0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

screenCapture_1.3.2.exe

pid process

1136 screenCapture_1.3.2.exe

pid	process
1136	screenCapture_1.3.2.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

cmd.execsc.exe

description	pid	process	target process
PID 1852 wrote to memory of 5104	1852	cmd.exe	csc.exe
PID 1852 wrote to memory of 5104	1852	cmd.exe	csc.exe
PID 1852 wrote to memory of 5104	1852	cmd.exe	csc.exe
PID 5104 wrote to memory of 3336	5104	csc.exe	cvtres.exe
PID 5104 wrote to memory of 3336	5104	csc.exe	cvtres.exe
PID 5104 wrote to memory of 3336	5104	csc.exe	cvtres.exe
PID 1852 wrote to memory of 1136	1852	cmd.exe	screenCapture_1.3.2.exe
PID 1852 wrote to memory of 1136	1852	cmd.exe	screenCapture_1.3.2.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6F54.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC5138B77F2C8044309DA41DC867F106A.TMP"
    3⤵
    PID:3336
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:1136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES6F54.tmp

Filesize
1KB

MD5
3c5b046290065aacf6b7258512b06152

SHA1
c5672a2e437a5f8152cfb37d1d69d1b6b3984e04

SHA256
b6248c5cd17ad1fb2ebe075ddba1af1b4397c62103b239e32f912e5019b3dd49

SHA512
d8d5a45a6c23ba29be258b7861560b2dbc679f3705b78c37ac05e70d1ba37707191b09812c789b7bb46bd632290bc7cb202c176ab0d504e723cefb24c7b356d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
ba5cac3f0471531c439816e3b3e816f4

SHA1
4c5749168c2760c382686dce99477ead4a0883a0

SHA256
83b5ac9475d39b21dfbc7f30539d8c89bd693fdc498a5c4803d9a263611fe9e2

SHA512
9a037b3963443f7d26ed96852436a0ed90f73276a96e7c1412c8c65a6678df5983cde09e48524b94a8b65ba942025d2ff0f3c58bbafd1ebb95c0a7a20d64407b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC5138B77F2C8044309DA41DC867F106A.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/1136-9-0x0000000000260000-0x000000000026A000-memory.dmp

Filesize
40KB

Download
memory/1136-11-0x00007FF9C5EC0000-0x00007FF9C6981000-memory.dmp

Filesize
10.8MB

Download
memory/1136-12-0x00007FF9C5EC0000-0x00007FF9C6981000-memory.dmp

Filesize
10.8MB

Download