Analysis

  • max time kernel
    70s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    12-03-2023 03:14

General

  • Target

    Greenshot.exe

  • Size

    515KB

  • MD5

    346d22939e3079901f0dfac7add71c94

  • SHA1

    67ea9f4f56c7c4189745aab05c614a6e615d9e7e

  • SHA256

    fdc3900da9cf5b4b7f4b461eb54f2f7abf2af104de8bfdd0b7f6a46f092f9cc6

  • SHA512

    3d845aee807f6fc711f212229595ba2dfeec760c649b7b0f4398cba8091fab8eb63dd551b46f49840a2de2c2b872130b4b5e90f95ff2757381e96be4b066122d

  • SSDEEP

    12288:qIska30pZKIpno9eKXt2w3Po52QIUtMbYKUnwLu8m3mkDGYP8/Gc5oTr6zG/P9PI:YxUR5LgcOoINdSjQk2

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Greenshot.exe
    "C:\Users\Admin\AppData\Local\Temp\Greenshot.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1968-54-0x0000000000140000-0x00000000001C2000-memory.dmp

    Filesize

    520KB

  • memory/1968-55-0x00000000001D0000-0x0000000000240000-memory.dmp

    Filesize

    448KB

  • memory/1968-56-0x0000000000240000-0x000000000027A000-memory.dmp

    Filesize

    232KB

  • memory/1968-57-0x000000001B340000-0x000000001B3C0000-memory.dmp

    Filesize

    512KB

  • memory/1968-58-0x00000000002F0000-0x0000000000300000-memory.dmp

    Filesize

    64KB

  • memory/1968-59-0x000000001B340000-0x000000001B3C0000-memory.dmp

    Filesize

    512KB

  • memory/1968-60-0x000000001B340000-0x000000001B3C0000-memory.dmp

    Filesize

    512KB

  • memory/1968-61-0x000000001A9B0000-0x000000001A9C6000-memory.dmp

    Filesize

    88KB

  • memory/1968-62-0x000000001B340000-0x000000001B3C0000-memory.dmp

    Filesize

    512KB

  • memory/1968-64-0x000000001B340000-0x000000001B3C0000-memory.dmp

    Filesize

    512KB