9c1a052b4f6fbbe3c6437b3af2a3f93f2218b3c175073e7daeb6361f999a94c5

Analysis

max time kernel
134s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-04-2024 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
608	screenCapture_1.3.2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 4488	4492	cmd.exe	87
PID 4492 wrote to memory of 4488	4492	cmd.exe	87
PID 4492 wrote to memory of 4488	4492	cmd.exe	87
PID 4488 wrote to memory of 1716	4488	csc.exe	89
PID 4488 wrote to memory of 1716	4488	csc.exe	89
PID 4488 wrote to memory of 1716	4488	csc.exe	89
PID 4492 wrote to memory of 608	4492	cmd.exe	90
PID 4492 wrote to memory of 608	4492	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7AC9.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC7811090D8E0042F887343A4ECC70DE13.TMP"
    3⤵
    PID:1716
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES7AC9.tmp

Filesize
1KB

MD5
4f6175a1db8a1dee1b0e581e52917edf

SHA1
18b535c9de03c717a6d2c0beabbf494b46625d8f

SHA256
eaa3412cb473f7a135bbdbdc1af5cd5b227be8897cb736f1dd0ca8384d609ef4

SHA512
956d3407d83940ebf7302a9193328d7ffeee2f7f93ff15ba5d310677d5ed9acdac521b1c0b25bdfe5647568145f61174767e376548fb2d8cfc1f5af13a512097

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
917c81129c7ed93f69d13c98ee10c704

SHA1
38670f80cbc4689685c105cac0d61c102f47e5ba

SHA256
8fae7f80273d6122319ad8832a17dd7803137d7c669c8dbb9ad69145820102c6

SHA512
3929f0c570d7999e3362b6520f12c87c835cd98e411f90979e9f0bb5f62745b12b8e95c0f6c0dcb5c271a6df5450e9803420ad081e5204d805d0a1c4ac7e4548

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC7811090D8E0042F887343A4ECC70DE13.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/608-9-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/608-10-0x00007FFCA9580000-0x00007FFCAA041000-memory.dmp

Filesize
10.8MB

Download
memory/608-12-0x00007FFCA9580000-0x00007FFCAA041000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads