a9ea01437d2621405693bf37b93d8fe067954ee00171ccfb07e50b0e71e43b8f

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4640	screenCapture_1.3.2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 4916	4504	cmd.exe	90
PID 4504 wrote to memory of 4916	4504	cmd.exe	90
PID 4504 wrote to memory of 4916	4504	cmd.exe	90
PID 4916 wrote to memory of 2080	4916	csc.exe	91
PID 4916 wrote to memory of 2080	4916	csc.exe	91
PID 4916 wrote to memory of 2080	4916	csc.exe	91
PID 4504 wrote to memory of 4640	4504	cmd.exe	92
PID 4504 wrote to memory of 4640	4504	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5803.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC68171F81857D4105888332E6AF2A65E.TMP"
    3⤵
    PID:2080
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:4640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES5803.tmp

Filesize
1KB

MD5
e3d49f5e394e2e112cc1d727a7761747

SHA1
e956ba3715f67b87d2737dd8a6a0f2e2ddaccbd7

SHA256
f685036f17ee763e0eeb8847ad73704491eee7fb194d62afbfd7f23eda8d0d6e

SHA512
5d10b427ac4a8b38c43b97465e076205ccb22a7bbf49dd5fd078114c2a7d8d35f7cf6d388ee271614475df9fe210d1c3948257d4276cdc79d37fae4eb40126a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
c5b433ca23ee3739395b65c95c3a585f

SHA1
a81c4dc1eca2559ae8e81c9df8427f151e83d349

SHA256
8950d2365af8afa8760b3f686364a844d243aa679ebfc944c34024c4ea54e2ae

SHA512
071e17b911d827036496ae67f406392367287cd6a2da09c3ed1455a48e070ab548738708444294f216ae88dfb4e4720bda4e2229f6dfa06a37ef484a30bcc3d1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC68171F81857D4105888332E6AF2A65E.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/4640-9-0x0000000000C80000-0x0000000000C8A000-memory.dmp

Filesize
40KB

Download
memory/4640-11-0x00007FFD29B70000-0x00007FFD2A631000-memory.dmp

Filesize
10.8MB

Download
memory/4640-12-0x00007FFD29B70000-0x00007FFD2A631000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads