0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149

Analysis

max time kernel
109s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 07:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3188	screenCapture_1.3.2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 2056	880	cmd.exe	88
PID 880 wrote to memory of 2056	880	cmd.exe	88
PID 880 wrote to memory of 2056	880	cmd.exe	88
PID 2056 wrote to memory of 4736	2056	csc.exe	91
PID 2056 wrote to memory of 4736	2056	csc.exe	91
PID 2056 wrote to memory of 4736	2056	csc.exe	91
PID 880 wrote to memory of 3188	880	cmd.exe	92
PID 880 wrote to memory of 3188	880	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES66B9.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC218DC1B31CE74ED78DDBE789686B43B6.TMP"
    3⤵
    PID:4736
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:3188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES66B9.tmp

Filesize
1KB

MD5
32f447eb0a19f80695761d9144a5c4d1

SHA1
45d2c6ae690130fdd81fefb59810b42847f618bc

SHA256
4f6042e7974aeb397a6c6f478ac852ca01341c55ac75345fc37c966e95d46dca

SHA512
50e01eafacc16c2d1119287c1a84c257ee5ce7dca463eb792af03ac8de384123ebfe594280fd3ebe4bce9cccbccd42c79f953df0c6efae7b883f0529235d9923

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
024ccc4b25daa608e3a0870a8c972b84

SHA1
9adea57ff36f5f97b1a0fcc368952c33cc8b0d0b

SHA256
38e0a39c6cc5c022657a6686c9c142ac38cf9a05af2089e9d5cf9aa42a22da6a

SHA512
30fd0824678fed366e566645d48afef013d74278339c0ad0c59177dbbf65da2d4d18f3c4b7e31473f9b03a8f8efc3c4347cceaef5e39ddb3628ba6b0f7102adb

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC218DC1B31CE74ED78DDBE789686B43B6.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/3188-9-0x0000000000070000-0x000000000007A000-memory.dmp

Filesize
40KB

Download
memory/3188-11-0x00007FFA32610000-0x00007FFA330D1000-memory.dmp

Filesize
10.8MB

Download
memory/3188-12-0x00007FFA32610000-0x00007FFA330D1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads