e8582220f161aef10bcba30369f4d9a3f2a53024b9cd4a5f9f9fecfb98ba8be2 | Triage

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 20:47

Sharing

Report Analysis Logs

General

Target

WindowBlinds/screen.exe
Size

228KB
MD5

e5d24769e601a8d8d23579e8222108d4
SHA1

6fa66b7852570774012b44d25b5d88258321e909
SHA256

d2092ebaf2875ab9d9539b4bbc1a688eae2b919a09a2060a6153cf2ad1079f60
SHA512

82c89f3dcc62d9d31b053a1ec35b9d3fbf920e1bd73d01e954a75a46b62eccdaa56bf5748e5cf9d2a371cae487fd1f34a7733e631066de6b61dfa7605868a82f
SSDEEP

3072:fir/c76bADCGUO7Z4b+kelpFl7dzM5kroBh6SgosPd:64WbquO7Z5Fl7pM56kh6SgosP

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4896	screen.exe
Token: SeIncBasePriorityPrivilege	4896	screen.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4896	screen.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4896	screen.exe

C:\Users\Admin\AppData\Local\Temp\WindowBlinds\screen.exe
"C:\Users\Admin\AppData\Local\Temp\WindowBlinds\screen.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads