f9cf48c044d90c94f4814a0577cc36a7ba1ac5dbc9652b2e0e498162a042494d

Analysis

max time kernel
147s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2756	screenCapture_1.3.2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 1840	4548	cmd.exe	100
PID 4548 wrote to memory of 1840	4548	cmd.exe	100
PID 4548 wrote to memory of 1840	4548	cmd.exe	100
PID 1840 wrote to memory of 4852	1840	csc.exe	109
PID 1840 wrote to memory of 4852	1840	csc.exe	109
PID 1840 wrote to memory of 4852	1840	csc.exe	109
PID 4548 wrote to memory of 2756	4548	cmd.exe	110
PID 4548 wrote to memory of 2756	4548	cmd.exe	110

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES668B.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC60716352DB72496DA78199CE38D30FD.TMP"
    3⤵
    PID:4852
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:2756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:3652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES668B.tmp

Filesize
1KB

MD5
6482c962017547b2fe91cbdbc40a52fa

SHA1
a07a3194d717695e7ff3eb381946445a9eaf275c

SHA256
fda73181bdbd354e558447d6be454d06b71f252936a2f8c9b389fcba2894d050

SHA512
8221e28b7b3c414891a52580c6a9cbb13daa7b773ab9dfa3f80222525e2a9badb648c961eaedd63647538b40efe2a53d627e8781d3bb8d6c045e85486759061d

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
0d81a7affc3123fddca3eddf31dcbdc8

SHA1
b6fb662058593a9d7477c5ee9217d85de809fb8e

SHA256
8b04364a0313e741bfcaba5cdb0ccdd9443649806b36b685cd7027ed1aa2c618

SHA512
3bc4c19ee2fa8228ef779c2df1e66d75faee68153c5cd91f1c28d41675a0e88830aee6b129f01245bc5e46dfa23fb64a983d6412be731e86ce27f1f44ceb7d36

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC60716352DB72496DA78199CE38D30FD.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/2756-9-0x0000000000250000-0x000000000025A000-memory.dmp

Filesize
40KB

Download
memory/2756-10-0x00007FFAE1960000-0x00007FFAE2421000-memory.dmp

Filesize
10.8MB

Download
memory/2756-12-0x00007FFAE1960000-0x00007FFAE2421000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads