d4990f7bcb35710c9a38dfb8c6cb324e43c47c72c6bb9c48d16d6b192fae4957

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2372	screenCapture_1.3.2.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2084	csc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2084	2220	cmd.exe	29
PID 2220 wrote to memory of 2084	2220	cmd.exe	29
PID 2220 wrote to memory of 2084	2220	cmd.exe	29
PID 2220 wrote to memory of 2084	2220	cmd.exe	29
PID 2084 wrote to memory of 2396	2084	csc.exe	30
PID 2084 wrote to memory of 2396	2084	csc.exe	30
PID 2084 wrote to memory of 2396	2084	csc.exe	30
PID 2084 wrote to memory of 2396	2084	csc.exe	30
PID 2220 wrote to memory of 2372	2220	cmd.exe	31
PID 2220 wrote to memory of 2372	2220	cmd.exe	31
PID 2220 wrote to memory of 2372	2220	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES200E.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC404AC4661F17433DAC2F2F9A903358A1.TMP"
    3⤵
    PID:2396
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:2372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES200E.tmp

Filesize
1KB

MD5
1e73d997b33984056491501c917ac418

SHA1
5567580d6b47a04386afd2ed6046cc1f56b4210a

SHA256
d5cf085ad6a3bb9c9d4f6ec1cc9778a65c366e3a1002f48ef02461a67fb6b9c7

SHA512
bf7df0cfab359fb018265fbb06f709cb506a6840bfcc874f72b37fc34aee63515ab42c2ccc0c3c869dcad022c7a77b53876dd2f2157227cc8267beca921672b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
56af26ae8cde87abaae843cdd2c591e2

SHA1
1ee3cc39b3aa3e4b0c19ae5ad4f82fd036936f96

SHA256
7b180ff9a9f1d11e767b6b40d3a7d95f31829105174f8d1ed921b2892f8cb91f

SHA512
190b764a917a51d340394961225006b66138c05b030628668554b7866d717e5e83388a929458679217fb25c61bf56406f6ffcb8658111ddb207058fbf14c9a3b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC404AC4661F17433DAC2F2F9A903358A1.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/2372-10-0x000007FEF5250000-0x000007FEF5C3C000-memory.dmp

Filesize
9.9MB

Download
memory/2372-9-0x000007FEF5250000-0x000007FEF5C3C000-memory.dmp

Filesize
9.9MB

Download
memory/2372-8-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads