Overview

overview

10

Static

static

3

Toolscreen...me.exe

windows10-2004-x64

10

Toolscreen...me.exe

windows11-21h2-x64

10

Resubmissions

23/05/2026, 04:33

260523-e6nvrscz5r10

23/05/2026, 04:30

260523-e5axhsfw6y10

Analysis

  • user interaction
    yes
  • max time kernel
    88s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    23/05/2026, 04:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Toolscreen-1.3.6-double-click-me.exe
  • Size 11.8MB
  • Sample260523-e5axhsfw6y
  • SHA256 5811f8bd2b06831e994af7164b168153b3ab4a3e1b37432ae62fb28f837c5103
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutiontrojan

Malware Config

Signatures

  • Windows security bypass 2 TTPs 3 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Toolscreen-1.3.6-double-click-me.exe
    "C:\Users\Admin\AppData\Local\Temp\Toolscreen-1.3.6-double-click-me.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1376
    • C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query "HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy" /v VerifiedAndReputablePolicyState
      2⤵
        PID:2328
      • C:\Windows\System32\reg.exe
        C:\Windows\System32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
        2⤵
          PID:3920
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { (Get-MpPreference).ExclusionPath | ForEach-Object { $_ } } catch { exit 1 }"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3388
        • C:\Windows\System32\reg.exe
          C:\Windows\System32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
          2⤵
            PID:4384
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { (Get-MpPreference).ExclusionPath | ForEach-Object { $_ } } catch { exit 1 }"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:668
          • C:\Users\Admin\AppData\Local\Temp\Toolscreen-1.3.6-double-click-me.exe
            "C:\Users\Admin\AppData\Local\Temp\Toolscreen-1.3.6-double-click-me.exe" --defender-elevated-ensure "C:\Users\Admin\.config\Toolscreen\dlls" --defender-elevated-selfexe "C:\Users\Admin\AppData\Local\Temp\Toolscreen.exe" --defender-elevated-out "C:\Users\Admin\AppData\Local\Temp\easyinject-defender-out.txt"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4072
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\easyinject-defender-ensure.ps1" -TargetPath "C:\Users\Admin\.config\Toolscreen\dlls" -SelfExePath "C:\Users\Admin\AppData\Local\Temp\Toolscreen.exe" -OutFile "C:\Users\Admin\AppData\Local\Temp\easyinject-defender-out.txt"
              3⤵
              • Windows security bypass
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2856
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:964

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                powershell.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                • Size 4KB
                • SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 b4907d9a35b11dbaf762750863b66a75d4fcb9d6a8ab85957a421d8578a2ebde
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 1d55bbc056f8783fdf0c469fd2c73dd7d1ddb27f66c0630eb5b6795e003e67ce
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                __PSScriptPolicyTest_eac0deyb.3ce.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eac0deyb.3ce.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                easyinject-defender-ensure.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\easyinject-defender-ensure.ps1
                • Size 2KB
                • SHA256 849cfcff2b2f8cc61f2e8b131933632fa8a5f1534d9fae43756400d541f90026
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                easyinject-defender-out.txt
                • Path C:\Users\Admin\AppData\Local\Temp\easyinject-defender-out.txt
                • Size 43B
                • SHA256 f29b6d92c15a642e23865af77a9c1de1605991e424b8a0cf85db0935bb024a60
                • MD5 SHA1 SHA512
                Submit Download

                memory/2856-60-0x000001C5F53D0000-0x000001C5F5483000-memory.dmp
                Download

                memory/3388-16-0x00007FF44CC30000-0x00007FF44CC40000-memory.dmp
                Download

                memory/3388-20-0x000001DC2F3E0000-0x000001DC2F3FC000-memory.dmp
                Download

                memory/3388-21-0x000001DC2D280000-0x000001DC2D28A000-memory.dmp
                Download

                memory/3388-22-0x000001DC2F420000-0x000001DC2F43A000-memory.dmp
                Download

                memory/3388-23-0x000001DC2D290000-0x000001DC2D298000-memory.dmp
                Download

                memory/3388-24-0x000001DC2F400000-0x000001DC2F406000-memory.dmp
                Download

                memory/3388-25-0x000001DC2F410000-0x000001DC2F41A000-memory.dmp
                Download

                memory/3388-19-0x000001DC2D270000-0x000001DC2D27A000-memory.dmp
                Download

                memory/3388-18-0x000001DC2F320000-0x000001DC2F3D3000-memory.dmp
                Download

                memory/3388-1-0x000001DC2D2A0000-0x000001DC2D2B0000-memory.dmp
                Download

                memory/3388-17-0x000001DC2D250000-0x000001DC2D26C000-memory.dmp
                Download

                memory/3388-3-0x000001DC13990000-0x000001DC139B2000-memory.dmp
                Download

                memory/3388-2-0x000001DC2D2A0000-0x000001DC2D2B0000-memory.dmp
                Download