.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\Msrd2x35.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msjter35.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msflxgrd.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\mstext35.dll	msiexec.exe
File created	C:\Windows\SysWOW64\tabctl32.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\msltus35.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\amd64\amd64\ftd2xx.lib	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\x86\ftdibus.inf	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\Dao2535.tlb	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\H1.spl	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\x86\amd64\ftlang.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\x86\amd64\ftbusui.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\LOCALE\EN\swgui.mo	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\amd64\amd64\ftd2xx64.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\LOCALE\CA\swgui.mo	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\x86\i386\ftserui2.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\LOCALE\FR\swgui.mo	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\x86\amd64\ftcserco.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\x86\amd64\ftser2k.sys	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\x86\i386\ftlang.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\amd64\i386\ftser2k.sys	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\HanoverLang.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\x86\dpinst.exe	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\x86\dpinst.xml	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\x86\Static\i386\ftd2xx.lib	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\LOCALE\ES\swgui.mo	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\dlls\WrapLib.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Uninstall.Bat	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\About44.txt	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\amd64\amd64\ftlang.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\amd64\dpinst.exe	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\LOCALE\PT\swgui.mo	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\LOCALE\IT\swgui.mo	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\database.exe	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\amd64\ftdiport.cat	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\versions.txt	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\amd64\i386\ftlang.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\x86\amd64\ftdibus.sys	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\dlls\signEmulator.exe	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\amd64\amd64\ftbusui.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\LOCALE\DE\swgui.mo	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\LOCALE\SV\swgui.mo	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\amd64\i386\ftcserco.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\amd64\amd64\ftcserco.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\h48.ico	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\amd64\i386\ftdibus.sys	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\H2.spl	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\amd64\i386\ftserui2.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\LOCALE\RO\swgui.mo	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\x86\i386\ftcserco.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\dlls\CGZipLibrary.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\amd64\i386\ftbusui.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Custom.exe	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\x86\i386\ftd2xx.lib	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\LOCALE\NL\swgui.mo	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\LOCALE\DA\swgui.mo	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\dlls\Asmo32.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\amd64\i386\ftd2xx.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Unzip32.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\x86\amd64\ftd2xx.lib	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\About33.txt	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\x86\ftdiport.inf	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\x86\Static\amd64\ftd2xx.lib	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\dlls\XELDDLL.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\dlls\bit32.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\H_USA.spl	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\x86\ftdiport.cat	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\amd64\amd64\ftser2k.sys	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\dlls\xDisplay.dll	msiexec.exe
File created	C:\Program Files (x86)\Hanover Displays\Helen\Keylo_Drivers\amd64\Static\amd64\ftd2xx.lib	msiexec.exe

Drops file in Windows directory 44 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF7C2D1BBCBF9D0302.TMP	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\472503A97C1DE4A41BDD1972AB4E74AF\1.0.0\Global_System_OLEAUT32_f2.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\472503A97C1DE4A41BDD1972AB4E74AF\1.0.0\vbajet32.dll.D53298B3_9A97_434B_BB42_3420D36D616F	msiexec.exe
File created	C:\Windows\Installer\{9A305274-D1C7-4A4E-B1DD-9127BAE447FA}\_FD8AB6BC7953ECD72617BD.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{9A305274-D1C7-4A4E-B1DD-9127BAE447FA}\_31635A9BCDA1C514CF279F.exe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9A305274-D1C7-4A4E-B1DD-9127BAE447FA}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB93DB47D19BE15BA.TMP	msiexec.exe
File created	C:\Windows\Fonts\HANARAB1.TTF	msiexec.exe
File created	C:\Windows\Fonts\lvnm.ttf	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\472503A97C1DE4A41BDD1972AB4E74AF\1.0.0\Global_VC_CRT_f0.51D569E0_8A28_11D2_B962_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\Installer\{9A305274-D1C7-4A4E-B1DD-9127BAE447FA}\_FD8AB6BC7953ECD72617BD.exe	msiexec.exe
File created	C:\Windows\Installer\e586bb5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\472503A97C1DE4A41BDD1972AB4E74AF\1.0.0\vbajet32.dll.D53298B3_9A97_434B_BB42_3420D36D616F	msiexec.exe
File created	C:\Windows\Installer\{9A305274-D1C7-4A4E-B1DD-9127BAE447FA}\_A348C22EAFAB81D2B0CD7F.exe	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\472503A97C1DE4A41BDD1972AB4E74AF\1.0.0\Global_VC_CRT_f0.51D569E0_8A28_11D2_B962_006097C4DE24	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\472503A97C1DE4A41BDD1972AB4E74AF\1.0.0	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\472503A97C1DE4A41BDD1972AB4E74AF\1.0.0\Global_System_OLEPRO32_f0.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\472503A97C1DE4A41BDD1972AB4E74AF\1.0.0\Global_System_OLEAUT32_f2.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File created	C:\Windows\Installer\{9A305274-D1C7-4A4E-B1DD-9127BAE447FA}\_31635A9BCDA1C514CF279F.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\472503A97C1DE4A41BDD1972AB4E74AF\1.0.0\Global_System_OLEAUT32_f3.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\472503A97C1DE4A41BDD1972AB4E74AF\1.0.0\expsrv.dll.D53298B3_9A97_434B_BB42_3420D36D616F	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\472503A97C1DE4A41BDD1972AB4E74AF\1.0.0\Global_Controls_COMCATDLL_f0.3207D1B0_80E5_11D2_B95D_006097C4DE24	msiexec.exe
File created	C:\Windows\Installer\{9A305274-D1C7-4A4E-B1DD-9127BAE447FA}\_6FEFF9B68218417F98F549.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7E87E00873B7AB0A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e586bb7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6EE2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\472503A97C1DE4A41BDD1972AB4E74AF	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\472503A97C1DE4A41BDD1972AB4E74AF\1.0.0\Global_System_STDOLE_f1.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\Installer\{9A305274-D1C7-4A4E-B1DD-9127BAE447FA}\_6FEFF9B68218417F98F549.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{9A305274-D1C7-4A4E-B1DD-9127BAE447FA}\_A348C22EAFAB81D2B0CD7F.exe	msiexec.exe
File created	C:\Windows\Installer\{9A305274-D1C7-4A4E-B1DD-9127BAE447FA}\_F0F18CCD403AEAC0F0253D.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{9A305274-D1C7-4A4E-B1DD-9127BAE447FA}\_F0F18CCD403AEAC0F0253D.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0E22B1432C936B32.TMP	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\472503A97C1DE4A41BDD1972AB4E74AF\1.0.0\Global_System_OLEAUT32_f3.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\Installer\e586bb5.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\472503A97C1DE4A41BDD1972AB4E74AF\1.0.0\Global_System_OLEPRO32_f0.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\472503A97C1DE4A41BDD1972AB4E74AF\1.0.0\expsrv.dll.D53298B3_9A97_434B_BB42_3420D36D616F	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\472503A97C1DE4A41BDD1972AB4E74AF\1.0.0\Global_System_STDOLE_f1.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\472503A97C1DE4A41BDD1972AB4E74AF\1.0.0\Global_Vba_VbRuntime_f0.1E64E430_36E0_11D2_A794_0060089A724B	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\472503A97C1DE4A41BDD1972AB4E74AF\1.0.0\Global_Vba_VbRuntime_f0.1E64E430_36E0_11D2_A794_0060089A724B	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\472503A97C1DE4A41BDD1972AB4E74AF\1.0.0\Global_Controls_COMCATDLL_f0.3207D1B0_80E5_11D2_B95D_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1268	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HELEN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	signEmulator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HELEN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clean_Up.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007693c80d07c71b6c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007693c80d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809007693c80d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a7693c80d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7693c80d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{20C62CAE-15DA-101B-B9A8-444553540000}\1.1\FLAGS	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B7E6391-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000069-0000-0010-8000-00AA006D2EA4}\TypeLib\ = "{00025E04-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComCtl2.Animation.2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ListViewCtrl\CurVer\ = "COMCTL.ListViewCtrl.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{111BCF6E-8BB4-11D2-ADBA-00A0C9A76405}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F4D83603-895E-11D0-B0A6-000000000000}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C247F22-8591-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000000FF-0000-0010-8000-00AA006D2EA4}\TypeLib\ = "{00025E04-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F8E414C-6D69-4326-96F7-AC6C8081CBB9}\TypeLib\ = "{16A258C9-07FF-49CC-95AE-30CF6A5EAD32}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{586A6359-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{648A5602-2C6E-101B-82B6-000000000014}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{38911D96-E448-11D0-84A3-00DD01104159}\ = "CoolBar"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E11AFF31-76AA-416F-B1DE-234022ECE536}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.TreeCtrl\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\MiscStatus\1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\ProgID\ = "COMCTL.TabStrip.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{111BCF7A-8BB4-11D2-ADBA-00A0C9A76405}\ProgID\ = "ComCtl3.BandProperties"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD9DA662-8594-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{026371C0-1B7C-11CF-9D53-00AA003C9CB6}\Control	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06C6649-F3B4-42B3-A525-B724164B9509}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{232E4565-87C3-11D1-8BE3-0000F8754DA1}\TypeLib\Version = "2.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{232E4569-87C3-11D1-8BE3-0000F8754DA1}\TypeLib\ = "{86CF1D34-0C5F-11D2-A9FC-0000F8754DA1}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB294FFC-14F7-41EC-A3B7-DF97D4A8DE44}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{00000010-0000-0010-8000-00AA006D2EA4}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{38911D9C-E448-11D0-84A3-00DD01104159}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{E6E17E82-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8A3DC00-8593-11D1-B16A-00C0F0283628}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TabStrip.2\ = "Microsoft TabStrip Control, version 6.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ProgCtrl	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{BF877894-E026-11CF-8E74-00A0C90F26F8}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{026371C0-1B7C-11CF-9D53-00AA003C9CB6}\Version	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ACBB956-5C57-11CF-8993-00AA00688B10}\ = "ListView Sort Property Page Object"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C39F35D-96BD-4A4D-A3F2-0CC0B2E51C82}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000041-0000-0010-8000-00AA006D2EA4}\TypeLib\ = "{00025E04-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\TypeLib\Version = "6.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E86-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1EFB6595-857C-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0000009B-0000-0010-8000-00AA006D2EA4}\TypeLib\Version = "3.5"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6887D8A2-4412-4BCD-9398-CDE9D8D635D6}\TypeLib\Version = "1.0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1F6F8D20-1B7D-11CF-9D53-00AA003C9CB6}\InprocServer32\ = "C:\\Windows\\SysWOW64\\comct232.ocx"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E216240-1B7D-11CF-9D53-00AA003C9CB6}\MiscStatus\ = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\TypeLib	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000017-0000-0010-8000-00AA006D2EA4}\InprocServer32\InprocServer32 = 65005f003d00570059005a006c00210074003f007100380021006600300060005e0049004d0079003e00730057006d0039003300210076007600340039007b0060005800780073002e0057005b005f00270000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{586A6354-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32\InprocServer32 = 65005f003d00570059005a006c00210074003f007100380021006600300060005e0049004d0079003e00410037006b0029003400730036007400660028004a0052006000710046002d005100390071002e0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\InprocServer32\InprocServer32 = 65005f003d00570059005a006c00210074003f007100380021006600300060005e0049004d0079003e00640062004b0078002d006c0062006d006600280047006e002c004c005b005b0051007e0043004e0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E944-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E3867A4-8586-11D1-B16A-00C0F0283628}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000016-0000-0010-8000-00AA006D2EA4}\ProgID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000014-0000-0010-8000-00AA006D2EA4}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComCtl2.MonthView.2\ = "Microsoft MonthView Control, version 6.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib\Version = "2.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E84-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F08DF953-8592-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F4DF280-531B-11CF-91F6-C2863C385E30}\ = "IMSFlexGrid"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB294FFC-14F7-41EC-A3B7-DF97D4A8DE44}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\UniSuiteFree.ocx, 30004"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000015-0000-0010-8000-00AA006D2EA4}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\Dao350.dll"	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2320	msiexec.exe
2320	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1268	msiexec.exe
Token: SeSecurityPrivilege	2320	msiexec.exe
Token: SeCreateTokenPrivilege	1268	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1268	msiexec.exe
Token: SeLockMemoryPrivilege	1268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1268	msiexec.exe
Token: SeMachineAccountPrivilege	1268	msiexec.exe
Token: SeTcbPrivilege	1268	msiexec.exe
Token: SeSecurityPrivilege	1268	msiexec.exe
Token: SeTakeOwnershipPrivilege	1268	msiexec.exe
Token: SeLoadDriverPrivilege	1268	msiexec.exe
Token: SeSystemProfilePrivilege	1268	msiexec.exe
Token: SeSystemtimePrivilege	1268	msiexec.exe
Token: SeProfSingleProcessPrivilege	1268	msiexec.exe
Token: SeIncBasePriorityPrivilege	1268	msiexec.exe
Token: SeCreatePagefilePrivilege	1268	msiexec.exe
Token: SeCreatePermanentPrivilege	1268	msiexec.exe
Token: SeBackupPrivilege	1268	msiexec.exe
Token: SeRestorePrivilege	1268	msiexec.exe
Token: SeShutdownPrivilege	1268	msiexec.exe
Token: SeDebugPrivilege	1268	msiexec.exe
Token: SeAuditPrivilege	1268	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1268	msiexec.exe
Token: SeChangeNotifyPrivilege	1268	msiexec.exe
Token: SeRemoteShutdownPrivilege	1268	msiexec.exe
Token: SeUndockPrivilege	1268	msiexec.exe
Token: SeSyncAgentPrivilege	1268	msiexec.exe
Token: SeEnableDelegationPrivilege	1268	msiexec.exe
Token: SeManageVolumePrivilege	1268	msiexec.exe
Token: SeImpersonatePrivilege	1268	msiexec.exe
Token: SeCreateGlobalPrivilege	1268	msiexec.exe
Token: SeBackupPrivilege	3932	vssvc.exe
Token: SeRestorePrivilege	3932	vssvc.exe
Token: SeAuditPrivilege	3932	vssvc.exe
Token: SeBackupPrivilege	2320	msiexec.exe
Token: SeRestorePrivilege	2320	msiexec.exe
Token: SeRestorePrivilege	2320	msiexec.exe
Token: SeTakeOwnershipPrivilege	2320	msiexec.exe
Token: SeBackupPrivilege	1908	srtasks.exe
Token: SeRestorePrivilege	1908	srtasks.exe
Token: SeSecurityPrivilege	1908	srtasks.exe
Token: SeTakeOwnershipPrivilege	1908	srtasks.exe
Token: SeRestorePrivilege	2320	msiexec.exe
Token: SeTakeOwnershipPrivilege	2320	msiexec.exe
Token: SeBackupPrivilege	1908	srtasks.exe
Token: SeRestorePrivilege	1908	srtasks.exe
Token: SeSecurityPrivilege	1908	srtasks.exe
Token: SeTakeOwnershipPrivilege	1908	srtasks.exe
Token: SeRestorePrivilege	2320	msiexec.exe
Token: SeTakeOwnershipPrivilege	2320	msiexec.exe
Token: SeRestorePrivilege	2320	msiexec.exe
Token: SeTakeOwnershipPrivilege	2320	msiexec.exe
Token: SeRestorePrivilege	2320	msiexec.exe
Token: SeTakeOwnershipPrivilege	2320	msiexec.exe
Token: SeRestorePrivilege	2320	msiexec.exe
Token: SeTakeOwnershipPrivilege	2320	msiexec.exe
Token: SeRestorePrivilege	2320	msiexec.exe
Token: SeTakeOwnershipPrivilege	2320	msiexec.exe
Token: SeRestorePrivilege	2320	msiexec.exe
Token: SeTakeOwnershipPrivilege	2320	msiexec.exe
Token: SeRestorePrivilege	2320	msiexec.exe
Token: SeTakeOwnershipPrivilege	2320	msiexec.exe
Token: SeRestorePrivilege	2320	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1268	msiexec.exe
1268	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2036	Clean_Up.exe
2364	Custom.exe
4824	HELEN.exe
220	HELEN.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1908	2320	msiexec.exe	87
PID 2320 wrote to memory of 3272	2320	msiexec.exe	90
PID 2320 wrote to memory of 3724	2320	msiexec.exe	91
PID 2320 wrote to memory of 5004	2320	msiexec.exe	92
PID 2320 wrote to memory of 1348	2320	msiexec.exe	93
PID 2320 wrote to memory of 2228	2320	msiexec.exe	94
PID 2320 wrote to memory of 2856	2320	msiexec.exe	95
PID 2320 wrote to memory of 4008	2320	msiexec.exe	96
PID 2320 wrote to memory of 4556	2320	msiexec.exe	97
PID 2320 wrote to memory of 1460	2320	msiexec.exe	98
PID 2320 wrote to memory of 5076	2320	msiexec.exe	99
PID 2320 wrote to memory of 488	2320	msiexec.exe	100
PID 2320 wrote to memory of 1928	2320	msiexec.exe	101
PID 2320 wrote to memory of 2036	2320	msiexec.exe	102
PID 2320 wrote to memory of 2364	2320	msiexec.exe	103

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\heleninstaller_3.3.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1268

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1908
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 70C8C65FAD3580ED3C2B30ED9143CF2A M Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3272
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\UniSuiteFree.ocx"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3724
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Hanover Displays\Helen\dlls\CGZipLibrary.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5004
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\Dao350.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1348
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msltus35.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2228
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msexcl35.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2856
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\mstext35.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4008
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\mspdox35.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4556
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\Msxbse35.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1460
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\Msrd2x35.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5076
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msjet35.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:488
- C:\Program Files (x86)\Hanover Displays\Helen\dlls\signEmulator.exe
  "C:\Program Files (x86)\Hanover Displays\Helen\dlls\signEmulator.exe" /REGSERVER
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1928
- C:\Program Files (x86)\Hanover Displays\Helen\Clean_Up.exe
  "C:\Program Files (x86)\Hanover Displays\Helen\Clean_Up.exe" /Commit
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2036
- C:\Program Files (x86)\Hanover Displays\Helen\Custom.exe
  "C:\Program Files (x86)\Hanover Displays\Helen\Custom.exe" C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2364

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3932

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4576

C:\Program Files (x86)\Hanover Displays\Helen\HELEN.exe
"C:\Program Files (x86)\Hanover Displays\Helen\HELEN.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4824

C:\Program Files (x86)\Hanover Displays\Helen\HELEN.exe
"C:\Program Files (x86)\Hanover Displays\Helen\HELEN.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e586bb6.rbs

Path C:\Config.Msi\e586bb6.rbs
Size 665KB
SHA256 7a0f3d7b691c5fd491c1f9fafb5aec358245e36706184ef8e818dac0441def13
MD5 13481010d462a8282ed7aac3f959084d
SHA1 dbc4a8f572fa6e7ca513194162ff1b00e0e337ca
SHA512 166cfe5a71b9450704a5d8329e7f60064f5d441e37ffb28bb2cdc658f44adc520aa1a4c83e670300015008e7a1ea139a807017ee5adbef672a33a7f7e4b64c51
SSDEEP 12288:kx8O2QT0YAXt4FNaovDL8WVowLFK+G5byHfqidZxeEYF045go:kxIF045go
TLSH
T199E4EF42B5409682C0EA1B70DAA73F197F3AB3D987C6474B419CD2384D877CA2D6FE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dao2535.tlb

Path C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\Dao2535.tlb
Size 71KB
SHA256 6c6cfb4e9a8dc9a0e65630a6718a87d6e3f962d87f4836845d8023fbf87f640c
MD5 87a2adf125be51cdd5d8d3843e0f0b7e
SHA1 f86f98587dc8193e197979714574ac127fdfb250
SHA512 7c9b5b1d3883d540e1a7a6cab7c36509c59ec4766f91b79632b842269ce2349104f40b5e1d508a7d0aa713d8bd8c9f6797c82d2a73e0cfe0aabf1193e87d2ed8
SSDEEP 768:qBTk6x6X4jwg6QttykgHGj+7RgazewxdgQlLZ6f152H/smzMGbRmHYGQSupZWye0:q/XjcegHbjEve/4e
TLSH
T1EE639456FA44C7F3C04D0230185B52AA5FB0B0962F0EB55723DE83AD6E737C17B96A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dao350.dll

Path C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\Dao350.dll
Size 556KB
SHA256 a4b20735be317a924d2e36707baaf911fbae890ca53c5044fb506f15d33bcb6d
MD5 8888bdbd4e118d915d40a11748282bca
SHA1 4e8822d2242d175cc3d708843e2cd71b7ee7033d
SHA512 a96f5e72905571de84f515dd8a19c87d5143ead532bf01f0132da8262974bfaf910f24b466d49cd4ee83845fc65f02c273a550786854aec3e0f4fa713929b562
SSDEEP 6144:lO4zReIcAtVXrPsS3Syvqe4v2QeD8yCaDSCwBwAlvz6Bm2hf9QdHHtMMeOh4J7Wu:lO4zRe7AvBiyvqe4pe7wHlv1tO7VYFk
TLSH
T162C45C4BF2D740F9DD05E53404A7976BFB382B429829D449BBF92F9A6A73310122E173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Clean_Up.exe

Path C:\Program Files (x86)\Hanover Displays\Helen\Clean_Up.exe
Size 20KB
SHA256 790dffd801180abededecaf0f554fb3899240c7f38e8351b00de5714ddcb79e4
MD5 71d5dc995216336c07ed93ed998c6e1d
SHA1 991e5321e0649863a3be58e189b25f18d1bcbe2a
SHA512 846e4266ca4acdcee4b81768a46dc17547cdf1ab5476602c24addb60613dff61fb0e27f3f45df639fd2203c42e3c60a0d7b2cff73a22bbf645e05e8759359ec7
SSDEEP 96:eg6hEVMlLGURpbxZwlr86pRfWnusF9yEE8wBK8VluRsA1dqs5CmNrpM8mid92:KlLGUjb4lIkRf+CCrn7d9
TLSH
T1AC92E123F7AC6471F5998BF11F32D39254127C725D14AE4BA9047B9E2D382424AF131B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Custom.exe

Path C:\Program Files (x86)\Hanover Displays\Helen\Custom.exe
Size 156KB
SHA256 64a829d34ca28b95370fa33a7f3cc7c2ad7b2088018823a35e31683f7f036f16
MD5 0c7ec51bc53397a71496d05e73ebc3cd
SHA1 8e14e74c386ae00354c614db75a24cde24a72694
SHA512 7b44b73556447dc1475df9aac642d33a55d4f2958c1e8e53a127049c5c6f4e075732c2b8a327c0ff196e2ad10f31ae0c08e5e709896a03af0513bd773a65ae32
SSDEEP 1536:04p1RUJV0rO7LleeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeV:DRoWrOAsWsJ5Q
TLSH
T11FF3D813E90B0553F05845B1C517478E78B07EEA1AD3A7CB9A54386DDA32AC3B673E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Program Files (x86)\Hanover Displays\Helen\Dlls\zlib1.dll
Size 72KB
SHA256 808a8fd7248dcf522602e79591371dfea79160329c486e28ee7e10f0fbba3b0e
MD5 94c0eb338ee9048189b54dbedc9b6e94
SHA1 7ac6869940fcfb7074b23e43a9b28d010fa39f46
SHA512 4280ce663ee03389a862d6baceae132bf895aa2d43b2c22bf787abbf96cf0bd31af8a4c542ae4b8f3723c3e7b793703f530f3bdbd87f120442d84cc1cfa41a93
SSDEEP 1536:jRn759wd1v+8wM7toWUYnToIftIOlIO/ih:jRnV9wdkvWRTBfnv/ih
TLSH
T142738D4287C283F2F878553494FB973EDB22B1060A59E7DBB14DE6961922215F3A13CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HELEN.exe

Path C:\Program Files (x86)\Hanover Displays\Helen\HELEN.exe
Size 3.5MB
SHA256 0aab72cf569cdff78011f0fe157c15fb200587003de279c33d87975426366775
MD5 49b16f70cb1e3ccf3041c5c44df3e16d
SHA1 4249d5624fc24434f6a5bd837f560af609e21ab2
SHA512 723d93299f96a49eddd12488177a9fac54fd565e9669a80a9ff7da95b3322c1d9ec4ae03117c3bec264d29c8fa7c03c91d2c886a19331eca048b95a0c2c63508
SSDEEP 98304:ztcALsBVn3jHmxHWCO6MnV6fS5tuWQbr56:zRsXn3jHmxHWCO6MnV6f0tuWQbr56
TLSH
T1E9F57E37D2306106D53664315C9F5F6B3C14AC3A2492A08767A2EFAC6670BA2FD5B34F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

H_USA.SPL

Path C:\Program Files (x86)\Hanover Displays\Helen\H_USA.SPL
Size 17KB
SHA256 2da8f2a32f448d6c6fa0f6b2cb029eab441032fc05d6a3540f4a72da14492f56
MD5 5f88ddb42f09c24d466c1621908b6867
SHA1 2dd897b1be311fcaf3020bd01b168d34b0dd9579
SHA512 4416a7176c6560dbcac95ec6312b1eccd80a7d36454b132e8621daed4f8d65fc76e227458a6a5a975f91ad879cdc02ce9f37f8460c18bc0f7f8495221fab1bb9
SSDEEP 384:oEgiaBPGWoizkc2FWfE2lu3ey9S0RPj7DozmtgH2gj:oEgXU/b73ey9S4j7UzmaH2G
TLSH
T17E82E343ED168B43A41087FDBE071D342B5F120CB88677ED213A0D9B8F64AA16D8F56E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HanoverLang.dll

Path C:\Program Files (x86)\Hanover Displays\Helen\HanoverLang.dll
Size 60KB
SHA256 ed04695b8dcbf26c1df0133f4d905d975799f54404523cd343b2df96233465ad
MD5 8ad7811f68d7e2ca2253fb5ad0c2e731
SHA1 016166e1c9194b571a62ece7d3a525efa50661c0
SHA512 6d30bfa999cfcc21b7dd0bcda22e8a98c8ccf562a82b6fa005c1c87c5abec71e52a8cdc978bb7a6ce925629a31c93a001186289df7e29acb4f83b38a9c49e8ce
SSDEEP 768:IX36Rg4tdjJ3S4OjTYGeDoCHiJLbC7DKlVtCtNFloPBbM:zFtP3SXgGTCHiJLG7DKFqFlcM
TLSH
T101536B13B64180B7D04A1538159797826B7ABD000FF665836FA937AE6E333E0F73A391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SendWrap.dll

Path C:\Program Files (x86)\Hanover Displays\Helen\SendWrap.dll
Size 254KB
SHA256 4078e36e25c0562699099ac4df7ef53444f1df0c1233be8a651f553430310b24
MD5 3f1d465e538276eed00ea534b4ae269f
SHA1 9d70778c4388c5d094fbbad947b12818a06d3c79
SHA512 ddfce0b7a5d756ee5ae6f5c8ae644b3b0e5ede9bb6cb99b76120a8389eda323036a541b227abfcc4e2f6d9a10dffa887b6c8f17834feb97dade2d5aa0aa9533d
SSDEEP 6144:fvIn3YSe67hXXNNyTrrwZQ8rA7mEpesA7:fvIn3YSldn3Krs0aSe1
TLSH
T1E1444A023140C07AE88609794CB6C7B99DB47871AB5F40E7BBF05F6F5A316D1A63A31E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CGZipLibrary.dll

Path C:\Program Files (x86)\Hanover Displays\Helen\dlls\CGZipLibrary.dll
Size 56KB
SHA256 579f192908447e14b7bae5fc904896e122bd86fed6a35b33eb6ab54008494da9
MD5 8bcc29921352e4329f0979c0d7044b7f
SHA1 20aaa8f38efac38ada8179b4e78f4b45cfd4bdb9
SHA512 4603ef5b33b4c75aa58e6fa583bc06d6ede9cb51abdc211935c01331e3ca941d05a216268e194abc53616d85c5a20b4ac39e8f4e57eda541e464e60b45309c1a
SSDEEP 768:Ax3zsDiFGr0ecuQWFteBLLU934T3cbLTPHewFxxUtsGtuKmvkE:AFYDiF5eQpI4TsLUtsxk
TLSH
T19C43A321B2DAD03FD54505B00E2BA7EE451D2E650F81E64F7B84F75D2E73A81623172B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

signEmulator.exe

Path C:\Program Files (x86)\Hanover Displays\Helen\dlls\signEmulator.exe
Size 180KB
SHA256 df5cec9bac708bc284185579fe93541c814f8f718c6d7cbfa33268ed131f7f67
MD5 ebd89807bda7729333a5ce52f7032ede
SHA1 38824e44a91e8dd0872ebd14c495a5daaef2b653
SHA512 d7658edaa7c7c59c8f7c4b67a9fae296613b0d152fe1804ddeff0daac9fe25fa16de61809d78ebd26d5f336815876ab65fcbab2f0c33bd205a9454621e59103b
SSDEEP 3072:Y8qKj+sVunalxvp0VYEt5zr6UNyKEkPjVp:IKllxtBKp
TLSH
T11404359992331469F17FF17D0873EBFAF1781939B89352A9D1606FC620726C38126E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

language.ini

Path C:\Program Files (x86)\Hanover Displays\Helen\language.ini
Size 210KB
SHA256 0f1695330a3e0a8024e60a75a0b7db938b934dc63911bd0ddcc97518c95ff612
MD5 a5aa20e2bda94df3b6f58db035397f04
SHA1 94a95b6330a8ededaa31e1b8482efa1065745f6d
SHA512 45ea9fe91fab59153e7af82a948670efce3b39638791111a9d574d40d1dfd16fb86e3f8277fec93b345e35dcfccd3166c1f3ecb3b39e4311d020a3d7b3d624cf
SSDEEP 6144:SnJONLi/V1fPLcorTAz01W15swgx9DCpsdLl94J0:DJiDLcWMg1W15swgx9DCpsdLlc0
TLSH
T141244B629EE21AAECDE303C1B1535C5BCA1CE1027F6AF1DE305D81ED11C9DA8D7CA664
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helen.ini

Path C:\ProgramData\Hanover Displays\Helen\helen.ini
Size 18KB
SHA256 ef8d0ad0a3fded9bf6da558f51e318bab441250e88e928e2a2574e663f0496b6
MD5 1c8d78e7ca327afdcf5499d2f4a94b5f
SHA1 edae7ef914c8e941f2dcd5c7852c19b22cc05f2b
SHA512 552a194464dd1b6b9983f8c849cf10cc3e6c425d26342660da657f03eb2284f3942453f14a87aea1109198e28fb90e33d751c50ce3e56911b8254956c1307035
SSDEEP 384:S/J8wTLDBYjBqZlrR4u8u32ni7udXNrtWyQrWdw7/:S/J8+Dz4uSiaNAyQrWC/
TLSH
T13882090F734C5338D99122EBB53E41A4D3F6E4E85236901974DFC9EC6382C659EFA268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e586bb7.msi

Path C:\Windows\Installer\e586bb7.msi
Size 19.9MB
SHA256 aa722e8fcb143df006d87e43c2910ee993352a3973a1b8190f0d405a97f44f71
MD5 44770b0e101f77ca062b782f36d3b477
SHA1 f2d44a8c26833259bc40396221cc5e7b87a83c45
SHA512 badeb2e34ae8f6f54329b3351173c72884385668643548b2e59d8e2ff66fee55e7a36e9efd6c9f386819a660e3aea737610655f04412ede14e96917d2dce66fe
SSDEEP 393216:V5ozr3Gt51U0CI5bsqyvSFxhfR2fsCI3iv6f2HEr5DmJM6cmyNAKT3pUFMJ:rmGtA3vmxv2+iv6f2HPSVmyBT32F
TLSH
T1EE2733925D491372ED08153DDA76BF352EA67CD204D9208A2273FF096CF7AD8C422DDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_A348C22EAFAB81D2B0CD7F.exe

Path C:\Windows\Installer\{9A305274-D1C7-4A4E-B1DD-9127BAE447FA}\_A348C22EAFAB81D2B0CD7F.exe
Size 3KB
SHA256 bcbc27e70a92c2ff2bd5257d5ca2acfe010d7c0f9a13ca0a9fcf40ee7c6b2ca1
MD5 431a8e13f1585c5093d94fccf7107b6d
SHA1 827da300343c5dc979b2cf81460e426c27935293
SHA512 6a67b3b989fdbda815fa891580ed98bcd7433bf9dbe1ab2803046fa5301171498a6a4af06b5dd67dcef6958b130ce7a0a39630390d71c3f09ffe627bbeef7996
TLSH
T11C71B689B7A1C990C452CB38E0C1CFF42A45AD88B343EC935691FD433D56B6172994D4
MD5 SHA1 SHA512 TLSH

Submit Download

MSJINT35.DLL

Path C:\Windows\SysWOW64\MSJINT35.DLL
Size 120KB
SHA256 3016d572ea5e695b52b1759432dd30b7a9cbc2b53ac42e8c7735854b464e7d34
MD5 4fb4a9fbb17ed82edc6ac5c3c6e71c6d
SHA1 15d9795d55f40658e874ccdf0dbbb191ab075a3f
SHA512 4935db061b0d2a1bfa078d1666dfefd12b64e57e40d295f2c95c1d6b8cf0814ae80b20c9d410aaa97b50dc5e41093837df83c693e8abb608af9488de469c77bd
SSDEEP 1536:AEhrCMnu8LylA1U4klSZ/v3P44XW9qT1z3RgYPx56gbpNvqb7m5:Aoju8Lf3db1zX56gbrqba
TLSH
T186C3684167F99618F6F77F706DB91AA44E3ABCAAFD79C65C1210805E0972E408DB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Msrd2x35.dll

Path C:\Windows\SysWOW64\Msrd2x35.dll
Size 246KB
SHA256 0a39237f27e801e87ae7d172c1c77bf6032cb30443e3b72111fbb6de78cef3fb
MD5 e9772bde5e8897236ce67dfe0cf5e002
SHA1 88d61da7bea310315731081fba68523af925e8a2
SHA512 561993b833e64c1fc6b520d3a4691c4bfe3b7dc30b8d4cdfb4cbaf66a9916b86093a5c107bee5a48aa81ba9a7591bfd83364a91624163185d272493d1effa257
SSDEEP 6144:dI0uKc+/y/n20qecWHUe+4nwO6WP2wXU:vi2BenHUTzXWOwE
TLSH
T162346C92F5CB41F5DDD29A7905A732173A329703031AECC78BE42D528C637E21A3A7D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Msxbse35.dll

Path C:\Windows\SysWOW64\Msxbse35.dll
Size 280KB
SHA256 37eba642c286206c84e7763c6da1a691dad67a33d0774d52cf517826f6ac971c
MD5 7bd9a2bc339effafc12a2c04dccb09e1
SHA1 52c874f79c4b52a6162edb1c0288778b949ae271
SHA512 2a7f551a7451b71ad89d34705424e2fe2a1a2b68046f1c638bbaf9fcdab9251766216b42611a547cf8a085eed5094d82a7c6526afed9470c08581e22d1cafa31
SSDEEP 6144:eYRLqA0GnZzZpWVDYv+BGUwFqbDq4FDaTU5BrVQ1okp4EAQ+:ROA0GZzZgYvJUwFqb+4FTT6p4EAQ
TLSH
T193546CC3F5C681F0DAE7B97910A7372BE1335B06401EE9C1EBB51C6A5A7391252393A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UniSuiteFree.ocx

Path C:\Windows\SysWOW64\UniSuiteFree.ocx
Size 460KB
SHA256 cac7b6c92ffe498e583d472f3d95326c74552cba5a16455fc6c3885641d7ac16
MD5 d126f4f357ae09d004409bce1fbfbf2c
SHA1 d04ce04d861ac87adcb303d1e64830cb3534c18e
SHA512 6f3e18409dbcf93bbf9cf55551b49ddc0d1c1bc5819df48348ad8fe03c339ac370275bf0ff2c50dd41d88c4a582d081e3417e615487faab1b37da0d32790d66e
SSDEEP 6144:F0Aj18RH5VeRyNoIgoWQnnZVjMvcNm2u7+EX3B97moefvDW0udTcGQsLeW9:fj1GH5VeRyrQQnDjMXlX3Bkz8TKsLeo
TLSH
T1DDA40915B2EAF0BDCE9202725D7BA3BC1D2D2D160501C55F3388EE0E5F73654AA2A35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

comctl32.ocx

Path C:\Windows\SysWOW64\comctl32.ocx
Size 595KB
SHA256 a071a89ca5f35ff51a5631b7ea7aa882eee1e8787640ab2e0c1f192f677ec443
MD5 e2bed335446b7321ff38a138b3962e8a
SHA1 f183eaeb7e4af955aad1d894dc46801b715f3ad9
SHA512 61bc1923e03daa74c0061e6534e5014375eff3728ab16dca68830bcd687991c640db4a6c76836cb0b92179e90159bd1f202fdb71b57de7ad760cc677fa3636b2
SSDEEP 12288:Wkec4KwGf99MSOeMkeXrnhIcVthDGn2mwCyP9tDCcrcJIVulr:Wk6nTSXJI4lr
TLSH
T1B8D43B02F7D69122E8B61D30897B6BB22B717C557D35D21F2384777E1C72B81AE22326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

comdlg32.ocx

Path C:\Windows\SysWOW64\comdlg32.ocx
Size 149KB
SHA256 e32d8bbe8e6985726742b496520fa47827f3b428648fa1bc34ecffdd9bdac240
MD5 ab412429f1e5fb9708a8cdea07479099
SHA1 eb49323be4384a0e7e36053f186b305636e82887
SHA512 f3348dbc3b05d14482250d7c399c00533598973f8e9168b4082ee5cbb81089dfaefcfda5a6a3c9f05b4445d655051b7a5170c57ee32d7a783dc35a75fee41aa9
SSDEEP 3072:VCslb9HnH/GrQ/qCFyn7dWXSQeRDBIY/OR5JrNo2CocrJbNN6N2TRqEydc:VCsB9Hu9nweRD4JZoDxtRHj
TLSH
T111E3099273F57162E4B33B302A7A17A15EBABC626D35D90E6314364D0872AC0DE74F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mscomm32.ocx

Path C:\Windows\SysWOW64\mscomm32.ocx
Size 103KB
SHA256 b3c7d7334d4329b8d28b8fd5ea62231a066383b113d5e9901cb80dcaf25a43ee
MD5 d11834cd2777f7db54d25010f7d61d17
SHA1 ed35d9e8db8fcb1c948a74d584d5f99d4d8d243d
SHA512 f4b0d9c44e85b91b600d5d9f78977787aa6da020e9aa2ef189e1d0ad82937f9f81f48054ee45830938456332ee961119625299de0037ac42098df1a8e8a22e43
SSDEEP 3072:rsQgdI5Hh8p28XMehRYSdB/TYDY44UGyGfDnfr:rdgdI598jhRJpYDY4fefn
TLSH
T1F4A3184273F69123E2B327340976E7A5BBBDBD612C35959B974033CD1B32A449E34B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msexcl35.dll

Path C:\Windows\SysWOW64\msexcl35.dll
Size 246KB
SHA256 ae1b44a86bc9666e65921f1cb6f85a49fac774e7249101a5cf2081d1d76098ce
MD5 29281b0fa3b49c18b900072b26702f14
SHA1 015f3891e4880adff77bc8c14c95ef1726f207a6
SHA512 8d3ca40ceb57aab6c950b4e93ca392a6afb89e79e0d7660541c4833365fa0ee305025adf5c6ddded6e4f26bc9164398bf134fe543064466bd3d867eceddd0359
SSDEEP 6144:C6F24gl8wB3xOnadfJkqO+tagQmBTmS5KQdpMix:vbgWYxvdh0MwmBTmctd
TLSH
T102345C83F5C744F0CEA5BA7900A7372B71338B56855AE5C2EBB56C755DB3A0212383A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msflxgrd.ocx

Path C:\Windows\SysWOW64\msflxgrd.ocx
Size 254KB
SHA256 36464966fbf46136ce0746c8cf419ca31360f81f06744e10d066441bc0ad5538
MD5 3f7a98d7be824143c7c88fc447e944ac
SHA1 d2b8e15b4b1c54670d3723d3d7468256a44de386
SHA512 45141b841ef87b99be8d9afceaaad0e9b281ff5d04dd34f630e0800c3260e1cc6e7f5b872b2a04ed2a4c4e2e8122e135ba23342f07e635b515d0a8f039317a5e
SSDEEP 6144:Kr+yiDlar6B3McDdhnN4R86DIqMQYe0SwXlktCfh1jRM:KrpuBznN4RZIH5XlkQdm
TLSH
T130443A42F3E581A6E0B736306A7623B15EBABC56AD39D54F1304364C2D32E64EE35336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msjet35.dll

Path C:\Windows\SysWOW64\msjet35.dll
Size 1.0MB
SHA256 91dc7e10f4f97c0046b4b91b04b5195b95f3f0fd36260fa6433ef2ef623cb0dc
MD5 2bcb3e39703a69b0235ad937c0e4b1ac
SHA1 8a3a66c533f3e9361f698f280423dad4bfa7431b
SHA512 500574ed6231d2354165052de53383190c7c187399991d3fb1ccb95709dc8cb795f4a9241d6da4f68f66ada5f1adc782786e6f2fd2a7a46252d0f9c599cefc03
SSDEEP 24576:mTZtL5tRvRV0sjN+YBMxd/r3oc90orxuD6AmuqbdRM+92b:6LvHAYmxdj3codNAmnb/
TLSH
T163259E62F1C780B5CEF26674098B772BA7361B16013ADDC7FFE81C699933902571A263
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msltus35.dll

Path C:\Windows\SysWOW64\msltus35.dll
Size 164KB
SHA256 e8c87e978a87246a32693f83027488ea204b7c6182bd80a9156bb60709276de7
MD5 89c1d25c3adb055130f42840e2663be6
SHA1 acf4d7463bc8a656199079a87824ca8db9c6a539
SHA512 3d4186213b20ccc4ca74952d3bb9ea103ed19ea3cd4514662deb763c7724267451a6d0ebaea1bcb649e165fb4b45d2ccdc93c1162be0b51560e614e3e6277847
SSDEEP 3072:e8668sapcCUnvx/IVj8FCqMq8N6lW4L2GyD0LqseLA3tomWSoOmr0eA3aatcx:e81FLO6Ccl9L2AWhmy9SoOmhA3V
TLSH
T1BEF33AC2F5C290F0DAA6763D4167372B66328F4A411FE682DBB22C696DB3A11453D3D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msmapi32.ocx

Path C:\Windows\SysWOW64\msmapi32.ocx
Size 134KB
SHA256 31e89efa4f043a7e937237b31036f00da00c2a1a771b88dd6c4db115d6192dcb
MD5 cddf7ab44fc2e4f823165d124d3885d4
SHA1 3fc2dbf113b5fa68346fb9c2616f0ad06aff6169
SHA512 de787ee04363d5b40a460162b9f9dcd4f07dc4f15365ee1019d54c5f5ced3d973e1a59ff3fde2c6742767f0beedf7020d00e1b0a953976a9d12ecdaa9cee28a2
SSDEEP 3072:y80WAViXxnCcg9t52SUF/V6MkWJtR7Zd/zDQJw+BF5E7gW0jfr:y89iiXxnG527kytRNdDYa8
TLSH
T1B8D32A52F3F54122ECB22B307A79639A5ABABC112EB5D64F5348334D4973B90DA34327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mspdox35.dll

Path C:\Windows\SysWOW64\mspdox35.dll
Size 244KB
SHA256 b7bd9fb77332b113dc615a307f24d10df999860220b0b822e21c43e6990c51eb
MD5 ec7713bd6cf95baae1a2f67c75b74376
SHA1 239f0c53f6241c0b78ff404eb7912a1e9936e4cb
SHA512 bb898434a2abd4cf510d2f14e2b20e15310d7778895e36e3ddd7a32c41e48114f8c38721d0d9b6c6d7dbf1997ab4dbd3aa3a094928ddb0ad285b1502899ec60f
SSDEEP 3072:PIewErfPt0RTebO1DQ6jfSZqqRzKsGNM3RxZ1/9IhBaVXrnXGK4CJ4KCK3sNioj5:PIen0RSOZSAsvZX2Ba8CJ4VZd6jLf4p
TLSH
T108343A83F9C355F0DDEAA63404933727A5326B1A406EE9C1FBF11D6D4E73E015228AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mstext35.dll

Path C:\Windows\SysWOW64\mstext35.dll
Size 162KB
SHA256 ae8f54c2fd76b33803c4877eaab73e133469b34436808ec6a8185616b8ff98a2
MD5 8e29affbf309490cbb33bcb25fd1f8bb
SHA1 546ec23cb9868252e0b2b7b90cda625a52da964e
SHA512 0da47d5525cfcdf7151290d6246ae1832d8d68893ce2197d60213a29cb612157b74589b610c706e283e73ff160ee3384224d14b0679aa3c7aa800982a8cd13b0
SSDEEP 3072:1stEwxdSml/eK5iN2ri2KLpYCQpj3JZba6VQktD3pdyo+hJKnaHjn6nf/oyv3c/n:1zwxdVheK5i8ri2KdYCQpj3JZ+ktD3E8
TLSH
T168F35B82E5C350F4CDFA66394197372BA6339B03A05EE9E1DBA21D655CB3B21523C387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 3927498a14d036a61057270f9e7f480da108054e4fd0a1494200c5059c1aaafa
MD5 761950098c80d3986f0c2800e44debde
SHA1 c6e9da36a0326a4e889912c92bf1b56471c92a22
SHA512 878fff38088549a6984790a749343dc7a10700f4cf684cb215fa9fd87a17fbf67db0fe6990ecb35ba4206fe24821ed84948dd3b27e48a19751ee8a174677542a
SSDEEP 24576:m2gmSp19doO/vvTLB2q+RknK/qpBA4eA22p9XpEqzRaIE2OvYR7d7nANh:W
TLSH
T1AA47C22436F92210E7F79E3CA8F0AA234D3A7D5B9C15DE8D05411B4E0961FB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{117ba27c-d81b-4043-9a10-69d053e30aa6}_OnDiskSnapshotProp

Path \??\Volume{0dc89376-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{117ba27c-d81b-4043-9a10-69d053e30aa6}_OnDiskSnapshotProp
Size 6KB
SHA256 5caaad62c2e66204b8e0d2993acd0eb1642fe773c4841932fd5e738e0d17488e
MD5 f1ed50c04e7ced05a10c3504ac92141f
SHA1 aecf3b7b67176c9568a8ac058d74d26244dbd28f
SHA512 26ba39485f63a64c512518d41c50a0ab06876dd37a148dca05f7b0d93686eefee55c8940ac1eec5d9a44ff29c00ce43f568e66cc79f2f4a1335c053f26a5cdce
SSDEEP 96:FjdezwBvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:tdLb++ZVmN
TLSH
T1DBD18A085AE54711E2B3AB7128F18557A877B911EF33CB8E0298238E2670A10F875F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-272-0x0000000002590000-0x00000000025A2000-memory.dmp

Download

memory/220-273-0x0000000021C10000-0x0000000021C2E000-memory.dmp

Download

memory/220-269-0x0000000000AB0000-0x0000000000AC1000-memory.dmp

Download

memory/1908-221-0x000001A37EDB0000-0x000001A37EE2B000-memory.dmp

Download

memory/1908-232-0x000001A37ED30000-0x000001A37EDAC000-memory.dmp

Download

memory/1908-220-0x000001A37ED30000-0x000001A37EDAC000-memory.dmp

Download

memory/1908-233-0x000001A37EDB0000-0x000001A37EE2B000-memory.dmp

Download

memory/4824-257-0x0000000021C10000-0x0000000021C2E000-memory.dmp

Download

memory/4824-262-0x0000000021D70000-0x0000000021D96000-memory.dmp

Download

memory/4824-248-0x0000000002E00000-0x0000000002E12000-memory.dmp

Download

memory/4824-241-0x00000000008D0000-0x00000000008E1000-memory.dmp

Download