4728b5eb6799fbe8850e03e7f7c73ceb7e530010b6179e157a016a6519cd1a31

Analysis

max time kernel
141s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1380	screenCapture_1.3.2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 2384	412	cmd.exe	87
PID 412 wrote to memory of 2384	412	cmd.exe	87
PID 412 wrote to memory of 2384	412	cmd.exe	87
PID 2384 wrote to memory of 3204	2384	csc.exe	92
PID 2384 wrote to memory of 3204	2384	csc.exe	92
PID 2384 wrote to memory of 3204	2384	csc.exe	92
PID 412 wrote to memory of 1380	412	cmd.exe	93
PID 412 wrote to memory of 1380	412	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE46.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC52B8C84BECD41B28CEB545BA9410.TMP"
    3⤵
    PID:3204
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESFE46.tmp

Filesize
1KB

MD5
74677ebdf786c51ed31537d144870219

SHA1
3f6cef7371b9b57845e3ea0605fe17cd60059831

SHA256
afcf36406374843941d323c031cfd7abafae1f9ac8843d184ae61ce5f602a0e5

SHA512
3cad1260bb51f3d440bff0e9f5ea876ab3f7d0f882a8e8a574e3d4de610e6651e5eb6f3deaa29fd9be08e0ce3456d61b2cfe48d7c4e58481c30145131f6c79a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
5c4d01eee15029ad159e4a84ce91c312

SHA1
d1e9f16d58bbbaa0ef50b7218fc2f69f3eb43cab

SHA256
d059ac87d4ff19f4ef92b2ceb5180eed1c94a101c32ff82c858d30a5d02964c7

SHA512
6718cd4c2d198a791d14a865832578a5d127227637c83661b2469b460d205a2170f486cc9f7bcbd5cc4162ac28f4bc21404d1b9cbb32be348a6ab8ada6f37d34

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC52B8C84BECD41B28CEB545BA9410.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/1380-9-0x0000000000090000-0x000000000009A000-memory.dmp

Filesize
40KB

Download
memory/1380-11-0x00007FFDE64B0000-0x00007FFDE6F71000-memory.dmp

Filesize
10.8MB

Download
memory/1380-12-0x00007FFDE64B0000-0x00007FFDE6F71000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads