Overview

overview

7

Static

static

1

filmcraft-...64.msi

windows10-2004-x64

7

filmcraft-...64.msi

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    148s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/10/2026, 15:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    filmcraft-0.2.1-windows-x64.msi
  • Size 24.6MB
  • Sample261014-tdjsnsvt2k
  • SHA256 cfe73eea4523a8ee896b4888a7208158b22506a73bd08f811c2880596bbad503
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
persistenceprivilege_escalationransomware

Malware Config

Signatures

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 14 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 23 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\filmcraft-0.2.1-windows-x64.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:4584
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5464
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:5532

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e597ead.rbs
        • Path C:\Config.Msi\e597ead.rbs
        • Size 8KB
        • SHA256 f9765676c3a45dcc924be18429d8655259e14d7d9da1c1edf6a929fcccd178b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        68D3CB5DF8B60914CA2C29396FD1ED7E
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\68D3CB5DF8B60914CA2C29396FD1ED7E
        • Size 22KB
        • SHA256 481ff1cc00321e9c585b2204e188cc6c9d9a73357a2964b9bed10ac9c896fd1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
        • Size 1KB
        • SHA256 2657554d562dcfbf326e79fc6739eab8c92681ef72fa19f0f292e8e6980650f1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        EF7234CDBB1649702229F955C785C39F
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EF7234CDBB1649702229F955C785C39F
        • Size 785B
        • SHA256 9e153cc9331fb887cacd6f08cfa3dc5aac7b9b26b4b9cfa75d2ac57288e9142a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        68D3CB5DF8B60914CA2C29396FD1ED7E
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\68D3CB5DF8B60914CA2C29396FD1ED7E
        • Size 290B
        • SHA256 2383a437212636ca4efe4885c905bb3fd41cc1997c6881e6eb2eedd6f28a74e6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
        • Size 422B
        • SHA256 0c666bcd63c356344aebd0093d51455075cea78bf50ee7c00c422d67d80fcab3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        EF7234CDBB1649702229F955C785C39F
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EF7234CDBB1649702229F955C785C39F
        • Size 308B
        • SHA256 ed188bb09b48a5ff9f49a80667c1d345742d23eea5d67695412ae50d76900237
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        e597eae.msi
        • Path C:\Windows\Installer\e597eae.msi
        • Size 24.6MB
        • SHA256 cfe73eea4523a8ee896b4888a7208158b22506a73bd08f811c2880596bbad503
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        metadata-2
        • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
        • Size 26.1MB
        • SHA256 93d9c955eef0a0363854e70c9c294dda88611094cd370dfc81bffec6bab43728
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {b2c7f45f-d00c-4483-a0b6-2780f67c1751}_OnDiskSnapshotProp
        • Path \??\Volume{e70967fa-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{b2c7f45f-d00c-4483-a0b6-2780f67c1751}_OnDiskSnapshotProp
        • Size 6KB
        • SHA256 8c3022d08e2d6149c358e4f17da15bcaa7b01d34d79b5ccb8a858d32854ec2d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download