9ab402a0de3e64411eaefcbd0eb004e4eaffa635a3a737cb41646cd6fbf06fa9

Analysis

max time kernel
120s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-03-2024 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1488	screenCapture_1.3.2.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2804	csc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2804	2272	cmd.exe	31
PID 2272 wrote to memory of 2804	2272	cmd.exe	31
PID 2272 wrote to memory of 2804	2272	cmd.exe	31
PID 2272 wrote to memory of 2804	2272	cmd.exe	31
PID 2804 wrote to memory of 2860	2804	csc.exe	32
PID 2804 wrote to memory of 2860	2804	csc.exe	32
PID 2804 wrote to memory of 2860	2804	csc.exe	32
PID 2804 wrote to memory of 2860	2804	csc.exe	32
PID 2272 wrote to memory of 1488	2272	cmd.exe	33
PID 2272 wrote to memory of 1488	2272	cmd.exe	33
PID 2272 wrote to memory of 1488	2272	cmd.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3C8.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSCE434891227C34D1985ACBFD0BD633D6.TMP"
    3⤵
    PID:2860
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES3C8.tmp

Filesize
1KB

MD5
12c6b7e626684e46f057d0c17f25539a

SHA1
f4a9046340e7ccaee5eac333d08f0324cb2f4c91

SHA256
32600b4d0280408d4a9bbd2cfed72dc8831b29ef730fc548001c51c5a8868f41

SHA512
f52627f54776c6f34be3fba6b41433bda9240fa3e55a7570c7f3833950559e4893e297f0ac58c19c15358e993f64df36ff2cadb03a8469ee6b598fa02d19e3e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
ebe691bb5a3a507850aa2a3f601ebe6a

SHA1
b5d6bd9595d1ec5d4b807083ac329a06aec847fd

SHA256
5617bb9d597e6401936aa85bc8f2021e7fcb77c17ba7e0f179bf96c7cca1591a

SHA512
8ca39e4da60547722e35e8db1fb36b37ca248cc1ea85e8390d7d06c133fd728edfd430b3cfd9a15fcd162bdb328284ae418137524e80826797ef87cbd18ea8a4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSCE434891227C34D1985ACBFD0BD633D6.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/1488-8-0x00000000010A0000-0x00000000010AA000-memory.dmp

Filesize
40KB

Download
memory/1488-9-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmp

Filesize
9.9MB

Download
memory/1488-10-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads