b58456e3c4b2fd055f01e7fcbb732bb91bd5d98209ffd71687046fd45b92094c

Analysis

max time kernel
138s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2024 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1240	screenCapture_1.3.2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 4616	2116	cmd.exe	95
PID 2116 wrote to memory of 4616	2116	cmd.exe	95
PID 2116 wrote to memory of 4616	2116	cmd.exe	95
PID 4616 wrote to memory of 4844	4616	csc.exe	97
PID 4616 wrote to memory of 4844	4616	csc.exe	97
PID 4616 wrote to memory of 4844	4616	csc.exe	97
PID 2116 wrote to memory of 1240	2116	cmd.exe	99
PID 2116 wrote to memory of 1240	2116	cmd.exe	99

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB7C7.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSCB874A4A1DE643D0AE2A9F984567AC6F.TMP"
    3⤵
    PID:4844
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:1240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3752 --field-trial-handle=2276,i,5672504106535478802,17394903851940863593,262144 --variations-seed-version /prefetch:8
1⤵
PID:872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESB7C7.tmp

Filesize
1KB

MD5
a6b639e67cc7f941558d5c7e423b27b7

SHA1
eb85a38f19e25eb08cfb55a73940db4739f2c1e2

SHA256
779bf5e15d9008fae6b20b4e9bb37c1e6c4b12b103577f2d0b2b8435e41f8bc6

SHA512
94c548d947008ee717047859e130acff4b3a22603c44321f2cfae699cd7d8dbd4ac7639dc96f4213bd92a1c2a8f6d17d46754d2824dd5cac9b223e898eeb53fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
ab9d8b826866214784ebd826fd237b26

SHA1
6886b0e318b28d60523f164d2838b139907cd091

SHA256
e35a8c327232f5dbc1f38dc17315d42b2aa3d81e59e21acb660e20adb257d7cb

SHA512
8928a0a703510eef0edcc3ff4eac8b05e360d0f32e7121aeee9abc0fd00c7aba4d5d1d7a5b52f276216493d930b318801dbf2fcda249d9a430a2a8cf532020a7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSCB874A4A1DE643D0AE2A9F984567AC6F.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/1240-9-0x0000000000260000-0x000000000026A000-memory.dmp

Filesize
40KB

Download
memory/1240-11-0x00007FFC3FAF0000-0x00007FFC405B1000-memory.dmp

Filesize
10.8MB

Download
memory/1240-12-0x00007FFC3FAF0000-0x00007FFC405B1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads