8863f887505fb33aa29b652cb3f84999c63da172d917b96ea7958a869d508506

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2024 19:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4872	screenCapture_1.3.2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 1488	980	cmd.exe	89
PID 980 wrote to memory of 1488	980	cmd.exe	89
PID 980 wrote to memory of 1488	980	cmd.exe	89
PID 1488 wrote to memory of 1300	1488	csc.exe	90
PID 1488 wrote to memory of 1300	1488	csc.exe	90
PID 1488 wrote to memory of 1300	1488	csc.exe	90
PID 980 wrote to memory of 4872	980	cmd.exe	91
PID 980 wrote to memory of 4872	980	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4CB8.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSCE42DBCF1D6841CDB4F3C5D2B81AA064.TMP"
    3⤵
    PID:1300
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:4872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES4CB8.tmp

Filesize
1KB

MD5
d89bf2933c4761f0672370bacb68aa0c

SHA1
c05253530ce1806aca075b5a5f6eace776d0997b

SHA256
e5ed9c0ae986c7c6c5cb696045651d337d4b79f69a55dda8503355d257db1a3b

SHA512
bca6bb1a217977bde2fe3cc8a65b20e8f22abb82525c71231e75d3ae6665406f50dc0fdecb452efe0e70d7f0c727a99471c33b2d5a6cf21e5df10dc0c5b98f93

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
81124b2f1293054707230e3f72f0cca4

SHA1
5160ed4bf38fd2c471190798caa4c7524b8b550e

SHA256
1e900a4f27380d677cabc793f784d5d30aaa0165757f137d8a981e3c7b9b37e8

SHA512
ec5a4ad3014164ab2f5131f570aeb68edf8a252da7b2cd186800c1dcc31ba7b2c2201cbac32c6850a925c223af5348641ba837df0157812a3d8ba8f1b4c58d72

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSCE42DBCF1D6841CDB4F3C5D2B81AA064.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/4872-9-0x0000000000C80000-0x0000000000C8A000-memory.dmp

Filesize
40KB

Download
memory/4872-11-0x00007FFC12990000-0x00007FFC13451000-memory.dmp

Filesize
10.8MB

Download
memory/4872-12-0x00007FFC12990000-0x00007FFC13451000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads