24c7d715a80500ca4286152f6f418ec753d5e7e95cd400a56c2df5d63ab1ffe2

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

screenCapture_1.3.2.exe

pid	Process
1728	screenCapture_1.3.2.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

csc.exe

pid	Process
2380	csc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

cmd.execsc.exe

description	pid	Process	procid_target
PID 2844 wrote to memory of 2380	2844	cmd.exe	29
PID 2844 wrote to memory of 2380	2844	cmd.exe	29
PID 2844 wrote to memory of 2380	2844	cmd.exe	29
PID 2844 wrote to memory of 2380	2844	cmd.exe	29
PID 2380 wrote to memory of 2372	2380	csc.exe	30
PID 2380 wrote to memory of 2372	2380	csc.exe	30
PID 2380 wrote to memory of 2372	2380	csc.exe	30
PID 2380 wrote to memory of 2372	2380	csc.exe	30
PID 2844 wrote to memory of 1728	2844	cmd.exe	31
PID 2844 wrote to memory of 1728	2844	cmd.exe	31
PID 2844 wrote to memory of 1728	2844	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES32F2.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC14F24DE6C04B417183A65A27A065BDEC.TMP"
    3⤵
    PID:2372
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES32F2.tmp

Filesize
1KB

MD5
d455a8251868ea69f97f5b15cfb1d7dc

SHA1
80f27e25eb7ce86a5a9d824b605df55cb1b11bc2

SHA256
6ceab3ed79a2581bdb7bb9d093ca65a11b5458eb8930a0f579cd58d9a9aeb643

SHA512
df0ced419ca4d90e8ce8ccd485c29b6bb1604ad26bd4f592759eac0da5ec139f5f3f6316c921a3d95f1169c8f3b17f0c872ae4fe20712f4fe0eac62f5820fd06

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
90b8c634c725453fbccbbac689f167f3

SHA1
ad68517648efe8a05418599561987e652b27785e

SHA256
0ac884653f1ae93dfaad497852a5afcf3f6542b8f93d357849e4183fdf10e813

SHA512
de4073c052648096c4f0b407dc65c058e090d8d2f5ec15e676bfdc386a01a0b90335421ae5e6828edcc27d10294787903d0ad9db767856cc998671b116664d0c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC14F24DE6C04B417183A65A27A065BDEC.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/1728-8-0x0000000000A20000-0x0000000000A2A000-memory.dmp

Filesize
40KB

Download
memory/1728-9-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

Filesize
9.9MB

Download
memory/1728-10-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

Filesize
9.9MB

Download