f9cf48c044d90c94f4814a0577cc36a7ba1ac5dbc9652b2e0e498162a042494d

Analysis

max time kernel
149s
max time network
162s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
19-03-2024 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4024	screenCapture_1.3.2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 2656	232	cmd.exe	79
PID 232 wrote to memory of 2656	232	cmd.exe	79
PID 232 wrote to memory of 2656	232	cmd.exe	79
PID 2656 wrote to memory of 700	2656	csc.exe	80
PID 2656 wrote to memory of 700	2656	csc.exe	80
PID 2656 wrote to memory of 700	2656	csc.exe	80
PID 232 wrote to memory of 4024	232	cmd.exe	81
PID 232 wrote to memory of 4024	232	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:232
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6F15.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC47EBFF47F9B946E18EBD11895ABBC425.TMP"
    3⤵
    PID:700
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:4024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES6F15.tmp

Filesize
1KB

MD5
f8a48e315b2907102dace455c648e38e

SHA1
2c2306ead32d63397d3a0901d5fb1e583b9bf30b

SHA256
2467e87505894e39d23141f9780661d88cdd5458e90b12d1ab138bec62353e8f

SHA512
c38b86db49793fe5c251b9ae152c8315a441219253ce16849486b1b2c19def87583d7ce60c7fc247920d3ef8413ad3223951a23e49e2c516abcea6d1da114f9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
3b31b7c5e6365d0c0de3e1c5a54e5c6a

SHA1
125804a503301c71fbbb705415fefff45062a91b

SHA256
38f53f2d48ece60de272fc470c87988af7e7870ef6ca02c20186766f5fe131fa

SHA512
84824a9d469117481132260fd5c1464808699d9ea5c383ff47411771a30bc4a87089ab114ec29e54512f061a173f7b7194f72100fba548a3a15ba42a5cad2830

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC47EBFF47F9B946E18EBD11895ABBC425.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/4024-9-0x0000000000190000-0x000000000019A000-memory.dmp

Filesize
40KB

Download
memory/4024-11-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

Filesize
10.8MB

Download
memory/4024-12-0x00007FFE7F300000-0x00007FFE7FDC2000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads