d4990f7bcb35710c9a38dfb8c6cb324e43c47c72c6bb9c48d16d6b192fae4957

Analysis

max time kernel
100s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4800	screenCapture_1.3.2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4248	4964	cmd.exe	87
PID 4964 wrote to memory of 4248	4964	cmd.exe	87
PID 4964 wrote to memory of 4248	4964	cmd.exe	87
PID 4248 wrote to memory of 1180	4248	csc.exe	90
PID 4248 wrote to memory of 1180	4248	csc.exe	90
PID 4248 wrote to memory of 1180	4248	csc.exe	90
PID 4964 wrote to memory of 4800	4964	cmd.exe	91
PID 4964 wrote to memory of 4800	4964	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES31D9.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC8AE2E4403A0544F58A1C76C1BE7ABF81.TMP"
    3⤵
    PID:1180
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:4800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES31D9.tmp

Filesize
1KB

MD5
10b8acec9b64bd135da47f83d5c4c323

SHA1
6f4a67b3346dd04292b69e1ce5e0edc1de6b12a2

SHA256
e1bb100b9d7cfdcbf0c25280d02916ad9e7fb7d2408e17124db868ae2cf553f4

SHA512
15cb3d05dcdab5f2aefc66d363fc7ebbc8eb3a078d53b6028cd2570278f90364394d1d20830d0f349d42fbac30a386cddb6a34fab981a278899112501e0279dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
6168b5c2ef3ed5d8fee7f184c6e4a163

SHA1
0b150528dd36d343d2fa93507cf617a8e8b481aa

SHA256
5f04dda6abd94509442906f940eb9ee86f2517612855575c296de4dc52bf46ea

SHA512
1d0fa34d24584b7ce91b271f6e2f65b3a314f7f7eb228270ebc4d8b8cf9a4e08037ca417e1b699ade82a0a528fca3fd5c8614e391e1b831041837d91a10f8f4d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC8AE2E4403A0544F58A1C76C1BE7ABF81.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/4800-9-0x0000000000D30000-0x0000000000D3A000-memory.dmp

Filesize
40KB

Download
memory/4800-11-0x00007FFF32E60000-0x00007FFF33921000-memory.dmp

Filesize
10.8MB

Download
memory/4800-12-0x00007FFF32E60000-0x00007FFF33921000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads