Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/10/2026, 15:00
Static task
static1
Behavioral task
behavioral1
Sample
photocraft-0.7.0-windows-x64.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
photocraft-0.7.0-windows-x64.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target photocraft-0.7.0-windows-x64.msi
- Size 61.6MB
- Sample261012-sdlrlasz9l
- SHA256 af959a169ba0b93bdcec4df0e9dfdbac365b7759d3d74b06c3f8f96ed45ff9a0
- MD5 89d779ecead7cb91d4118c3db93f81f8
- SHA1 9aeb411c568790dde22d1c6492c3308c8741b795
- SHA512 677aa8f1b5c1586e1d034c5bb29b9bea940973c47e13d9cd278af6fbd1150c4e621d802e1f40703d306d37d3cd3a8e1d8399792c47e652f51c36e3e7fe8471bf
- SSDEEP 1572864:BN780imfsj5VA4bTWzZdWR53I7oIY1opJ:BO0wrb+TM54mopJ
- TLSH T1C8E73386B7C01468F55F053EC6BFA61587BA3D0C63D0A08E96683117DE7A760E5FB388
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3312 photocraft.exe - Loads dropped DLL 2 IoCs
pid Process 2564 MsiExec.exe 2564 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\PhotoCraft\photocraft-cli.exe msiexec.exe File created C:\Program Files\PhotoCraft\photocraft.exe msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Installer\{C10DE45D-077A-4443-961C-8217639B66D2}\PhotocraftIcon.exe msiexec.exe File created C:\Windows\Installer\e59f526.msi msiexec.exe File created C:\Windows\SystemTemp\~DF5D26CA92069BB7BE.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFF3D32C522BA73624.TMP msiexec.exe File opened for modification C:\Windows\Installer\e59f524.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFBFB79A9711A606B7.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{C10DE45D-077A-4443-961C-8217639B66D2} msiexec.exe File opened for modification C:\Windows\Installer\MSI2C61.tmp msiexec.exe File created C:\Windows\Installer\{C10DE45D-077A-4443-961C-8217639B66D2}\PhotocraftIcon.exe msiexec.exe File created C:\Windows\Installer\e59f524.msi msiexec.exe File created C:\Windows\SystemTemp\~DF339EE3CDAF47795A.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5032 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002fc1fe242d8ae0d60000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838012fc1fe240000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841012fc1fe24000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e32fc1fe2400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e62fc1fe2400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\.jpg\OpenWithProgids msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tga\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.qoi\OpenWithProgids\Photocraft.Image msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Photocraft.Image msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.PhotoshopDocument\shell msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.exr\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.bmp msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D54ED01CA770344469C1287136B9662D\ProductName = "PhotoCraft" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.Document\shell\open\command\ = "\"C:\\Program Files\\PhotoCraft\\photocraft.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.Image\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pdn\OpenWithProgids msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.jpeg\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hdr\OpenWithProgids\Photocraft.Image msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Applications\photocraft.exe\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D54ED01CA770344469C1287136B9662D\PackageCode = "8F39D65091CECF444B66EF5717B4F0E2" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.psb\OpenWithProgids msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ora\OpenWithProgids msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.gif\OpenWithProgids msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.exr\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.qoi msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D54ED01CA770344469C1287136B9662D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D54ED01CA770344469C1287136B9662D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.ora\OpenWithProgids msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D54ED01CA770344469C1287136B9662D\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.tga\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gif\OpenWithProgids\Photocraft.Image msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.bmp\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.exr\OpenWithProgids\Photocraft.Image msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D54ED01CA770344469C1287136B9662D\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.ico\OpenWithProgids msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D54ED01CA770344469C1287136B9662D\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.Document\ = "PhotoCraft Document" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Photocraft.PhotoshopDocument\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdn\OpenWithProgids\Photocraft.Image msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.hdr msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D54ED01CA770344469C1287136B9662D\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Photocraft.Document\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hdr\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.ico msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D54ED01CA770344469C1287136B9662D\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Photocraft.Document\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Photocraft.Document\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.Image\ = "Image" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.Image\shell\open\command\ = "\"C:\\Program Files\\PhotoCraft\\photocraft.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Applications\photocraft.exe msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D54ED01CA770344469C1287136B9662D\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D54ED01CA770344469C1287136B9662D\SourceList\PackageName = "photocraft-0.7.0-windows-x64.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.PhotoshopDocument\ = "PSD Document" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.qoi\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.pcraft msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.tiff msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.psb msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.pdn\OpenWithProgids msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.qoi\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.tga msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D54ED01CA770344469C1287136B9662D\Main msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.jpeg msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Photocraft.Document msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Photocraft.Image\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tga\OpenWithProgids\Photocraft.Image msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D54ED01CA770344469C1287136B9662D\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.Document msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.png\OpenWithProgids\Photocraft.Image msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.jpeg\OpenWithProgids\Photocraft.Image msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4224 msiexec.exe 4224 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5032 msiexec.exe Token: SeIncreaseQuotaPrivilege 5032 msiexec.exe Token: SeSecurityPrivilege 4224 msiexec.exe Token: SeCreateTokenPrivilege 5032 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5032 msiexec.exe Token: SeLockMemoryPrivilege 5032 msiexec.exe Token: SeIncreaseQuotaPrivilege 5032 msiexec.exe Token: SeMachineAccountPrivilege 5032 msiexec.exe Token: SeTcbPrivilege 5032 msiexec.exe Token: SeSecurityPrivilege 5032 msiexec.exe Token: SeTakeOwnershipPrivilege 5032 msiexec.exe Token: SeLoadDriverPrivilege 5032 msiexec.exe Token: SeSystemProfilePrivilege 5032 msiexec.exe Token: SeSystemtimePrivilege 5032 msiexec.exe Token: SeProfSingleProcessPrivilege 5032 msiexec.exe Token: SeIncBasePriorityPrivilege 5032 msiexec.exe Token: SeCreatePagefilePrivilege 5032 msiexec.exe Token: SeCreatePermanentPrivilege 5032 msiexec.exe Token: SeBackupPrivilege 5032 msiexec.exe Token: SeRestorePrivilege 5032 msiexec.exe Token: SeShutdownPrivilege 5032 msiexec.exe Token: SeDebugPrivilege 5032 msiexec.exe Token: SeAuditPrivilege 5032 msiexec.exe Token: SeSystemEnvironmentPrivilege 5032 msiexec.exe Token: SeChangeNotifyPrivilege 5032 msiexec.exe Token: SeRemoteShutdownPrivilege 5032 msiexec.exe Token: SeUndockPrivilege 5032 msiexec.exe Token: SeSyncAgentPrivilege 5032 msiexec.exe Token: SeEnableDelegationPrivilege 5032 msiexec.exe Token: SeManageVolumePrivilege 5032 msiexec.exe Token: SeImpersonatePrivilege 5032 msiexec.exe Token: SeCreateGlobalPrivilege 5032 msiexec.exe Token: SeCreateTokenPrivilege 5032 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5032 msiexec.exe Token: SeLockMemoryPrivilege 5032 msiexec.exe Token: SeIncreaseQuotaPrivilege 5032 msiexec.exe Token: SeMachineAccountPrivilege 5032 msiexec.exe Token: SeTcbPrivilege 5032 msiexec.exe Token: SeSecurityPrivilege 5032 msiexec.exe Token: SeTakeOwnershipPrivilege 5032 msiexec.exe Token: SeLoadDriverPrivilege 5032 msiexec.exe Token: SeSystemProfilePrivilege 5032 msiexec.exe Token: SeSystemtimePrivilege 5032 msiexec.exe Token: SeProfSingleProcessPrivilege 5032 msiexec.exe Token: SeIncBasePriorityPrivilege 5032 msiexec.exe Token: SeCreatePagefilePrivilege 5032 msiexec.exe Token: SeCreatePermanentPrivilege 5032 msiexec.exe Token: SeBackupPrivilege 5032 msiexec.exe Token: SeRestorePrivilege 5032 msiexec.exe Token: SeShutdownPrivilege 5032 msiexec.exe Token: SeDebugPrivilege 5032 msiexec.exe Token: SeAuditPrivilege 5032 msiexec.exe Token: SeSystemEnvironmentPrivilege 5032 msiexec.exe Token: SeChangeNotifyPrivilege 5032 msiexec.exe Token: SeRemoteShutdownPrivilege 5032 msiexec.exe Token: SeUndockPrivilege 5032 msiexec.exe Token: SeSyncAgentPrivilege 5032 msiexec.exe Token: SeEnableDelegationPrivilege 5032 msiexec.exe Token: SeManageVolumePrivilege 5032 msiexec.exe Token: SeImpersonatePrivilege 5032 msiexec.exe Token: SeCreateGlobalPrivilege 5032 msiexec.exe Token: SeCreateTokenPrivilege 5032 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5032 msiexec.exe Token: SeLockMemoryPrivilege 5032 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 5032 msiexec.exe 5032 msiexec.exe 3312 photocraft.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5032 msiexec.exe 4224 msiexec.exe 2564 MsiExec.exe 3312 photocraft.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4224 wrote to memory of 2564 4224 msiexec.exe 90 PID 4224 wrote to memory of 4988 4224 msiexec.exe 97 PID 2564 wrote to memory of 3312 2564 MsiExec.exe 100 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\photocraft-0.7.0-windows-x64.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5032
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 6D56B363DEE2804941C4F2047CE898BB C2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Program Files\PhotoCraft\photocraft.exe"C:\Program Files\PhotoCraft\photocraft.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3312
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4988
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4356
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3016
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59f525.rbs
- Size 14KB
- SHA256 35a947f59e6e4cf1735cd950ca7f2867fdfe34b5567d51e35434028b50ddef1b
- MD5 9617aa5a65e9936ca4cceb3d7bb2630b
- SHA1 596a5b1d589b49f2c055a34b6e6e50d62f351364
- SHA512 7b3689faf8ef46ed24baa03da1e615fcaeae32a010e5d3ccb1b0a982f6bba7c215bcc1e541f9564278252a0ff92af10a9c818a1e6d5e60d12817d73870607127
- SSDEEP 192:2a3VvVV7E8SU/S6ERCLQXc/mILZXc/mZLybbQ3pA:2a3VvVVoXc/9ZXc/SasO
- TLSH T167620082B602A6C2F4D71730CA1B2F553B73C7E88745534F09DC95246E8778A3EAAD4E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI37DB.tmp
- Size 390KB
- SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
- MD5 e8dc682f2c486075c6aba658971a62cc
- SHA1 7cd0a2b5047a4074aa06a6caa3bb69124851e95d
- SHA512 a0a1f0f418bf2d4ffd079b840aeb0142c7faab7fa72b5e33b1841798569f55a25dfd305abf9c2ca89792f6499f695b69975882697dc53e99d5a975a9fa8c7d75
- SSDEEP 6144:p2ET2+QBLh+MVy5DCRoRRvc181kaKN8MMLuG:p2ET2+cVXVyNhvcCkaKN8Me
- TLSH T10D846B29F7E408EDE4B78276C5A68530FF75748D3320D5AE47A8852D1F3AAA070BB701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI84C6.tmp
- Size 175KB
- SHA256 9d6745913a51d4c6749a4119f87da410cb226c45a72d6dbc3231efe5b928f491
- MD5 543072c649a87e1880784b7f0effaeeb
- SHA1 c0f986dbb344aab2efe92bffbc8e683f11558f80
- SHA512 b7a16edd32a517245ba3c70d83175009486e840f9a0820b8d787b3e39b8594687617f67c50db253bce213786609975bb969325150b99ccdcb4e4b858e539ef2d
- SSDEEP 3072:nColDBwKxdtOToLEzKqflmw9N+rDoluP2:nl+Kx/XL4KIT5
- TLSH T188046C5673B400BAE8B78235C4934A16EB76B8511720DBDF07A4433A9F2F3D1A93E761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 532fc9700cd934c36924c644afe3ee954d01e8a9acb18d596b6aa7cc5442de0b
- MD5 90cffc33fc8c7f053659cac667b05a59
- SHA1 b07f035f391250f3dbaf7638a5564a2277a78761
- SHA512 f29f757bdcaffe43a1d2c58d3d47cc35ec6f77f0e55fc161bad78dfdbbc28f36525717b39a2dd04f5c1e24f49c1d5dfa5e6f9bc35e53ac64ba4cc08bbaaf5696
- SSDEEP 24576:pFo3DMPYdoO/vvTL/SghxClQfLu7KrWCkMHjdMP5HkvapWwxMYxWRorg1ed:8H0
- TLSH T10457B31836F92101E7B7DE3DA8F0AA234D397D5B9C16DE8D05811B4E0861F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{24fec12f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{a519db2a-5b87-4160-bf4d-d2bcf95a4e48}_OnDiskSnapshotProp
- Size 6KB
- SHA256 e5ca754035606143aa3775a1b164de07bb652350f4b4e768df51f00419ec6ef0
- MD5 fedcb228a485313614cfe9618e95b9ee
- SHA1 86ad4e88dda3a8caac00b61e579e5165d8094e14
- SHA512 83ed0b259b5f016b7833df354c65d41fdbfd3dc4033e1321a34489fdcfe42a894b6ddf6d2a11601a54e9c5fc71d08560a213966b70d1bf90bcde31c6621c654a
- SSDEEP 96:F2S+26vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:sSkb++uVm
- TLSH T1B4D1980C5AF54711E2B3AB7129F18557A877B911EF33CB8E0298238E2670910F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH