4728b5eb6799fbe8850e03e7f7c73ceb7e530010b6179e157a016a6519cd1a31

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3052	screenCapture_1.3.2.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1784	csc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1784	1708	cmd.exe	29
PID 1708 wrote to memory of 1784	1708	cmd.exe	29
PID 1708 wrote to memory of 1784	1708	cmd.exe	29
PID 1708 wrote to memory of 1784	1708	cmd.exe	29
PID 1784 wrote to memory of 2992	1784	csc.exe	30
PID 1784 wrote to memory of 2992	1784	csc.exe	30
PID 1784 wrote to memory of 2992	1784	csc.exe	30
PID 1784 wrote to memory of 2992	1784	csc.exe	30
PID 1708 wrote to memory of 3052	1708	cmd.exe	31
PID 1708 wrote to memory of 3052	1708	cmd.exe	31
PID 1708 wrote to memory of 3052	1708	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES78B9.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC9CB3682D2099464C9F358FCBBACC6A6C.TMP"
    3⤵
    PID:2992
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:3052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES78B9.tmp

Filesize
1KB

MD5
080cdadd0368ab7cad6f9eadb0200ae5

SHA1
dbf29fc538a3b34f301d0571d1fd54c289f665ef

SHA256
91944edfdca518a9994a95c17c7cedc7c304ffb93a8ccbd15f46943f22c4d1e8

SHA512
657f7c47a35529685e14b7ee7dba6bdaafd9466ee154cc449a160c343e71cc3b68acd44305289f9a2e118b7970dc862719778399cb152d8c040a65c0b4d7dd06

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
227a5288a5e5fa51b1a8be213c357559

SHA1
f2faa72b7762b514b08d380e2aeffc5dd13fc12d

SHA256
5797edf234a29111fd3e5a1d550ef65683a92842010b24fda4b2d3b9086d1b6d

SHA512
2111a78a12a52aaeee26fbe59bb592758003da4fabdb6b16c8fea1d8bd362ff517d2cad7c0d26f2553de17721c648f7a608c4ff27e12cc43e0dfe56594cf5baa

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC9CB3682D2099464C9F358FCBBACC6A6C.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/3052-8-0x00000000000D0000-0x00000000000DA000-memory.dmp

Filesize
40KB

Download
memory/3052-9-0x000007FEF60D0000-0x000007FEF6ABC000-memory.dmp

Filesize
9.9MB

Download
memory/3052-10-0x000007FEF60D0000-0x000007FEF6ABC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads