a9ea01437d2621405693bf37b93d8fe067954ee00171ccfb07e50b0e71e43b8f

Analysis

max time kernel
59s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20240319-fr
resource tags

arch:x64arch:x86image:win10v2004-20240319-frlocale:fr-fros:windows10-2004-x64systemwindows
submitted
25-03-2024 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4552	screenCapture_1.3.2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 208	4804	cmd.exe	94
PID 4804 wrote to memory of 208	4804	cmd.exe	94
PID 4804 wrote to memory of 208	4804	cmd.exe	94
PID 208 wrote to memory of 1136	208	csc.exe	95
PID 208 wrote to memory of 1136	208	csc.exe	95
PID 208 wrote to memory of 1136	208	csc.exe	95
PID 4804 wrote to memory of 4552	4804	cmd.exe	96
PID 4804 wrote to memory of 4552	4804	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9395.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSCB28E6F0A21454F998B6ECE2236B84E3A.TMP"
    3⤵
    PID:1136
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4004 --field-trial-handle=2216,i,10470919997680216866,8963655491978124220,262144 --variations-seed-version /prefetch:8
1⤵
PID:4696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES9395.tmp

Filesize
1KB

MD5
39a5b69405b8e071c5894ab2adb672fd

SHA1
228a96921b3c08f8094368d66df069c6bab02c0b

SHA256
cf341b8f6acdcde125ac49646b7960e58e3fbddf92b0e478943ae01845f380bf

SHA512
0924c2613d27f1450fb6a1a577fd66e77986407230c7623de3644824a946694e4aad7496488c9926dcd91b1b1ea82fc9844228719e2178f7c2b8e2c234066492

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
309855a076eab0e530e074c6ff2d1ad9

SHA1
8848c4472dc0b432ff0328c32887232f0644bb95

SHA256
879b68890e741970273b0c1f54fe963be703e9905a2d981e83fd3790622031ab

SHA512
19a75774a465326061fdf94dfe910c180fecbd00a8f2b3616f9649375f59e60fb13f494ca0c59d2bb58a71964102758cdaf51acef2a2afc9f24d15314d1ec9bb

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSCB28E6F0A21454F998B6ECE2236B84E3A.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/4552-9-0x00000000006F0000-0x00000000006FA000-memory.dmp

Filesize
40KB

Download
memory/4552-11-0x00007FF85CF70000-0x00007FF85DA31000-memory.dmp

Filesize
10.8MB

Download
memory/4552-12-0x00007FF85CF70000-0x00007FF85DA31000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads