79ae38d3832ab7d48543039eff6078538465eb83d8fbb124db2e319295ab5e68

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3012	screenCapture_1.3.2.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1228	csc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1228	2292	cmd.exe	29
PID 2292 wrote to memory of 1228	2292	cmd.exe	29
PID 2292 wrote to memory of 1228	2292	cmd.exe	29
PID 2292 wrote to memory of 1228	2292	cmd.exe	29
PID 1228 wrote to memory of 1296	1228	csc.exe	30
PID 1228 wrote to memory of 1296	1228	csc.exe	30
PID 1228 wrote to memory of 1296	1228	csc.exe	30
PID 1228 wrote to memory of 1296	1228	csc.exe	30
PID 2292 wrote to memory of 3012	2292	cmd.exe	31
PID 2292 wrote to memory of 3012	2292	cmd.exe	31
PID 2292 wrote to memory of 3012	2292	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1D12.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSCA52054C96B4A4A44A14A92861825FAF3.TMP"
    3⤵
    PID:1296
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES1D12.tmp

Filesize
1KB

MD5
feb3210e3365380763e2addf877c8c55

SHA1
4324ec12171829bba6458f2b12ccd4cf66d23ec7

SHA256
6c146971cf4e631415c1b3bd067f967ebe6194f9a623212ad814128bee5a9ab4

SHA512
e28bd4ca6edf8e7afbcf6c9749bef07d284019df7c6e61f9c4ff4048e626ff3073dbb9770ec9e908494ad8bb076b1f08a788c2edc04fba1355db7bc4beee937d

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
1a182ccbfff3be024d3f71f8c0bc2484

SHA1
b0a9e509fa0d7bbcaf07415841a6b4cdd68f982c

SHA256
c798a0a136c304741c6b0dd207dd44f92decd31743f3da7c68ddf2ad8e323b6b

SHA512
73ade6e9160dbf5562c1d156831c5440d402e945ef554d4c22fec8ba33e0cd8fac7b11c7f68d161da752c1255587e8b4cbcc6cf22b0f86af1b6946361371ba1c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSCA52054C96B4A4A44A14A92861825FAF3.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/3012-8-0x0000000000380000-0x000000000038A000-memory.dmp

Filesize
40KB

Download
memory/3012-9-0x000007FEF5150000-0x000007FEF5B3C000-memory.dmp

Filesize
9.9MB

Download
memory/3012-10-0x000007FEF5150000-0x000007FEF5B3C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads