b58456e3c4b2fd055f01e7fcbb732bb91bd5d98209ffd71687046fd45b92094c

Analysis

max time kernel
144s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2024 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4644	screenCapture_1.3.2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4392	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 4924	3932	cmd.exe	89
PID 3932 wrote to memory of 4924	3932	cmd.exe	89
PID 3932 wrote to memory of 4924	3932	cmd.exe	89
PID 4924 wrote to memory of 3164	4924	csc.exe	95
PID 4924 wrote to memory of 3164	4924	csc.exe	95
PID 4924 wrote to memory of 3164	4924	csc.exe	95
PID 3932 wrote to memory of 4644	3932	cmd.exe	96
PID 3932 wrote to memory of 4644	3932	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES83D6.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC303DF8A9E5A54CD8B3AC6F93C17ECD3.TMP"
    3⤵
    PID:3164
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:4644

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES83D6.tmp

Filesize
1KB

MD5
5c3eeb10207b1b78c395bc945fc39fb0

SHA1
749cb0d303a226542041f45c18c3b766688bf50b

SHA256
6efc8d1c7c7aa4f4a72c18bc1024dc9dd644e9a85002d8c2a7d5fb2cb3548f62

SHA512
9a39566a3f1579073310f93f02e8e311d275e79457e301967b4b81f68d2e7b2e24829621b2a22428d3ab7dd78b76d6b58d4d63adb9e5ecdc87c839a662cfdd02

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
d31d5efc984bc598b455ffcb86376e62

SHA1
f3a99a4e42f3629d7762d61b28f733b55115ae02

SHA256
2da68f638423244854e27bdd0b979f68bc365ff1644e3a3a726cb39d84d5cbf7

SHA512
3526b976d0fb8e598452b3cdb2461df7d699026b5b54ea251c8bd9f9beeacbc5b2f4c8e306b94508b7d6098599be7de68743d5c793f284574818f8fad3739287

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC303DF8A9E5A54CD8B3AC6F93C17ECD3.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/4392-51-0x000002677E340000-0x000002677E341000-memory.dmp

Filesize
4KB

Download
memory/4392-53-0x000002677E340000-0x000002677E341000-memory.dmp

Filesize
4KB

Download
memory/4392-81-0x000002677E1B0000-0x000002677E1B1000-memory.dmp

Filesize
4KB

Download
memory/4392-13-0x0000026775C40000-0x0000026775C50000-memory.dmp

Filesize
64KB

Download
memory/4392-29-0x0000026775D40000-0x0000026775D50000-memory.dmp

Filesize
64KB

Download
memory/4392-45-0x000002677E310000-0x000002677E311000-memory.dmp

Filesize
4KB

Download
memory/4392-46-0x000002677E340000-0x000002677E341000-memory.dmp

Filesize
4KB

Download
memory/4392-47-0x000002677E340000-0x000002677E341000-memory.dmp

Filesize
4KB

Download
memory/4392-48-0x000002677E340000-0x000002677E341000-memory.dmp

Filesize
4KB

Download
memory/4392-49-0x000002677E340000-0x000002677E341000-memory.dmp

Filesize
4KB

Download
memory/4392-50-0x000002677E340000-0x000002677E341000-memory.dmp

Filesize
4KB

Download
memory/4392-80-0x000002677E0A0000-0x000002677E0A1000-memory.dmp

Filesize
4KB

Download
memory/4392-52-0x000002677E340000-0x000002677E341000-memory.dmp

Filesize
4KB

Download
memory/4392-79-0x000002677E0A0000-0x000002677E0A1000-memory.dmp

Filesize
4KB

Download
memory/4392-54-0x000002677E340000-0x000002677E341000-memory.dmp

Filesize
4KB

Download
memory/4392-55-0x000002677E340000-0x000002677E341000-memory.dmp

Filesize
4KB

Download
memory/4392-56-0x000002677DF60000-0x000002677DF61000-memory.dmp

Filesize
4KB

Download
memory/4392-57-0x000002677DF50000-0x000002677DF51000-memory.dmp

Filesize
4KB

Download
memory/4392-59-0x000002677DF60000-0x000002677DF61000-memory.dmp

Filesize
4KB

Download
memory/4392-62-0x000002677DF50000-0x000002677DF51000-memory.dmp

Filesize
4KB

Download
memory/4392-65-0x000002677DE90000-0x000002677DE91000-memory.dmp

Filesize
4KB

Download
memory/4392-77-0x000002677E090000-0x000002677E091000-memory.dmp

Filesize
4KB

Download
memory/4644-11-0x00007FFEEC740000-0x00007FFEED201000-memory.dmp

Filesize
10.8MB

Download
memory/4644-9-0x0000000000960000-0x000000000096A000-memory.dmp

Filesize
40KB

Download
memory/4644-12-0x00007FFEEC740000-0x00007FFEED201000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads