70016e7acb7c5a21286d35b6ba064443d15f7260085e9d8711bd71077b91e654

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2176	screenCapture_1.3.2.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
836	csc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 836	2192	cmd.exe	29
PID 2192 wrote to memory of 836	2192	cmd.exe	29
PID 2192 wrote to memory of 836	2192	cmd.exe	29
PID 2192 wrote to memory of 836	2192	cmd.exe	29
PID 836 wrote to memory of 2076	836	csc.exe	30
PID 836 wrote to memory of 2076	836	csc.exe	30
PID 836 wrote to memory of 2076	836	csc.exe	30
PID 836 wrote to memory of 2076	836	csc.exe	30
PID 2192 wrote to memory of 2176	2192	cmd.exe	31
PID 2192 wrote to memory of 2176	2192	cmd.exe	31
PID 2192 wrote to memory of 2176	2192	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2452.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC7C2C919AB644148AC18A27914C4C18.TMP"
    3⤵
    PID:2076
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:2176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES2452.tmp

Filesize
1KB

MD5
0c9447258a3b3ac2c11343a4b3e280c2

SHA1
5b8c0b4129f053fdb0a29c6d522ddd8776ee6be3

SHA256
a2a2fd2acb10bd6b53e98b6ec857fa99a3cffbacf22f6973731ba9bb3106251b

SHA512
dc16a9a633dd774826fe03df8ba9a740c7d3d07ce9145119f0eaa00e1a8b6b20376dc79d303468a953bd8e36204376a7050c1f609bf99ab2337905e6620089a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
f4aa154b837fa5e6a622d9c21a95d80c

SHA1
f32c2502c2931c364f2cb6c8ba66873660a267dd

SHA256
2891ec5bf54eca567c1408f2eecc8c09ec75062f163bef7991160f9bc45e0958

SHA512
a70fd1ebcb2aa06e79853d542476a700b660c7b5129b56853a612b636d6d6f319d66b315942678feeaa481e29bb4b833427e91c65ca31cf753351ce0d1d3a0ae

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC7C2C919AB644148AC18A27914C4C18.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/2176-8-0x0000000000810000-0x000000000081A000-memory.dmp

Filesize
40KB

Download
memory/2176-9-0x000007FEF5890000-0x000007FEF627C000-memory.dmp

Filesize
9.9MB

Download
memory/2176-10-0x000007FEF5890000-0x000007FEF627C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads