03fbbf6298f06ae59141431f37c81546091316d5318a4426149a6d86f337d3cf | Triage

Analysis

max time kernel
40s
max time network
18s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
12/11/2023, 13:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

temp/Lightshot.exe
Size

487KB
MD5

1e1c83b9680029ad4a9f8d3b3ac93197
SHA1

fa7b69793454131a5b21b32867533305651e2dd4
SHA256

0b899508777d7ed5159e2a99a5eff60c54d0724493df3d630525b837fa43aa51
SHA512

fe6f8df3dbbcc7535ead60028ec3e45801a33ccc81c9137b2288bc0d18be42379564c907eb406ce9491f46930690efa9a86a9f6506414992b5dba75adb3d1136
SSDEEP

12288:cl1dT6lwApgXttZmPdsfkmDU3pRQa/JSQE:Q1d0wVmPdsfkP3zQa/JSH

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2564	Lightshot.exe
2564	Lightshot.exe
2564	Lightshot.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2564	Lightshot.exe
2564	Lightshot.exe
2564	Lightshot.exe

C:\Users\Admin\AppData\Local\Temp\temp\Lightshot.exe
"C:\Users\Admin\AppData\Local\Temp\temp\Lightshot.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2564-0-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2564-1-0x0000000074D30000-0x00000000751BB000-memory.dmp

Filesize
4.5MB

Download