9ab402a0de3e64411eaefcbd0eb004e4eaffa635a3a737cb41646cd6fbf06fa9

Analysis

max time kernel
117s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3572	screenCapture_1.3.2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 2592	4892	cmd.exe	86
PID 4892 wrote to memory of 2592	4892	cmd.exe	86
PID 4892 wrote to memory of 2592	4892	cmd.exe	86
PID 2592 wrote to memory of 4816	2592	csc.exe	87
PID 2592 wrote to memory of 4816	2592	csc.exe	87
PID 2592 wrote to memory of 4816	2592	csc.exe	87
PID 4892 wrote to memory of 3572	4892	cmd.exe	88
PID 4892 wrote to memory of 3572	4892	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES67F1.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC754F0CD2392742438FB8A78AB3FD735.TMP"
    3⤵
    PID:4816
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:3572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES67F1.tmp

Filesize
1KB

MD5
6c029561c4697a6503b9145f4148d464

SHA1
09726858576a8f7b8b4b00f156e14bb13f37c54a

SHA256
3f97e72d7a43bc1347d387ead451842431918ca46120cefdfeb1e92cebfb9b1d

SHA512
04f85eb90b851eeb9e9b32ebcc84613c65e7898e61518a1d1f7709000c424cd20d03f7f5eb42fbcb60009db4992d655cc6d6520ed0b41772b68d6636177850a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
009356759103283d72aeadcf52d660bf

SHA1
a6036a96b5c04d9bbc4b3e870f811d8c16bb2e53

SHA256
0b52c5f40eb46d48308a8b7e5b72fee9b9a3838dae5e150b84add380e63efde2

SHA512
3ecb1a0ae321f06fab4e8aedf9998a15dc3cd58097d330c7cf9a0faccc4ed799572a7b872aeff13686ef9c02e77dd50c5b56dafb49d90c59e8e7ca604993e574

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC754F0CD2392742438FB8A78AB3FD735.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/3572-9-0x0000000000410000-0x000000000041A000-memory.dmp

Filesize
40KB

Download
memory/3572-11-0x00007FF9B1D00000-0x00007FF9B27C1000-memory.dmp

Filesize
10.8MB

Download
memory/3572-12-0x00007FF9B1D00000-0x00007FF9B27C1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads