70016e7acb7c5a21286d35b6ba064443d15f7260085e9d8711bd71077b91e654

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1724	screenCapture_1.3.2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 3368	3388	cmd.exe	89
PID 3388 wrote to memory of 3368	3388	cmd.exe	89
PID 3388 wrote to memory of 3368	3388	cmd.exe	89
PID 3368 wrote to memory of 1048	3368	csc.exe	91
PID 3368 wrote to memory of 1048	3368	csc.exe	91
PID 3368 wrote to memory of 1048	3368	csc.exe	91
PID 3388 wrote to memory of 1724	3388	cmd.exe	92
PID 3388 wrote to memory of 1724	3388	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6E4A.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSCCB4C49DDD1EF4BE8B9F65342FF468F7F.TMP"
    3⤵
    PID:1048
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES6E4A.tmp

Filesize
1KB

MD5
64fdfd1ab66eb17696725ce265a760ac

SHA1
d98911a04720038a68fc19becefe974f6f14009d

SHA256
6b75bf905d2fbd38d86e30b1739f3347b16f4056259121b987bbdafb25430d54

SHA512
03415d4ef545a8be2f86fd6d96c6aee96e6c21eb34e2326c6998d78547de97260146779cac58433edf689f2fa8fa705f6e0bbd887c81eac87c04454947b21b78

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
417e81bcda2c0d34abb19cac478c998a

SHA1
1bc9c7c848d2d07f475539b6f7f16f5066677287

SHA256
c5098246d786c3e0d56c3c88c6297863ef685813dae9591e477675e0717293f8

SHA512
cde2dc285b623fcd64c5c0198450d006f16e0cd539893bb9b38c5d927f6ca246e4b2659d5856349869447386be623b3b2f59cf4935e6cae456ef93d4625dd537

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSCCB4C49DDD1EF4BE8B9F65342FF468F7F.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/1724-9-0x0000000000930000-0x000000000093A000-memory.dmp

Filesize
40KB

Download
memory/1724-11-0x00007FFB99AB0000-0x00007FFB9A571000-memory.dmp

Filesize
10.8MB

Download
memory/1724-12-0x00007FFB99AB0000-0x00007FFB9A571000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads