58fa80d61fa4bb25b6a2833593378c11cd014f63fa22b282332e6ca66fb1abc9

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-03-2024 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3064	screenCapture_1.3.2.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2588	csc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2588	2156	cmd.exe	29
PID 2156 wrote to memory of 2588	2156	cmd.exe	29
PID 2156 wrote to memory of 2588	2156	cmd.exe	29
PID 2156 wrote to memory of 2588	2156	cmd.exe	29
PID 2588 wrote to memory of 1032	2588	csc.exe	30
PID 2588 wrote to memory of 1032	2588	csc.exe	30
PID 2588 wrote to memory of 1032	2588	csc.exe	30
PID 2588 wrote to memory of 1032	2588	csc.exe	30
PID 2156 wrote to memory of 3064	2156	cmd.exe	31
PID 2156 wrote to memory of 3064	2156	cmd.exe	31
PID 2156 wrote to memory of 3064	2156	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2710.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSCF028C3B49BA44C1D9656FD925380C96A.TMP"
    3⤵
    PID:1032
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:3064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES2710.tmp

Filesize
1KB

MD5
415651b349e732cd42fe667b52778b6f

SHA1
72ee2721343329c58bb57f98ec50e3a1d4d9de26

SHA256
8019c5ac290ed7db0ea9f918a7bed0ad5101d2ccd3bf49000c407422ede71a35

SHA512
8315223f6af8af2e7b6a3b6dc4bc91db0bdd1dc507e50c6d7964a00bb01ff7c52909b9b92beaa29fb36acf2134aae74d75641ef7a6d93eb8a24ed546c0cccc45

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
b1949b8c6ee1e0972904f635245f7217

SHA1
ce94c79549120aaef27ea77c4fbbbd0687a572ba

SHA256
49743a00d20ce8b679c04edff9049bd932c7a89ecae4de2aa75a88546192b2df

SHA512
c14b4594620004e35c266678bee3fb14b417bfe485280e75181bb2a935282b63886e8338e2e344dba31d6a12e0ae16af8c8a80949573c511f397424946fbba85

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSCF028C3B49BA44C1D9656FD925380C96A.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/3064-8-0x00000000002F0000-0x00000000002FA000-memory.dmp

Filesize
40KB

Download
memory/3064-9-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Filesize
9.9MB

Download
memory/3064-10-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads