8e2cec488eee06da057192bce2c4512a69317ed96d7fb3009906eee96751b423

Analysis

user interaction
yes
max time kernel
129s
max time network
129s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/11/2026, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
photocraft-0.18.0-windows-x86.msi
Size 98.3MB
Sample261102-hc47faed29
SHA256 8e2cec488eee06da057192bce2c4512a69317ed96d7fb3009906eee96751b423
MD5 8dcc562c925f9c867d01d80c3c155a34
SHA1 c0db3325cafc5f681503b855691644896d38d457
SHA512 0bb260de3ad10e488d018d92d87ef2032a4a8e359f1d32c452e60282e6f2d71e58114ed71171e5226477775ac9292de3625f52347b98388184b449e5799f23cd
SSDEEP 3145728:GbcuJfaNmT9cL9EwDcExA0EBl6gr87Pic:PqCNkcLWExiBl6gr8Wc
TLSH
T1893833173EE88826F25E1D3FA03CFF108ABA1E1C57D0454B23403567A9F5A52EEB7616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	464	msiexec.exe
3	464	msiexec.exe
4	464	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5904c9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6F97B9AF-9D84-48E5-874A-301A9AD2CA2E}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB77993F2020AF999.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF655D06462DE750EE.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5904c9.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF854DB9037B5C509A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6A.tmp	msiexec.exe
File created	C:\Windows\Installer\e5904cb.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF59BE30B578C8F387.TMP	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
5820	photocraft.exe
1804	photocraft.exe

Loads dropped DLL 2 IoCs

pid	Process
4196	MsiExec.exe
4196	MsiExec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
464	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	photocraft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	photocraft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a0ced4dedd8b0f9b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a0ced4de0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900a0ced4de000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aa0ced4de000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da0ced4de000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Applications\photocraft.exe\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Applications\photocraft.exe\SupportedTypes\.jpeg	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Photocraft.Image\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\ArtCraft\\PhotoCraft\\photocraft.exe\",0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.psb\OpenWithProgids	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.ora\OpenWithProgids	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.qoi	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Applications\photocraft.exe	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Photocraft.Document\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Photocraft.PhotoshopDocument\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\ArtCraft\\PhotoCraft\\photocraft.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.gif\OpenWithProgids\Photocraft.Image	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.bmp\OpenWithProgids	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Applications	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Applications\photocraft.exe\SupportedTypes\.pcraft	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Applications\photocraft.exe\SupportedTypes\.krz	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Applications\photocraft.exe\SupportedTypes\.png	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Applications\photocraft.exe\SupportedTypes\.webp	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Photocraft.PhotoshopDocument\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.pdn\OpenWithProgids	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.kra	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.tif\OpenWithProgids	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.tiff\OpenWithProgids\Photocraft.Image	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.avif\OpenWithProgids	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Applications\photocraft.exe\FriendlyAppName = "PhotoCraft"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Applications\photocraft.exe\shell\open	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.pdn	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.jpeg\OpenWithProgids	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.bmp\OpenWithProgids\Photocraft.Image	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.hdr	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Photocraft.Document\ = "PhotoCraft Document"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Photocraft.PhotoshopDocument\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\ArtCraft\\PhotoCraft\\photocraft.exe\",0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Photocraft.Image\DefaultIcon	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Photocraft.Image\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Photocraft.Image	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.ora	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.jpeg\OpenWithProgids\Photocraft.Image	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.qoi\OpenWithProgids	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Applications\photocraft.exe\SupportedTypes\.kra	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Photocraft.PhotoshopDocument\ = "PSD Document"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Photocraft.PhotoshopDocument\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.krz	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.tga\OpenWithProgids	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Applications\photocraft.exe\SupportedTypes\.psd	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Applications\photocraft.exe\SupportedTypes\.ora	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Applications\photocraft.exe\SupportedTypes\.tiff	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Applications\photocraft.exe\SupportedTypes\.gif	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Photocraft.Document\shell\open\ = "Open"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.krz\OpenWithProgids	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.png\OpenWithProgids	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.jpg\OpenWithProgids\Photocraft.Image	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Applications\photocraft.exe\SupportedTypes\.tif	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Photocraft.Document\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\ArtCraft\\PhotoCraft\\photocraft.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Photocraft.Image\ = "Image"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Photocraft.Image\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Photocraft.Image\shell\open	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.psb	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.krz\OpenWithProgids\Photocraft.Image	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.qoi\OpenWithProgids\Photocraft.Image	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Applications\photocraft.exe\shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Applications\photocraft.exe\SupportedTypes\.exr	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.pcraft\ = "Photocraft.Document"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.kra\OpenWithProgids	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\.avif\OpenWithProgids\Photocraft.Image	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Applications\photocraft.exe\SupportedTypes\.hdr	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Applications\photocraft.exe\SupportedTypes\.avif	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4072	msiexec.exe
4072	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	464	msiexec.exe
Token: SeIncreaseQuotaPrivilege	464	msiexec.exe
Token: SeSecurityPrivilege	4072	msiexec.exe
Token: SeCreateTokenPrivilege	464	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	464	msiexec.exe
Token: SeLockMemoryPrivilege	464	msiexec.exe
Token: SeIncreaseQuotaPrivilege	464	msiexec.exe
Token: SeMachineAccountPrivilege	464	msiexec.exe
Token: SeTcbPrivilege	464	msiexec.exe
Token: SeSecurityPrivilege	464	msiexec.exe
Token: SeTakeOwnershipPrivilege	464	msiexec.exe
Token: SeLoadDriverPrivilege	464	msiexec.exe
Token: SeSystemProfilePrivilege	464	msiexec.exe
Token: SeSystemtimePrivilege	464	msiexec.exe
Token: SeProfSingleProcessPrivilege	464	msiexec.exe
Token: SeIncBasePriorityPrivilege	464	msiexec.exe
Token: SeCreatePagefilePrivilege	464	msiexec.exe
Token: SeCreatePermanentPrivilege	464	msiexec.exe
Token: SeBackupPrivilege	464	msiexec.exe
Token: SeRestorePrivilege	464	msiexec.exe
Token: SeShutdownPrivilege	464	msiexec.exe
Token: SeDebugPrivilege	464	msiexec.exe
Token: SeAuditPrivilege	464	msiexec.exe
Token: SeSystemEnvironmentPrivilege	464	msiexec.exe
Token: SeChangeNotifyPrivilege	464	msiexec.exe
Token: SeRemoteShutdownPrivilege	464	msiexec.exe
Token: SeUndockPrivilege	464	msiexec.exe
Token: SeSyncAgentPrivilege	464	msiexec.exe
Token: SeEnableDelegationPrivilege	464	msiexec.exe
Token: SeManageVolumePrivilege	464	msiexec.exe
Token: SeImpersonatePrivilege	464	msiexec.exe
Token: SeCreateGlobalPrivilege	464	msiexec.exe
Token: SeCreateTokenPrivilege	464	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	464	msiexec.exe
Token: SeLockMemoryPrivilege	464	msiexec.exe
Token: SeIncreaseQuotaPrivilege	464	msiexec.exe
Token: SeMachineAccountPrivilege	464	msiexec.exe
Token: SeTcbPrivilege	464	msiexec.exe
Token: SeSecurityPrivilege	464	msiexec.exe
Token: SeTakeOwnershipPrivilege	464	msiexec.exe
Token: SeLoadDriverPrivilege	464	msiexec.exe
Token: SeSystemProfilePrivilege	464	msiexec.exe
Token: SeSystemtimePrivilege	464	msiexec.exe
Token: SeProfSingleProcessPrivilege	464	msiexec.exe
Token: SeIncBasePriorityPrivilege	464	msiexec.exe
Token: SeCreatePagefilePrivilege	464	msiexec.exe
Token: SeCreatePermanentPrivilege	464	msiexec.exe
Token: SeBackupPrivilege	464	msiexec.exe
Token: SeRestorePrivilege	464	msiexec.exe
Token: SeShutdownPrivilege	464	msiexec.exe
Token: SeDebugPrivilege	464	msiexec.exe
Token: SeAuditPrivilege	464	msiexec.exe
Token: SeSystemEnvironmentPrivilege	464	msiexec.exe
Token: SeChangeNotifyPrivilege	464	msiexec.exe
Token: SeRemoteShutdownPrivilege	464	msiexec.exe
Token: SeUndockPrivilege	464	msiexec.exe
Token: SeSyncAgentPrivilege	464	msiexec.exe
Token: SeEnableDelegationPrivilege	464	msiexec.exe
Token: SeManageVolumePrivilege	464	msiexec.exe
Token: SeImpersonatePrivilege	464	msiexec.exe
Token: SeCreateGlobalPrivilege	464	msiexec.exe
Token: SeCreateTokenPrivilege	464	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	464	msiexec.exe
Token: SeLockMemoryPrivilege	464	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
464	msiexec.exe
464	msiexec.exe
5820	photocraft.exe
1804	photocraft.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4196	4072	msiexec.exe	81
PID 4072 wrote to memory of 4576	4072	msiexec.exe	85
PID 4196 wrote to memory of 5820	4196	MsiExec.exe	88
PID 5820 wrote to memory of 4944	5820	photocraft.exe	89
PID 5820 wrote to memory of 1804	5820	photocraft.exe	91
PID 1804 wrote to memory of 4240	1804	photocraft.exe	92

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\photocraft-0.18.0-windows-x86.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:464

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2891F24F78BACFDF405F5F20AFEC1975 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Users\Admin\AppData\Local\Programs\ArtCraft\PhotoCraft\photocraft.exe
    "C:\Users\Admin\AppData\Local\Programs\ArtCraft\PhotoCraft\photocraft.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5820
  - - C:\Windows\SysWOW64\reg.exe
      "reg" query "HKCU\Control Panel\International" /v LocaleName
      4⤵
      System Location Discovery: System Language Discovery
      PID:4944
  - - C:\Users\Admin\AppData\Local\Programs\ArtCraft\PhotoCraft\photocraft.exe
      "C:\Users\Admin\AppData\Local\Programs\ArtCraft\PhotoCraft\photocraft.exe" --safe-gpu
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1804
    - - C:\Windows\SysWOW64\reg.exe
        
        "reg" query "HKCU\Control Panel\International" /v LocaleName
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4240
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4576

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5904ca.rbs

Path C:\Config.Msi\e5904ca.rbs
Size 18KB
SHA256 6b1c8f096e5eea871b91c8e25d9fe98aa8961b6ca6d65f041076d45e0693f4b6
MD5 a1046bfd397f6699014192412d105d01
SHA1 e3ba61f8a5907fa8038f65bba97b3ba3c2e45260
SHA512 d567ba8735e2b02853dceac07c35560330296f3a158dc1ee6bdb301a74063d0081913107b8659c0d4ced0cb5475b92f079a9de856d4f629f215a52e016ff286a
SSDEEP 192:ImSAAlInHFtRWZWpm+rpw2CXtVEIcVER5bIJpPNPr:ITlInUVsVobw1
TLSH
T102826586B906E3C3EC861335DB373789B3B78798C745738F188F91245A87B687AD9046
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 2KB
SHA256 4cb5b34ad822a0d86a127981c37a8c99ed9436096a29cc8490ae86aa4ab808fd
MD5 7c4363c461b0d7d29fe64a6832f7c288
SHA1 2e8915fc365071336c59439d7b282da5bd0d2d62
SHA512 5d482d11a77fd802202bbfb6872961c7e0aef8a427ad19b6b8b82bf701ef9c9a2b904283b47233d7ad43f3368878634f403d7f8b5fb1ef113add60a3795baf0b
TLSH
T10C413A0A673D8449EA61BB6087E4CFB5B83CD3610A121C2FBA8DF5A40D19FD42F0610C
MD5 SHA1 SHA512 TLSH

Submit Download

C8D02B4227BDBA17232BCBB5B61BEFB6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8D02B4227BDBA17232BCBB5B61BEFB6
Size 21KB
SHA256 922040803bb0784c34d4a438ff31cf60e516cf8f7c827f07940489e142689d6e
MD5 2182a9267d2ee1f85329a8868a9c8f38
SHA1 85f751cef18a38168931566dd0ecb1769ee26a8f
SHA512 a41a41c5c6848607f34f56762bfdd49f5facbd72e881164853ec1b1feb2d4890f6ceccf3b41386f0a973c50fd36aa6a52d9db5a4e49b4868033c9d224c56ff54
SSDEEP 384:H+3QXwYEwMsYEg4QfRHnaZo7CNBXo+/gxX3Klw:hwYEL3Z57CDL0X3K2
TLSH
T116A2EABCAA4CA69751C66A31CACB9FD3C8F651B53BD2E10F41651E884424FC3CE97382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EF7234CDBB1649702229F955C785C39F
Size 785B
SHA256 9e153cc9331fb887cacd6f08cfa3dc5aac7b9b26b4b9cfa75d2ac57288e9142a
MD5 13c624bbd9ad9ff627a68b5ced19b228
SHA1 ff158247f5c6bf41d5fed9f3d756b82f735a24f6
SHA512 62251f6fd12706cc3b90b738523a3a32c34b104ed967b0f42da80596fe0a3b03a27dbbbab144afff619c4a910558b2f8f6f6f223f4cc65bb288f7516bfdb7068
TLSH
T14A017561A8BCF3844DA11BD603F4ADA559B407F6294CB2672437A1560562B53EF28129
MD5 SHA1 SHA512 TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 422B
SHA256 71963c88b0c2e31108f659e65e451476605ad6e43ccaa6996da3206024513c56
MD5 eafab13c9a299949993bbc0244575e02
SHA1 0721fd6dccd1f0fd7ac6dfe24170de98b8f9d070
SHA512 451fc87ac4daf718ec78019cf77421899f21068dcea8c60733bae933214172555ff54ecb2e8ad1fc1a3937cb240483369b90882513f9c673ded970f1af268258
TLSH
T1CEE0921829FE821AE372693E4B996A2F093BF353280866A6B76511655456D018D21722
MD5 SHA1 SHA512 TLSH

Submit Download

C8D02B4227BDBA17232BCBB5B61BEFB6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8D02B4227BDBA17232BCBB5B61BEFB6
Size 290B
SHA256 cc5fb0822cb65f8e45b49590e717bd5fa8b3208d49833afd7c530e150e462668
MD5 4df761e7122502491bc0309384691e55
SHA1 939da8818af97e10763484c08b3d47448e92bc80
SHA512 70b882542675b4b29b9e327a8d40d00c4b71d917079b9bd16ff28fe578e52e330c47744a173fa6322b2f7cab2db5d6622434cb1af7da5aa210996f88c460b958
TLSH
T16ED05E18A3F50612F490C67E9BD42517AA39B819A504A3840FB1E3043038D02AC3071B
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EF7234CDBB1649702229F955C785C39F
Size 308B
SHA256 a5c90d821a0fa32088b5d92192897515a5cb25b32fd68b494796d440fd401faa
MD5 65b67b1c89a380cb00d482ad6ba9d297
SHA1 52780d8c16dfe976eb221cf21e650c13f900fde9
SHA512 c50c213f72cfab20d7b6794a0b5f39c30153b9719afe610c8b82aef8016b972355894b9d92321543f97d9f3edd14c3b1baed634fffdf0d1a380209327744cc02
TLSH
T1E6E0170CA3F90A22F490C93E25E424177A35AE548A0483490FF18709787C981B920713
MD5 SHA1 SHA512 TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\76cb7b40f5d0e371\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 f5daa74e79bf66442453398dd5998ea94abe8de892bde3c28bfadbd49fdb85e8
MD5 020b2d8ad9eacdd93bba5df93a86aa85
SHA1 986adb57b8a7d06f7803e3c6c32b9842b0badfa8
SHA512 286964fc2ae33f47e059275e766efd5c48976af1b79d0561d51733629f5e19a4f80868695d779b08d697420bee71510a6ebaf32c1ed3e393498e1dca7ce30086
SSDEEP 3:871HlGlll/l/lXp9ZjrPBYSncHPl/lP/ltDlllG1kn3smnll:q1H0dPBYSn+FtZl/d3x/
TLSH
T1DB539281EB920B5BD82653300ACA569AB836951D02070AD64A004661A8BEB61493A9D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\76cb7b40f5d0e371\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\76cb7b40f5d0e371\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 5KB
SHA256 a7eebbd89c58064ffebef48b05b78e169d89f436f7cb9e1bc60e59154282768d
MD5 9c94288c471268bed920ba4fb9bdeda0
SHA1 c55cb228c386186dd7c660e0689b5114f5cfcdb9
SHA512 52477aa9e46ce53e9aa4f5f8418180c677efdd72c5222e777992a9d34121f968f364ea0dd5693a71204e59bf72730f2de427e978a1170b0d8f017c34ff95fa6d
SSDEEP 96:ZJmAqPVlPlyKtZzDqeC3D6Al9kP+ayvpi6PKtZzn0QeypPdvrcpm:ZJ+NlUKt9yOPTApi6PKt9iyp1C
TLSH
T18AC12B09F2823DACF134E2FD45DC41E9B3269125676BADFCC3F6E37946139165403990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI280C.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI280C.tmp
Size 342KB
SHA256 1acf96054b98d1298f553f7065bfccb9a306a3d86358f849671b81b7e89c109d
MD5 51551de5d386a49ed073699448fa4eaf
SHA1 6b3302b7bc9dd1ca2c8ab2f583c0af03b4dd3c89
SHA512 9c12b25c7cfded54396c7121cf67be0b94392f431cb8708eb704ff9716e0d94526aa43ca8eed47e821abe056fbb274f818a58d0e768908e1a2852934490622fc
SSDEEP 6144:k19loZu2TGtCeu2ycuJ3HXrvxQTRJjBNxvgMzmoLkf:k1/I/T0CeuJX7vxQpNxvgMFkf
TLSH
T161745B266456303BE6F90D32F528CB306D3DB61827D8949AC3E0984E3C645E36BF775A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB9A6.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIB9A6.tmp
Size 145KB
SHA256 f34eff56497107449a836c4643d01ad0ede4750d4a5a12d606b690d9f04561ec
MD5 1b247e54c182f0ca11abd2a7cb6e81b4
SHA1 9b44def967dde00b1de64e576cf894413b0df28b
SHA512 96d655da4241abe4b50fbfae1ef44a6eb7ecd6431431fbd000527d3512dc8b0977d8b3062fbed9fdcd406944bd34e06dea07f36a19a542281df61a29e6080da8
SSDEEP 3072:U4n4dw51x0DKiSgWQkEIVcxsbcJWdI/72bCPWr+2sor9OPrs:Ulo0DS8kLVcxpJAIO+O91
TLSH
T1F6E3AE11B190C472EABF2A394470CB725B7FB930DF909DDB539806AA5E206C19E35B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 337d047f8292af71db0262a38af2932081c8f96d038b66ae3954c1bf02cdb446
MD5 b8ae591d6a5447776b27bb551bced8aa
SHA1 d3e44263816dc943267d91100d110be144853a5f
SHA512 74e433f06f690a2a58c4180ba15337415323cd4863ebe3c051e1e6b3cfdd94d3e15abf59d21130d234bbb080ffa1cc34ed44039db0379aa54c1e3d270fc98f40
SSDEEP 24576:v2gmSp1tdoO/vvTLrmAuhUHqf6JrQYkq2WTdXJEwpbaIkM0VoLBnrd6nh:L
TLSH
T1E647A12436F92240E7F79E7CA8F06A234D3A7D5B9C199E8D45411F4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8c062b72-7516-4ae8-b110-c9d2ba8b0148}_OnDiskSnapshotProp

Path \??\Volume{ded4cea0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8c062b72-7516-4ae8-b110-c9d2ba8b0148}_OnDiskSnapshotProp
Size 6KB
SHA256 35520493592603c7a6fa34d31b3e49035a6757acf92f04d6ef98bdb60c2292ea
MD5 7f08b8602d74e7078d4b8fc27b8a4f1a
SHA1 10cf1195e8f19df11b5eb78d0c245ea552876192
SHA512 8b50d16dcaeb70527e1c0bf060e24d8c69559caa599ace68c9553926af47bbf45d65b3654db59726a535a2f1d54ec474731d443720f6a59d51bd548d70ff399f
SSDEEP 96:FSx+Jbvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:8xeb++ZVm
TLSH
T197D197085AF54711E2B3AB7229F14557A877B911EF33CB8E0298238E2670A14F935F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5820-80-0x000000000A520000-0x000000000A521000-memory.dmp

Download

memory/5820-86-0x000000000CD80000-0x000000000CD81000-memory.dmp

Download

memory/5820-79-0x000000000A520000-0x000000000A521000-memory.dmp

Download

memory/5820-81-0x000000000A520000-0x000000000A521000-memory.dmp

Download

memory/5820-84-0x000000000A520000-0x000000000A521000-memory.dmp

Download

memory/5820-83-0x000000000A520000-0x000000000A521000-memory.dmp

Download

memory/5820-82-0x000000000A520000-0x000000000A521000-memory.dmp

Download

memory/5820-85-0x000000000CD80000-0x000000000CD81000-memory.dmp

Download

memory/5820-87-0x000000000CD80000-0x000000000CD81000-memory.dmp

Download

memory/5820-78-0x000000000A520000-0x000000000A521000-memory.dmp

Download

memory/5820-91-0x000000000CD80000-0x000000000CD81000-memory.dmp

Download

memory/5820-92-0x000000000CD80000-0x000000000CD81000-memory.dmp

Download

memory/5820-94-0x000000000CD80000-0x000000000CD81000-memory.dmp

Download

memory/5820-93-0x000000000CD80000-0x000000000CD81000-memory.dmp

Download

memory/5820-96-0x000000000CD80000-0x000000000CD81000-memory.dmp

Download

memory/5820-95-0x000000000CD80000-0x000000000CD81000-memory.dmp

Download

memory/5820-74-0x000000000A520000-0x000000000A521000-memory.dmp

Download

memory/5820-73-0x000000000A520000-0x000000000A521000-memory.dmp

Download

memory/5820-72-0x000000000A520000-0x000000000A521000-memory.dmp

Download