File name:

Photos.exe.zip

Full analysis: https://app.any.run/tasks/0166b197-4642-4730-a3f9-e910f3aed385
Verdict: Malicious activity
Analysis date: December 09, 2024, 03:00:57
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

77F11E8D82BEC0715A9F1062EC539398

SHA1:

CC963D5F192313E3B4E982FAAD142BA89F6A0AC2

SHA256:

A72D31C9F0DC4FC589FBD1BBCD91E07DA5FAF8740BD7FBF16B31D73FD588E122

SSDEEP:

12288:YkUY3ocVidvuGWuMBlSwBs6mtkaVXOFz0cRn5IxMp:zUY3o8id2GWuMBlSwBs6mtkat0z0c55x

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • svchost.exe (PID: 4932)

    • Executing a file with an untrusted certificate

      • InstallFramework.exe (PID: 3692)
      • InstallFramework.exe (PID: 3288)

    • Changes the autorun value in the registry

      • Photos.exe (PID: 6940)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 4932)
      • Photos.exe (PID: 6940)
      • rundll32.exe (PID: 3224)

    • Connects to FTP

      • Photos.exe (PID: 6940)

    • Connects to unusual port

      • Photos.exe (PID: 6940)
      • rundll32.exe (PID: 3224)

    • Executable content was dropped or overwritten

      • Photos.exe (PID: 6940)
      • InstallFramework.exe (PID: 3288)

    • Starts itself from another location

      • Photos.exe (PID: 6940)

  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 4932)
      • Photos.exe (PID: 6940)
      • consent.exe (PID: 5640)

    • Reads the software policy settings

      • SIHClient.exe (PID: 7164)
      • WaaSMedicAgent.exe (PID: 7044)
      • consent.exe (PID: 5640)

    • Checks supported languages

      • Photos.exe (PID: 6940)
      • InstallFramework.exe (PID: 3288)
      • rundll32.exe (PID: 3224)

    • Checks proxy server information

      • Photos.exe (PID: 6940)
      • rundll32.exe (PID: 3224)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4932)

    • Create files in a temporary directory

      • Photos.exe (PID: 6940)
      • InstallFramework.exe (PID: 3288)

    • Creates files or folders in the user directory

      • Photos.exe (PID: 6940)

    • Reads the computer name

      • Photos.exe (PID: 6940)
      • rundll32.exe (PID: 3224)

    • Process checks computer location settings

      • Photos.exe (PID: 6940)

    • Reads the machine GUID from the registry

      • rundll32.exe (PID: 3224)

    • Creates files in the program directory

      • Photos.exe (PID: 6940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0009
ZipCompression: Unknown (99)
ZipModifyDate: 2024:12:09 02:01:22
ZipCRC: 0x69b2b9d9
ZipCompressedSize: 378030
ZipUncompressedSize: 492616
ZipFileName: Photos.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
30
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start start svchost.exe no specs winrar.exe photos.exe waasmedicagent.exe no specs conhost.exe no specs sihclient.exe installframework.exe no specs consent.exe no specs installframework.exe rundll32.exe svchost.exe no specs svchost.exe no specs svchost.exe svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs upfc.exe no specs uhssvc.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe svchost.exe no specs svchost.exe no specs svchost.exe no specs sppsvc.exe no specs svchost.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
376C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHostC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
812C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvcC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
1176C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wlidsvcC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ondemandconnroutehelper.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\webio.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\fwpuclnt.dll
1340C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvcC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\devinv.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\devobj.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\fltlib.dll
c:\windows\system32\drvstore.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptbase.dll
1764C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroupC:\Windows\System32\svchost.exe—services.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
1888C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s NetSetupSvcC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2224C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s BrowserC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srvcli.dll
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2796C:\WINDOWS\System32\Upfc.exe /launchtype periodic /cv vqyZsH1S6kej6JwYolIo5w.0C:\Windows\System32\upfc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Updateability From SCM
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netprofm.dll
c:\windows\system32\npmproxy.dll
2908"C:\Program Files\Microsoft Update Health Tools\uhssvc.exe"C:\Program Files\Microsoft Update Health Tools\uhssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Update Health Service
Version:
10.0.19041.3626 (WinBuild.160101.0800)
Modules
Images
c:\program files\microsoft update health tools\uhssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
3032C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NetmanC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
26 849
Read events
26 412
Write events
304
Delete events
133

Modification events

(PID) Process:(6092) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\WaaS\WaaSMedic\TaskStore
Operation:writeName:Schedule Maintenance Work
Value:
Microsoft\Windows\UpdateOrchestrator
(PID) Process:(6092) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\WaaS\WaaSMedic\TaskStore
Operation:writeName:Schedule Work
Value:
Microsoft\Windows\UpdateOrchestrator
(PID) Process:(1340) svchost.exeKey:\REGISTRY\A\{5527aa12-63c0-68e4-5b15-565719f44db5}\Root\InventoryDevicePnp
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(1340) svchost.exeKey:\REGISTRY\A\{5527aa12-63c0-68e4-5b15-565719f44db5}\Root\InventoryDevicePnp\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(1340) svchost.exeKey:\REGISTRY\A\{5527aa12-63c0-68e4-5b15-565719f44db5}\Root\InventoryDeviceContainer
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(1340) svchost.exeKey:\REGISTRY\A\{5527aa12-63c0-68e4-5b15-565719f44db5}\Root\InventoryDeviceContainer\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(1340) svchost.exeKey:\REGISTRY\A\{5527aa12-63c0-68e4-5b15-565719f44db5}\Root\InventoryDriverBinary
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(1340) svchost.exeKey:\REGISTRY\A\{5527aa12-63c0-68e4-5b15-565719f44db5}\Root\InventoryDriverBinary\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(1340) svchost.exeKey:\REGISTRY\A\{5527aa12-63c0-68e4-5b15-565719f44db5}\Root\InventoryDeviceMediaClass
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(1340) svchost.exeKey:\REGISTRY\A\{5527aa12-63c0-68e4-5b15-565719f44db5}\Root\InventoryDeviceMediaClass\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
Executable files
88
Suspicious files
9
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
4932WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb4932.8017\Photos.exeexecutable
MD5:754545AFCA5D10149F1138221317DA2D
SHA256:38633E676FECE37028170D8736E1BC616784ECD7FCF5D503B65030688C8E4A97
1176svchost.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:3834B4212B9F1CFEF504DA6F632C74A9
SHA256:B8DC4CD2BE39ADBE1CF4E924580569F6C35C37BA28C375DDD513E7C7890B2E62
6092svchost.exeC:\Windows\Logs\waasmediccapsule\WaasRemediation.003.etletl
MD5:A83C439448C1E67E6FFC948FEF1FCE18
SHA256:9FAA75F166CFDD869D3549B76139DDDDDB6A50790A5C6CC81B2084A432D7D60F
6092svchost.exeC:\Windows\Logs\waasmediccapsule\WaasRemediation.002.etletl
MD5:DEDECFD6DDECAA969F2F735761A8363F
SHA256:6D554FD45C5A4651BA508028AF27C5AE6501E3A2E10CFF9A8A925DCB74A68702
7164SIHClient.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\51867C3735CFAECCDB556E146BB12C28der
MD5:E1E3CC4D691535D73D5E7BA76E9B14B2
SHA256:AB97B5AE07DF03363B9F4A73AD4C1C0C9816DC21D9A4D60FFF32EB8B94AAD4C6
3288InstallFramework.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb4932.8017\WD140cod.dllexecutable
MD5:FDEB59C61510CDFD6F90D2CA54A61B58
SHA256:BFB8BF7DF686D67D31C307FAF80316EB5D3DAB95C6AAF1DF466C1686DC9E7FDB
1340svchost.exeC:\Windows\appcompat\Programs\Amcache.hvehiv
MD5:43BDDB5CD4DA84475126E759AC506D44
SHA256:02040BC73B0D984386A3FFDACCD3E2D40E38A566EB61A4F0B155318F60E111A7
7164SIHClient.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\51867C3735CFAECCDB556E146BB12C28binary
MD5:5E4F143B94B9BC251CA3D4BD5326F530
SHA256:DBE51F7D184DEFDCA1B2F3D6F8EC0A4C18B8EFC60857965FBCDEE0E82AB59172
3288InstallFramework.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb4932.8017\WD140Action.dllexecutable
MD5:960599A741CAB2930772618EF7FE4B06
SHA256:2F56CA86392C4C5A324D1B986C08B2A83E80D1D1FCB17633572E800FD501F772
3288InstallFramework.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb4932.8017\WD140agt.dllexecutable
MD5:D07AF2571AB565AE3A36C6C0CA2E5498
SHA256:A4D2627823324712C43C0DA0E6B22005EB4809D14A1D21D4C9B994249491AE00
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
36
DNS requests
17
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6352
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7164
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7164
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5340
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6092
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.16.110.121:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
google.com
  • 216.58.206.78
whitelisted
www.bing.com
  • 2.16.110.121
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.72
  • 40.126.32.76
  • 40.126.32.138
  • 40.126.32.134
  • 40.126.32.140
  • 20.190.160.22
  • 40.126.32.133
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted
fd.api.iris.microsoft.com
  • 20.31.169.57
whitelisted

Threats

PID
Process
Class
Message
6940
Photos.exe
Misc activity
ET INFO .exe File requested over FTP
6940
Photos.exe
Misc activity
ET HUNTING PE EXE Download over raw TCP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Photos.exe.zip