Analysis

  • max time kernel
    118s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11-04-2024 08:34

General

  • Target

    resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat

  • Size

    13KB

  • MD5

    da0f40d84d72ae3e9324ad9a040a2e58

  • SHA1

    4ca7f6f90fb67dce8470b67010aa19aa0fd6253f

  • SHA256

    818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b

  • SHA512

    30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9

  • SSDEEP

    384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
      2⤵
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      • Suspicious use of WriteProcessMemory
      PID:2196
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDEAC.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC71DCCF196AD442449D4720A0573BF1B.TMP"
        3⤵
          PID:2252
      • C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
        screenCapture_1.3.2.exe
        2⤵
        • Executes dropped EXE
        PID:2332

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RESDEAC.tmp

      Filesize

      1KB

      MD5

      74880ce1738add00fb680ce3599c53ca

      SHA1

      63b8827d46abf3a9c8d38a03bb117fe612a8564f

      SHA256

      ffdfb62a547dec319ec1443ecaab2975ccf7970c613ae44073bc67c6a43ba340

      SHA512

      475561e9b0db3b9361b36939ff3268b492f73c9d08752d0943e93d88d2dfbf4316f7c0f095a628aea24f4d766e4ccbba63e8dee7d3b906444553055d91bf5bbf

    • C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

      Filesize

      12KB

      MD5

      e7b84e1ef4ea952e9d5a271e2bcdd66d

      SHA1

      fe1875c3f747d6acd7808214a437fcf4fe57a2f8

      SHA256

      66859df5e4468c9450f898d04de0302a44c0de2ef7817bf04ade132718fe7abb

      SHA512

      a5a0fa1021819b5fc5c56021c012c878401b1bf5a9e5f672710228815bae47fea5a595d443f52af465f3e3c87b0c573a9ef4c6d54316f56dbcfda11790587bae

    • \??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC71DCCF196AD442449D4720A0573BF1B.TMP

      Filesize

      1KB

      MD5

      a6f2d21624678f54a2abed46e9f3ab17

      SHA1

      a2a6f07684c79719007d434cbd1cd2164565734a

      SHA256

      ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

      SHA512

      0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

    • memory/2332-8-0x0000000000BD0000-0x0000000000BDA000-memory.dmp

      Filesize

      40KB

    • memory/2332-9-0x000007FEF6170000-0x000007FEF6B5C000-memory.dmp

      Filesize

      9.9MB

    • memory/2332-10-0x000007FEF6170000-0x000007FEF6B5C000-memory.dmp

      Filesize

      9.9MB