24c7d715a80500ca4286152f6f418ec753d5e7e95cd400a56c2df5d63ab1ffe2

Analysis

max time kernel
110s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

screenCapture_1.3.2.exe

pid	Process
3712	screenCapture_1.3.2.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

cmd.execsc.exe

description	pid	Process	procid_target
PID 2632 wrote to memory of 2808	2632	cmd.exe	89
PID 2632 wrote to memory of 2808	2632	cmd.exe	89
PID 2632 wrote to memory of 2808	2632	cmd.exe	89
PID 2808 wrote to memory of 4528	2808	csc.exe	90
PID 2808 wrote to memory of 4528	2808	csc.exe	90
PID 2808 wrote to memory of 4528	2808	csc.exe	90
PID 2632 wrote to memory of 3712	2632	cmd.exe	91
PID 2632 wrote to memory of 3712	2632	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDBC9.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSCF7BCEFC0B1AC4915919F48DE3F456F52.TMP"
    3⤵
    PID:4528
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:3712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESDBC9.tmp

Filesize
1KB

MD5
5b63dcc90c559268ddad470e975e4969

SHA1
f318ddc31894f9f85ad445ed91ffdf80ecba62ca

SHA256
a340652abb23273fcdcacd41c5eb7f2aa79264af205d9798fba6b06ea9e206d9

SHA512
7a463d78d08d75a73b9f90a015ed0130838073c88bfda6fa2f34bfcd5dfbf1d314a6c7d580a68be4fbb3982ac705a34d43143d006700802079dbe508ed2411be

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
51b63358de88bfb0c5ead3b8e4113adb

SHA1
dc9de3df799643b38cadc33b036b103b1654f519

SHA256
8073545592d543ae740d82019c21bef53f0bee230195a27e4409f483c62ccc7c

SHA512
1608af0ae005b41962ad89e0536f5f438cd50735e724b79b20c81d3dee182e5e68bf3c9f2120d16b24d9065bda09e954325947cd7233065036978bf5522a72ba

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSCF7BCEFC0B1AC4915919F48DE3F456F52.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/3712-9-0x00000000009D0000-0x00000000009DA000-memory.dmp

Filesize
40KB

Download
memory/3712-11-0x00007FFECBC50000-0x00007FFECC711000-memory.dmp

Filesize
10.8MB

Download
memory/3712-12-0x00007FFECBC50000-0x00007FFECC711000-memory.dmp

Filesize
10.8MB

Download