Analysis
- max time kernel
149s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 05:21
Static task
static1
Behavioral task
behavioral1
Sample
photocraft-0.10.0-windows-x64.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
photocraft-0.10.0-windows-x64.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target photocraft-0.10.0-windows-x64.msi
- Size 67.5MB
- Sample261024-f2ft2axt4q
- SHA256 96a2a77093d3cdbfe72e989c9fb5bddcdcec94abb0261ad0617b07e893f4542b
- MD5 f7f6f60df95db055e21ecb2af75a9f54
- SHA1 ecda93d8708d11d310374e88aaea145a995ef035
- SHA512 3a1c2347143037569a0d49612baa4f6e87d5746a2c0b11bb1a44ff06d63c839291c5672015679ef37c76be74614c1b6f4b3976ea919ecc18a64da75bffe840b9
- SSDEEP 1572864:E12q4XW7fK8pwTEeVc+YN40Y+lr0LCqsy/S4IaDPLeewuY:E1JdfKsWv66yr2/S/arLeew
- TLSH T106F7336BF7910A9EF0AE817DC2BE5A51EAB53E4C63D0965E0320711BEEB8550F0B7341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 4628 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\PhotoCraft\photocraft.exe msiexec.exe File created C:\Program Files\PhotoCraft\photocraft-cli.exe msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFA742B1572E31F8DC.TMP msiexec.exe File created C:\Windows\Installer\{75F65070-F611-431B-A42B-B953FDE451B4}\PhotocraftIcon.exe msiexec.exe File created C:\Windows\Installer\e5af427.msi msiexec.exe File created C:\Windows\SystemTemp\~DFD2F13803E0283E9D.TMP msiexec.exe File opened for modification C:\Windows\Installer\e5af425.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIFF70.tmp msiexec.exe File opened for modification C:\Windows\Installer\{75F65070-F611-431B-A42B-B953FDE451B4}\PhotocraftIcon.exe msiexec.exe File created C:\Windows\SystemTemp\~DF164D83AACD596999.TMP msiexec.exe File created C:\Windows\Installer\e5af425.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF9AF920F7F3220961.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{75F65070-F611-431B-A42B-B953FDE451B4} msiexec.exe - Executes dropped EXE 1 IoCs
pid Process 1480 photocraft.exe - Loads dropped DLL 2 IoCs
pid Process 1956 MsiExec.exe 1956 MsiExec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4628 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027445be3350784180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380127445be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410127445be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e327445be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e627445be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pcraft\ = "Photocraft.Document" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.Image\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.kra msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.jpeg\OpenWithProgids msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Applications\photocraft.exe\SupportedTypes msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.pdn msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ora msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.krz msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hdr msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\shell\open\command\ = "\"C:\\Program Files\\PhotoCraft\\photocraft.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.psd\OpenWithProgids\Photocraft.PhotoshopDocument msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.png\OpenWithProgids\Photocraft.Image msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07056F57116FB1344AB29B35DF4E154B\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07056F57116FB1344AB29B35DF4E154B\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Photocraft.Image\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.ico\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.psd msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.ico msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\23F0669DA0D2EBA47BD371EB521F45C2 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.kra\OpenWithProgids msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Photocraft.Image msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Photocraft.PhotoshopDocument\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07056F57116FB1344AB29B35DF4E154B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Photocraft.Document\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.tiff msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.avif msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07056F57116FB1344AB29B35DF4E154B\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.tga msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07056F57116FB1344AB29B35DF4E154B\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.qoi\OpenWithProgids msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.png msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07056F57116FB1344AB29B35DF4E154B\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.psd\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.jpeg\OpenWithProgids\Photocraft.Image msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gif\OpenWithProgids\Photocraft.Image msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.avif\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.hdr msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07056F57116FB1344AB29B35DF4E154B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.PhotoshopDocument msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ora\OpenWithProgids msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.tga\OpenWithProgids msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tga\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tga\OpenWithProgids\Photocraft.Image msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.qoi msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.ora\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.krz\OpenWithProgids\Photocraft.Image msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pdn\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hdr\OpenWithProgids\Photocraft.Image msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Photocraft.Document\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.Document\shell\open msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.bmp\OpenWithProgids msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07056F57116FB1344AB29B35DF4E154B\PackageCode = "FBEE558476E69554D9E6425128F0057A" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.qoi\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.Document\shell\open\ = "Open" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.PhotoshopDocument\shell\open\command\ = "\"C:\\Program Files\\PhotoCraft\\photocraft.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.Image\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tiff\OpenWithProgids\Photocraft.Image msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.PhotoshopDocument\ = "PSD Document" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.Image\ = "Image" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.psb\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ora\OpenWithProgids\Photocraft.Image msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1404 msiexec.exe 1404 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4628 msiexec.exe Token: SeIncreaseQuotaPrivilege 4628 msiexec.exe Token: SeSecurityPrivilege 1404 msiexec.exe Token: SeCreateTokenPrivilege 4628 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4628 msiexec.exe Token: SeLockMemoryPrivilege 4628 msiexec.exe Token: SeIncreaseQuotaPrivilege 4628 msiexec.exe Token: SeMachineAccountPrivilege 4628 msiexec.exe Token: SeTcbPrivilege 4628 msiexec.exe Token: SeSecurityPrivilege 4628 msiexec.exe Token: SeTakeOwnershipPrivilege 4628 msiexec.exe Token: SeLoadDriverPrivilege 4628 msiexec.exe Token: SeSystemProfilePrivilege 4628 msiexec.exe Token: SeSystemtimePrivilege 4628 msiexec.exe Token: SeProfSingleProcessPrivilege 4628 msiexec.exe Token: SeIncBasePriorityPrivilege 4628 msiexec.exe Token: SeCreatePagefilePrivilege 4628 msiexec.exe Token: SeCreatePermanentPrivilege 4628 msiexec.exe Token: SeBackupPrivilege 4628 msiexec.exe Token: SeRestorePrivilege 4628 msiexec.exe Token: SeShutdownPrivilege 4628 msiexec.exe Token: SeDebugPrivilege 4628 msiexec.exe Token: SeAuditPrivilege 4628 msiexec.exe Token: SeSystemEnvironmentPrivilege 4628 msiexec.exe Token: SeChangeNotifyPrivilege 4628 msiexec.exe Token: SeRemoteShutdownPrivilege 4628 msiexec.exe Token: SeUndockPrivilege 4628 msiexec.exe Token: SeSyncAgentPrivilege 4628 msiexec.exe Token: SeEnableDelegationPrivilege 4628 msiexec.exe Token: SeManageVolumePrivilege 4628 msiexec.exe Token: SeImpersonatePrivilege 4628 msiexec.exe Token: SeCreateGlobalPrivilege 4628 msiexec.exe Token: SeCreateTokenPrivilege 4628 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4628 msiexec.exe Token: SeLockMemoryPrivilege 4628 msiexec.exe Token: SeIncreaseQuotaPrivilege 4628 msiexec.exe Token: SeMachineAccountPrivilege 4628 msiexec.exe Token: SeTcbPrivilege 4628 msiexec.exe Token: SeSecurityPrivilege 4628 msiexec.exe Token: SeTakeOwnershipPrivilege 4628 msiexec.exe Token: SeLoadDriverPrivilege 4628 msiexec.exe Token: SeSystemProfilePrivilege 4628 msiexec.exe Token: SeSystemtimePrivilege 4628 msiexec.exe Token: SeProfSingleProcessPrivilege 4628 msiexec.exe Token: SeIncBasePriorityPrivilege 4628 msiexec.exe Token: SeCreatePagefilePrivilege 4628 msiexec.exe Token: SeCreatePermanentPrivilege 4628 msiexec.exe Token: SeBackupPrivilege 4628 msiexec.exe Token: SeRestorePrivilege 4628 msiexec.exe Token: SeShutdownPrivilege 4628 msiexec.exe Token: SeDebugPrivilege 4628 msiexec.exe Token: SeAuditPrivilege 4628 msiexec.exe Token: SeSystemEnvironmentPrivilege 4628 msiexec.exe Token: SeChangeNotifyPrivilege 4628 msiexec.exe Token: SeRemoteShutdownPrivilege 4628 msiexec.exe Token: SeUndockPrivilege 4628 msiexec.exe Token: SeSyncAgentPrivilege 4628 msiexec.exe Token: SeEnableDelegationPrivilege 4628 msiexec.exe Token: SeManageVolumePrivilege 4628 msiexec.exe Token: SeImpersonatePrivilege 4628 msiexec.exe Token: SeCreateGlobalPrivilege 4628 msiexec.exe Token: SeCreateTokenPrivilege 4628 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4628 msiexec.exe Token: SeLockMemoryPrivilege 4628 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4628 msiexec.exe 4628 msiexec.exe 1480 photocraft.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4628 msiexec.exe 1404 msiexec.exe 1956 MsiExec.exe 1480 photocraft.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1404 wrote to memory of 1956 1404 msiexec.exe 89 PID 1404 wrote to memory of 3364 1404 msiexec.exe 95 PID 1956 wrote to memory of 1480 1956 MsiExec.exe 98 PID 1480 wrote to memory of 5980 1480 photocraft.exe 99 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\photocraft-0.10.0-windows-x64.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4628
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 54D321BB9414111CF2A4BC3043DE99A7 C2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Program Files\PhotoCraft\photocraft.exe"C:\Program Files\PhotoCraft\photocraft.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\system32\reg.exe"reg" query "HKCU\Control Panel\International" /v LocaleName4⤵PID:5980
-
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3364
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2680
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5af426.rbs
- Size 14KB
- SHA256 c78df3c146a5e3fd5da901b14ec91af1eb5b01d68e45573d83bf8aae7b698bcb
- MD5 ff8626834f74753e4be84b070dcf33f6
- SHA1 36671cd8b593233f3665ccc4391fe6df3b7c692f
- SHA512 2a2361ef6c8ea8014a25e537becd7cb9ad21393fa5ff441f516f883a9b42fb1c607bdb39ef20bcb406089b4ececb8b216d6deea4d25b13965e40abe095e684fb
- SSDEEP 192:DCem5ZBYI8SU/S6EuCXlFQIuFQnYlvopoo:DCem5fY+FSFTpo
- TLSH T181622081BA41A7D1F4D79730CA6B1B553772C3D98345238F049CA1242F8375A2EBAE9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI1BD2.tmp
- Size 390KB
- SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
- MD5 e8dc682f2c486075c6aba658971a62cc
- SHA1 7cd0a2b5047a4074aa06a6caa3bb69124851e95d
- SHA512 a0a1f0f418bf2d4ffd079b840aeb0142c7faab7fa72b5e33b1841798569f55a25dfd305abf9c2ca89792f6499f695b69975882697dc53e99d5a975a9fa8c7d75
- SSDEEP 6144:p2ET2+QBLh+MVy5DCRoRRvc181kaKN8MMLuG:p2ET2+cVXVyNhvcCkaKN8Me
- TLSH T10D846B29F7E408EDE4B78276C5A68530FF75748D3320D5AE47A8852D1F3AAA070BB701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI9C22.tmp
- Size 175KB
- SHA256 9d6745913a51d4c6749a4119f87da410cb226c45a72d6dbc3231efe5b928f491
- MD5 543072c649a87e1880784b7f0effaeeb
- SHA1 c0f986dbb344aab2efe92bffbc8e683f11558f80
- SHA512 b7a16edd32a517245ba3c70d83175009486e840f9a0820b8d787b3e39b8594687617f67c50db253bce213786609975bb969325150b99ccdcb4e4b858e539ef2d
- SSDEEP 3072:nColDBwKxdtOToLEzKqflmw9N+rDoluP2:nl+Kx/XL4KIT5
- TLSH T188046C5673B400BAE8B78235C4934A16EB76B8511720DBDF07A4433A9F2F3D1A93E761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 897b9da503127e863e197e55decc6f1ad1983e500fd4a22b53a466a28c19cdcb
- MD5 da0502e73b042fef6d92916a7cc926a8
- SHA1 361429d5d7c9b22d6635902175d06277fc4ef930
- SHA512 efc015fe758767914bd628aed475c251989aa8e2b64f45d3c26f662ff8c108424c04caebe5bf61be04299780c1562d0e12e62c1829346598828daa85b669e109
- SSDEEP 24576:YFo3DMPndoO/vvTL/SAuOilQvru0VbJ90z48dDgm47AKJpvOMoR2uXUPKeQ:+Hw
- TLSH T18357042532F92211E7F39F3CA8F46A2349397D5B9C15DE8D45411B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{e35b4427-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{308a0c72-1f45-41a0-9735-6b8d05470855}_OnDiskSnapshotProp
- Size 6KB
- SHA256 a5bf0e8e5d340b4bc6de8a115ec3b70164c480a889e2ffa2cd8ee43b9c7d6953
- MD5 a47e063482a07cc1613a762e53689bcc
- SHA1 24e2aeb1ceda6d2f80941fda0505a21e8e0a150c
- SHA512 8f21c3411585cd5060a6d25ca09413650fe3aa66373029038077c5d1f769ca371e75d4303d7ce10de51189fa776415c3cdabf2562ea2035f4c12076627c7deda
- SSDEEP 96:FhS+Fvvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:7S0b++uVm
- TLSH T157D188185AF54711E2B3AB7128F18557A477B912EF33CB8E0198238E2670A10F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH