a9ea01437d2621405693bf37b93d8fe067954ee00171ccfb07e50b0e71e43b8f

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2096	screenCapture_1.3.2.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2988	csc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2988	2204	cmd.exe	29
PID 2204 wrote to memory of 2988	2204	cmd.exe	29
PID 2204 wrote to memory of 2988	2204	cmd.exe	29
PID 2204 wrote to memory of 2988	2204	cmd.exe	29
PID 2988 wrote to memory of 2936	2988	csc.exe	30
PID 2988 wrote to memory of 2936	2988	csc.exe	30
PID 2988 wrote to memory of 2936	2988	csc.exe	30
PID 2988 wrote to memory of 2936	2988	csc.exe	30
PID 2204 wrote to memory of 2096	2204	cmd.exe	31
PID 2204 wrote to memory of 2096	2204	cmd.exe	31
PID 2204 wrote to memory of 2096	2204	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES25AA.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC4876620E49704E5E9BD56F404B3D7BAB.TMP"
    3⤵
    PID:2936
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:2096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES25AA.tmp

Filesize
1KB

MD5
bc0832f3d6872215b77af7ca55cbb9e6

SHA1
d89d34e6cb78deff9dd455aa0c3cae3083b345fc

SHA256
cc77d530039c00ed498118813a0929392c91a898cf45f15e64ec13a73a91958b

SHA512
775a6d8b66b3e938861ef555e2f5bdbd2434907662632835f8490ed35ec4851a525a60573008cab5399e4c4066a930fd683c3dd235396ffff326d8dec40961c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
440b1be7da32f7023b4106856b1a9d27

SHA1
efeba6766672f4a21b3459bbf986bb4381c0a255

SHA256
581e649fb72ce2b656a916dd1e02ff5cc5dafdc6e10c33890f9be3e383564a8f

SHA512
57e3ea1faebd415f9e56163b748d82596d4ed54b634cad32b4c7c9c7d289807dc6742fb638afb9ec1b7b4264fe1a9c62be7b537c94be9b3c5b7a225e19b740da

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC4876620E49704E5E9BD56F404B3D7BAB.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/2096-8-0x00000000001F0000-0x00000000001FA000-memory.dmp

Filesize
40KB

Download
memory/2096-9-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

Filesize
9.9MB

Download
memory/2096-10-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads