0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

screenCapture_1.3.2.exe

pid	Process
3932	screenCapture_1.3.2.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

cmd.execsc.exe

description	pid	Process	procid_target
PID 768 wrote to memory of 2648	768	cmd.exe	86
PID 768 wrote to memory of 2648	768	cmd.exe	86
PID 768 wrote to memory of 2648	768	cmd.exe	86
PID 2648 wrote to memory of 4936	2648	csc.exe	88
PID 2648 wrote to memory of 4936	2648	csc.exe	88
PID 2648 wrote to memory of 4936	2648	csc.exe	88
PID 768 wrote to memory of 3932	768	cmd.exe	89
PID 768 wrote to memory of 3932	768	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4EAC.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC819FCAE531904D13884A949CEB749CB2.TMP"
    3⤵
    PID:4936
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:3932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES4EAC.tmp

Filesize
1KB

MD5
72875f8a952875a402908d35a57ea2fc

SHA1
1e63820f8186b7b38a0cbbdbf6b02da26ab51ab9

SHA256
b1f064646a05a9b619ff961e5112886f8fc0433a5972ef2c1ca304c7b490e266

SHA512
1d0487e6e8de41cef1c84b23773bf250a6851c757c77e3338e143956bf29da2a23c45ab7be7a6eb3ebb8f34ebf53641b2869e7e8e2d563dc8fb76c70ad8708f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
b8ba658632ece7d9dead36b67fbade48

SHA1
0b3bd0e0a414a35994c989467176fe69e9db834a

SHA256
1bfbf3af3ae461f83f48b463164e5d99f39cba64bd4858bf20d00f0c21791e4b

SHA512
14ffd4db242a3e580b31a3b3cc235727f7e089d8c2ff6ef4ea9f754a7019428757aa5429e0dbe2f076517c70f86e22928cbb81c094ec9aebb01fb7fb8eaa88ac

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC819FCAE531904D13884A949CEB749CB2.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/3932-9-0x00000000005C0000-0x00000000005CA000-memory.dmp

Filesize
40KB

Download
memory/3932-11-0x00007FF93E190000-0x00007FF93EC51000-memory.dmp

Filesize
10.8MB

Download
memory/3932-12-0x00007FF93E190000-0x00007FF93EC51000-memory.dmp

Filesize
10.8MB

Download