a2d4c19d2a8c9a6a196ebcf1f49a6eed03b06b76880d772fa8c0ab72aec59763

Analysis

max time kernel
117s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

screenCapture_1.3.2.exe

pid	Process
2544	screenCapture_1.3.2.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

csc.exe

pid	Process
2628	csc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

cmd.execsc.exe

description	pid	Process	procid_target
PID 2204 wrote to memory of 2628	2204	cmd.exe	29
PID 2204 wrote to memory of 2628	2204	cmd.exe	29
PID 2204 wrote to memory of 2628	2204	cmd.exe	29
PID 2204 wrote to memory of 2628	2204	cmd.exe	29
PID 2628 wrote to memory of 2460	2628	csc.exe	30
PID 2628 wrote to memory of 2460	2628	csc.exe	30
PID 2628 wrote to memory of 2460	2628	csc.exe	30
PID 2628 wrote to memory of 2460	2628	csc.exe	30
PID 2204 wrote to memory of 2544	2204	cmd.exe	31
PID 2204 wrote to memory of 2544	2204	cmd.exe	31
PID 2204 wrote to memory of 2544	2204	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCEF3.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC89D3D258157C47FAB0B45CB11E8E2B8.TMP"
    3⤵
    PID:2460
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:2544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESCEF3.tmp

Filesize
1KB

MD5
c4f9501b93fc77ccdaf8d1cab31feb93

SHA1
9058b3f55a72c9bc0f9383cf0d3fecfb675ce3ec

SHA256
9e332456abd12ef1b838e1896e84da945ce900cda6efd00334b06cd5c621d682

SHA512
3ae9cd83c5cd362f8ca1a4c801d948cbe940e636b699aa9b0b72a93e0f722a5993402133075221afb1f1c40feb26290e8208af84041282a3981727458a47aac6

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
ecc72f9a3690c67c7aae03042cd919f3

SHA1
641d5f79cd596d84623202f3457c630f212b7e5e

SHA256
3fc1de839dae1ed3437abdd7a5a998229ccebd669e5712507a71d033bcc1ec8d

SHA512
2f40fe839cc186030a3618d1fa4654e5d885e3e1fd4528980c425da0758489fafb712c489a0ef3d2ba6c94194a1df7d2a686adcd2e3bdca52f2d353829006e07

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC89D3D258157C47FAB0B45CB11E8E2B8.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/2544-8-0x00000000012B0000-0x00000000012BA000-memory.dmp

Filesize
40KB

Download
memory/2544-9-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/2544-10-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download