Overview

overview

7

Static

static

3

ShareX-20....64.exe

windows10-ltsc_2021-x64

7

ShareX-20....64.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260630-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/07/2026, 14:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ShareX-20.2.0-setup-x64.exe
  • Size 120.3MB
  • Sample260703-r89apsgv4m
  • SHA256 7c0dcaa05806de80cfb5829d243a62496d64bf2ed5cecc10185d9e769f365621
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryinstaller

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies registry class 37 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ShareX-20.2.0-setup-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\ShareX-20.2.0-setup-x64.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4372
    • C:\Users\Admin\AppData\Local\Temp\is-7L39E0P7PE.tmp\ShareX-20.2.0-setup-x64.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-7L39E0P7PE.tmp\ShareX-20.2.0-setup-x64.tmp" /SL5="$5019A,124897752,893952,C:\Users\Admin\AppData\Local\Temp\ShareX-20.2.0-setup-x64.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:5584
  • C:\PROGRA~1\ShareX\ShareX.exe
    C:\PROGRA~1\ShareX\ShareX.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2748
    • C:\Windows\system32\mspaint.exe
      "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Documents\ShareX\Screenshots\2026-07\bVI6Vtdhuq.png"
      2⤵
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4224
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004F0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2972
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
    1⤵
    • Checks SCSI registry key(s)
    PID:756

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ShareX.HelpersLib.dll
        • Path C:\PROGRA~1\ShareX\ShareX.HelpersLib.dll
        • Size 1.0MB
        • SHA256 c2d71da944aba84a509262b9a4422f5ca199108750da1dc3360364d2b2ccc046
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ShareX.UploadersLib.dll
        • Path C:\PROGRA~1\ShareX\ShareX.UploadersLib.dll
        • Size 1.6MB
        • SHA256 2f189d96c28f22dd8cc66f0934906dc0f960cf779b28489358cf003af18bb96b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ShareX.deps.json
        • Path C:\PROGRA~1\ShareX\ShareX.deps.json
        • Size 93KB
        • SHA256 328eb43c2a5a0a71b96ec414efe20de4a218723065bfa6727a705ae52a1acec4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ShareX.dll
        • Path C:\PROGRA~1\ShareX\ShareX.dll
        • Size 2.1MB
        • SHA256 bbee95cb326ed891302b76a9bb659497717a3ad83812d01aa098c542c2dd5634
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ShareX.runtimeconfig.json
        • Path C:\PROGRA~1\ShareX\ShareX.runtimeconfig.json
        • Size 637B
        • SHA256 306cbcac744f48f70567fff740591084b57db635f181c5700ee69cb94d236260
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        System.Collections.dll
        • Path C:\PROGRA~1\ShareX\System.Collections.dll
        • Size 326KB
        • SHA256 b21618652e0ebd7d7aaa1d07f1f44f962443637d2554bf17931448400c471add
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.Process.dll
        • Path C:\PROGRA~1\ShareX\System.Diagnostics.Process.dll
        • Size 330KB
        • SHA256 057f62b9d6ee709ab2ee22198f83d151307d6f8eb4b8f99eef16109ec2320a35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Drawing.Common.dll
        • Path C:\PROGRA~1\ShareX\System.Drawing.Common.dll
        • Size 1.1MB
        • SHA256 9a1fe85a289288750455d341f5ed2de79d5bc227cb8fe840a320bc2cdd77b9a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.IO.Pipes.AccessControl.dll
        • Path C:\PROGRA~1\ShareX\System.IO.Pipes.AccessControl.dll
        • Size 15KB
        • SHA256 f953e2c480a4d9107098829b4d0b4130708106d633660f5b563d701a8d965688
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Linq.dll
        • Path C:\PROGRA~1\ShareX\System.Linq.dll
        • Size 642KB
        • SHA256 abad3358c94f9b6e55e49decb071cf513fdb79aa5d3c968da1ee8d531439c7cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.CoreLib.dll
        • Path C:\PROGRA~1\ShareX\System.Private.CoreLib.dll
        • Size 14.6MB
        • SHA256 92639a58be1c677d6ec86f9e73f4d368a9e6594ba304c5da8c77e106d801339d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.Windows.Core.dll
        • Path C:\PROGRA~1\ShareX\System.Private.Windows.Core.dll
        • Size 1.2MB
        • SHA256 89ad21c17892cd322aba4e014258ae22c33dc1494dbb28cf26fe01b75bbd16da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.Loader.dll
        • Path C:\PROGRA~1\ShareX\System.Runtime.Loader.dll
        • Size 15KB
        • SHA256 8ef7534ca2b98078ae0be3c022365dfdb5820914329532d133eba3e9e8507c43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.dll
        • Path C:\PROGRA~1\ShareX\System.Runtime.dll
        • Size 43KB
        • SHA256 1bed6536587c14ba65e34428a5e6e937f14b02026a8377e19e921a6a399f8636
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Security.Claims.dll
        • Path C:\PROGRA~1\ShareX\System.Security.Claims.dll
        • Size 98KB
        • SHA256 bd9922222d0f207e5c5122380a9149803b9e7b51c3696c31f354346dd66d0d57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Threading.Overlapped.dll
        • Path C:\PROGRA~1\ShareX\System.Threading.Overlapped.dll
        • Size 15KB
        • SHA256 89f40f838f4f13c34959577af79d44c2e86718d56dc6cf6e2cf795c5c08f6b01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Threading.Thread.dll
        • Path C:\PROGRA~1\ShareX\System.Threading.Thread.dll
        • Size 15KB
        • SHA256 501246cfe10382739e0b612ea5607ad80f3768fc4fd161aa3cd0d597176e60f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Windows.Forms.Primitives.dll
        • Path C:\PROGRA~1\ShareX\System.Windows.Forms.Primitives.dll
        • Size 3.8MB
        • SHA256 f2d6608c108c73bedee7cf1cf0ecac8c9811bc4efe754de8850bd32495fe813c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Windows.Forms.dll
        • Path C:\PROGRA~1\ShareX\System.Windows.Forms.dll
        • Size 13.1MB
        • SHA256 02ddd1ddc9e79bd980cdf0d666b5b49b8da590d1ba52d6bc762087a39f18d5ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        coreclr.dll
        • Path C:\PROGRA~1\ShareX\coreclr.dll
        • Size 4.6MB
        • SHA256 116f073f8e620c3719c50276f033e936595338b75dabe7cc817e57c2b9f39619
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hostfxr.dll
        • Path C:\PROGRA~1\ShareX\hostfxr.dll
        • Size 365KB
        • SHA256 7bc01958f75b4e885070fcd7518bb3a656ce70ef79473abb0dd29fdaed704c32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hostpolicy.dll
        • Path C:\PROGRA~1\ShareX\hostpolicy.dll
        • Size 378KB
        • SHA256 69907915fc4fe9539a40bb31da6d18f08afe87c928c2f86bda2df970e4fc05e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Win32.Registry.dll
        • Path C:\Program Files\ShareX\Microsoft.Win32.Registry.dll
        • Size 118KB
        • SHA256 a7085eee8925a2e00ad4c89cd4f2703c086567ef10abfa131137af256bb6f020
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ShareX.exe
        • Path C:\Program Files\ShareX\ShareX.exe
        • Size 194KB
        • SHA256 3ebc2819993ee7d61faa8d6feca14fdf2e4cd9124480043454ef0dd1fd294537
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.Concurrent.dll
        • Path C:\Program Files\ShareX\System.Collections.Concurrent.dll
        • Size 286KB
        • SHA256 5889632390ea938ce56650e01a375c51bb5134bf1a3b37e11a9857bb503eba7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.Specialized.dll
        • Path C:\Program Files\ShareX\System.Collections.Specialized.dll
        • Size 102KB
        • SHA256 3244c8a3fd58e6e3490d06788a6d7a418db2491393743e47dd029a5cd42b9db1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.Primitives.dll
        • Path C:\Program Files\ShareX\System.ComponentModel.Primitives.dll
        • Size 78KB
        • SHA256 a68a710f3f3455b51e7c6e49063a975dc20aef365b74540d4b56b8cbb491232e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Drawing.Primitives.dll
        • Path C:\Program Files\ShareX\System.Drawing.Primitives.dll
        • Size 134KB
        • SHA256 18521fd73dca6b884a97aab141c6670c90752e2f3a9d8a477fbe8cbe82643ba4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.IO.Pipes.dll
        • Path C:\Program Files\ShareX\System.IO.Pipes.dll
        • Size 166KB
        • SHA256 607acc345f9709c2719d140d793cd61e35e313f3d516e6de3d2d6703fe89ff7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.InteropServices.dll
        • Path C:\Program Files\ShareX\System.Runtime.InteropServices.dll
        • Size 110KB
        • SHA256 089055dce0175e559d05e0a1fbf25aa6c4e367280ef11eee94aa2e252afad89c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Security.AccessControl.dll
        • Path C:\Program Files\ShareX\System.Security.AccessControl.dll
        • Size 226KB
        • SHA256 9d27c4f0d90c4f4bab378f4a3b5d2d8df332e0f139b4ac3a02f56e92b7a1e959
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Security.Principal.Windows.dll
        • Path C:\Program Files\ShareX\System.Security.Principal.Windows.dll
        • Size 182KB
        • SHA256 d9913f1676f617ffc4a5cd0ee26c8a7183c39e08b41057372b8fde0fe996bc7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Threading.dll
        • Path C:\Program Files\ShareX\System.Threading.dll
        • Size 82KB
        • SHA256 ee135dec345d64509e01c0a789193fc98181e1fa1be965a6e0c133b4f0eb322b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        clrjit.dll
        • Path C:\Program Files\ShareX\clrjit.dll
        • Size 1.9MB
        • SHA256 bf5fdd817bc10ad75cedf78cd7e794e797296bed8eed1cdd326d86d3196617a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ShareX-20.2.0-setup-x64.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-7L39E0P7PE.tmp\ShareX-20.2.0-setup-x64.tmp
        • Size 4.2MB
        • SHA256 157c8a276cff2f76c89750ad42e305369889b4a9e23653fb2de51060902f0cba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ShareX-Log-2026-07.txt
        • Path C:\Users\Admin\Documents\ShareX\Logs\ShareX-Log-2026-07.txt
        • Size 474B
        • SHA256 2900c23fc870ddb8a6e59f278fb61a77c1fb23da80a2454c3e4b539d6c175439
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ShareX-Log-2026-07.txt
        • Path C:\Users\Admin\Documents\ShareX\Logs\ShareX-Log-2026-07.txt
        • Size 1KB
        • SHA256 d11473ceb0d9f0cf3f439de9903404a800b60e25028ec4b0ae0e5ae896e88945
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ShareX-Log-2026-07.txt
        • Path C:\Users\Admin\Documents\ShareX\Logs\ShareX-Log-2026-07.txt
        • Size 2KB
        • SHA256 46456fe00f8b11e752ea34caab4fb09c2cd3d21a587fc4520415f509afabf3c1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        bVI6Vtdhuq.png
        • Path C:\Users\Admin\Documents\ShareX\Screenshots\2026-07\bVI6Vtdhuq.png
        • Size 499KB
        • SHA256 da38169a2145a411890357b5c893e83952756dd37b14854621c6fefaf75efc71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bVI6Vtdhuq.png
        • Path C:\Users\Admin\Documents\ShareX\Screenshots\2026-07\bVI6Vtdhuq.png
        • Size 487KB
        • SHA256 c643381624045c6f88a43c01b7d9f365f5cd46b7a751308752a5c92f4993aeef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4372-0-0x00000000005D0000-0x00000000006B9000-memory.dmp
        Download

        memory/4372-8-0x00000000005D0000-0x00000000006B9000-memory.dmp
        Download

        memory/5584-6-0x0000000002980000-0x0000000002981000-memory.dmp
        Download

        memory/5584-9-0x0000000000130000-0x000000000057B000-memory.dmp
        Download

        memory/5584-10-0x0000000002980000-0x0000000002981000-memory.dmp
        Download

        memory/5584-35-0x0000000000130000-0x000000000057B000-memory.dmp
        Download

        memory/5584-711-0x0000000000130000-0x000000000057B000-memory.dmp
        Download

        memory/5584-2455-0x0000000000130000-0x000000000057B000-memory.dmp
        Download

        memory/5584-2358-0x0000000000130000-0x000000000057B000-memory.dmp
        Download