a2d4c19d2a8c9a6a196ebcf1f49a6eed03b06b76880d772fa8c0ab72aec59763

Analysis

max time kernel
64s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Size

13KB
MD5

da0f40d84d72ae3e9324ad9a040a2e58
SHA1

4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256

818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512

30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
SSDEEP

384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

screenCapture_1.3.2.exe

pid	Process
1076	screenCapture_1.3.2.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

cmd.execsc.exe

description	pid	Process	procid_target
PID 1452 wrote to memory of 3692	1452	cmd.exe	86
PID 1452 wrote to memory of 3692	1452	cmd.exe	86
PID 1452 wrote to memory of 3692	1452	cmd.exe	86
PID 3692 wrote to memory of 2592	3692	csc.exe	87
PID 3692 wrote to memory of 2592	3692	csc.exe	87
PID 3692 wrote to memory of 2592	3692	csc.exe	87
PID 1452 wrote to memory of 1076	1452	cmd.exe	88
PID 1452 wrote to memory of 1076	1452	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\RESOUR~1\APPASA~1.UNP\NODE_M~1\SCREEN~1\lib\win32\SCREEN~1.BAT"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4892.tmp" "c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC32133F8FE6164C6998D31DF7510AA7.TMP"
    3⤵
    PID:2592
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe
  screenCapture_1.3.2.exe
  2⤵
  - Executes dropped EXE
  PID:1076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES4892.tmp

Filesize
1KB

MD5
7c23aba68cdc75afc59f265ca2d2c605

SHA1
6d3471975480e0548234cbc3a8728497963d74bd

SHA256
c605991a3d6d270be3f264193ac6b6c435686aeebcc1b5d3e1708f5cdfd9cfdc

SHA512
9f07e4b48dbc14b89b9741e98373eb23723c3b14ada67accf2ce8b116a8e341a5d33641a9abe736c290f9d38f91d88df54740fb94b1bc025b6872ac1c9a082c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\screenCapture_1.3.2.exe

Filesize
12KB

MD5
3cb41436841af6e2155201715f9b20ea

SHA1
22f8cfb1e221e2d52ef8dcc71fac89ecf64f6b60

SHA256
1f7333ab89b97d80d8a69fe448eff7bbf385e78fac69f1fc3d7ec29fefaaa2f1

SHA512
f055b807eabcd9c9dd2437980fda74d98b0e600f285124e9cf17cc824495b77d19a5b8a1669f51797e63b51d1b54fb52f9019e8c43fa7584e6cabd3a9da2c053

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\screenshot-desktop\lib\win32\CSC32133F8FE6164C6998D31DF7510AA7.TMP

Filesize
1KB

MD5
a6f2d21624678f54a2abed46e9f3ab17

SHA1
a2a6f07684c79719007d434cbd1cd2164565734a

SHA256
ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

SHA512
0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

Download Submit
memory/1076-9-0x0000000000B10000-0x0000000000B1A000-memory.dmp

Filesize
40KB

Download
memory/1076-11-0x00007FFECA340000-0x00007FFECAE01000-memory.dmp

Filesize
10.8MB

Download
memory/1076-12-0x00007FFECA340000-0x00007FFECAE01000-memory.dmp

Filesize
10.8MB

Download