Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
15s -
max time network
26s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2023, 17:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Lightshot (1).exe
Resource
win7-20230831-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Lightshot (1).exe
Resource
win10v2004-20230915-en
7 signatures
150 seconds
General
-
Target
Lightshot (1).exe
-
Size
907KB
-
MD5
f014f091e2ae82895d06bc8871934e36
-
SHA1
e008535eea8ad084a6f0415bc5658ea4a491de3d
-
SHA256
559147eab75bae021a64a64c5f5442d561b5f8dea16996a7be13731122d7b03e
-
SHA512
22112465f110759d2386d951620959602c849969aa9175b77a4cefb2482d16c466954fcdc5d1af708beffae183badd768449f90d8e6402be1d74abd641ca826d
-
SSDEEP
24576:fGzl9+a4Ne1nEFI56xU+0IdY2Zv952uetfbFEzP4UFhORjt:f+tOWnEFZR0El0JEzQAhw5
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 3540 timeout.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings cmd.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4128 Lightshot (1).exe 4128 Lightshot (1).exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4128 Lightshot (1).exe 4128 Lightshot (1).exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4128 Lightshot (1).exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4128 wrote to memory of 1788 4128 Lightshot (1).exe 89 PID 4128 wrote to memory of 1788 4128 Lightshot (1).exe 89 PID 4128 wrote to memory of 1788 4128 Lightshot (1).exe 89 PID 1788 wrote to memory of 3540 1788 cmd.exe 91 PID 1788 wrote to memory of 3540 1788 cmd.exe 91 PID 1788 wrote to memory of 3540 1788 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lightshot (1).exe"C:\Users\Admin\AppData\Local\Temp\Lightshot (1).exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start C:\Windows\Prefetch & timeout /t 2 & del /q /f C:\Windows\Prefetch\Lightshot*.exe-*.pf & del /q /f C:\Windows\Prefetch\CMD*.exe-*.pf & del /q /f C:\Windows\Prefetch\CMD*.exe-*.pf & del /q /f C:\Windows\Prefetch\Notepad*.exe-*.pf & del /q /f C:\Windows\Prefetch\regedit*.exe-*.pf2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\timeout.exetimeout /t 23⤵
- Delays execution with timeout.exe
PID:3540
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2656