b58456e3c4b2fd055f01e7fcbb732bb91bd5d98209ffd71687046fd45b92094c

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-03-2024 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2640	screenCapture_1.3.2.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2196	csc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2196	1700	cmd.exe	29
PID 1700 wrote to memory of 2196	1700	cmd.exe	29
PID 1700 wrote to memory of 2196	1700	cmd.exe	29
PID 1700 wrote to memory of 2196	1700	cmd.exe	29
PID 2196 wrote to memory of 2032	2196	csc.exe	30
PID 2196 wrote to memory of 2032	2196	csc.exe	30
PID 2196 wrote to memory of 2032	2196	csc.exe	30
PID 2196 wrote to memory of 2032	2196	csc.exe	30
PID 1700 wrote to memory of 2640	1700	cmd.exe	31
PID 1700 wrote to memory of 2640	1700	cmd.exe	31
PID 1700 wrote to memory of 2640	1700	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES202E.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC3662DEA6F0424A6BAF6C2CC7D42D1833.TMP"
    3⤵
    PID:2032
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES202E.tmp

Filesize
1KB

MD5
f4cb5c2c71b63da6569aeb4b492d8133

SHA1
85ca65f4204dbbb2b6282c84d00d24f4142dfcc4

SHA256
4ddc4b0e140c2b997858e62bc83988ce9872fb309f0dc2a1c8282c01129b4f6f

SHA512
b89a37814488a53c245e121132e6e960e4c1f4255f11c9ef0e2bfe3a9772322086cc14eb9c510103120da89f8f539764a75735c28b3cf9d45c972393dcd8cb52

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
e834e722eea0eb1ea798fe2a4e057e5b

SHA1
fee33cf1d3d1f863cc179cf2015d026166bdf46d

SHA256
380ed931b30e2df2f39c6dd014e5b1a1100591aef5bdea0529adaf61f5edbb27

SHA512
e30be51d05be2a13bdb6e0c81fc48bca77d3c6ca803cc70c394d3395e27a7e3340ca50aee74ab93f4fe47ab6d38722637df4fd199957dc1b4b1944aa46666e88

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC3662DEA6F0424A6BAF6C2CC7D42D1833.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/2640-8-0x00000000002B0000-0x00000000002BA000-memory.dmp

Filesize
40KB

Download
memory/2640-9-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2640-10-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads