6d9cbfd099d91fc5d53512f90bdcf8a7675cfd9a93b533a31ac2b2a8a5f6fbb4

Analysis

max time kernel
142s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2024 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2796	screenCapture_1.3.2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 3440	4656	cmd.exe	92
PID 4656 wrote to memory of 3440	4656	cmd.exe	92
PID 4656 wrote to memory of 3440	4656	cmd.exe	92
PID 3440 wrote to memory of 2404	3440	csc.exe	94
PID 3440 wrote to memory of 2404	3440	csc.exe	94
PID 3440 wrote to memory of 2404	3440	csc.exe	94
PID 4656 wrote to memory of 2796	4656	cmd.exe	95
PID 4656 wrote to memory of 2796	4656	cmd.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA1CE.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC1300189CE788454DA03B78CB27D55AF3.TMP"
    3⤵
    PID:2404
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESA1CE.tmp

Filesize
1KB

MD5
dad79afb4f4548d0a70eff5c6776cfef

SHA1
69924eeb6a0233a8f8cfa6637923eb7feae43acf

SHA256
548302d48771a13a03c6c98c350fb7c17b8d2ea5ce201f2a6970ed51664eec87

SHA512
63cecf5a87780e1789a6259c13748ceeab25c85bde55d5316a3985ab637d872952b06b0d63eebd0f3eeab4d5062ce3396d581ba53625cbdea7d5b98ec3016ce5

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
4b31434764f3b580c48e4675bb0737d3

SHA1
236898816f7e83a11d31ee6b748f0cfe8093a8d5

SHA256
ea4f071f8018b030c2a44e4fd8131b0beec8fa4d941e86be34667a760d0e6dee

SHA512
4dedbd52beadb49922c4d8c127fcb84e19add24aa0b549e0a2b5a156403c15624c65ebb8a818ee7aaee44c092a5c890564f00373f13efcbe73c319d71e802097

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC1300189CE788454DA03B78CB27D55AF3.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/2796-9-0x00000000007B0000-0x00000000007BA000-memory.dmp

Filesize
40KB

Download
memory/2796-11-0x00007FFB61200000-0x00007FFB61CC1000-memory.dmp

Filesize
10.8MB

Download
memory/2796-12-0x00007FFB61200000-0x00007FFB61CC1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads