Overview

overview

10

Static

static

3

Toolscreen...me.exe

windows10-2004-x64

10

Toolscreen...me.exe

windows11-21h2-x64

10

Resubmissions

23/05/2026, 04:33

260523-e6nvrscz5r10

23/05/2026, 04:30

260523-e5axhsfw6y10

Analysis

  • user interaction
    yes
  • max time kernel
    46s
  • max time network
    49s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/05/2026, 04:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Toolscreen-1.3.6-double-click-me.exe
  • Size 11.8MB
  • Sample260523-e6nvrscz5r
  • SHA256 5811f8bd2b06831e994af7164b168153b3ab4a3e1b37432ae62fb28f837c5103
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutiontrojan

Malware Config

Signatures

  • Windows security bypass 2 TTPs 3 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Toolscreen-1.3.6-double-click-me.exe
    "C:\Users\Admin\AppData\Local\Temp\Toolscreen-1.3.6-double-click-me.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4344
    • C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query "HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy" /v VerifiedAndReputablePolicyState
      2⤵
        PID:5060
      • C:\Windows\System32\reg.exe
        C:\Windows\System32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
        2⤵
          PID:2492
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { (Get-MpPreference).ExclusionPath | ForEach-Object { $_ } } catch { exit 1 }"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3980
        • C:\Windows\System32\reg.exe
          C:\Windows\System32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
          2⤵
            PID:3376
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { (Get-MpPreference).ExclusionPath | ForEach-Object { $_ } } catch { exit 1 }"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5032
          • C:\Users\Admin\AppData\Local\Temp\Toolscreen-1.3.6-double-click-me.exe
            "C:\Users\Admin\AppData\Local\Temp\Toolscreen-1.3.6-double-click-me.exe" --defender-elevated-ensure "C:\Users\Admin\.config\Toolscreen\dlls" --defender-elevated-selfexe "C:\Users\Admin\AppData\Local\Temp\Toolscreen.exe" --defender-elevated-out "C:\Users\Admin\AppData\Local\Temp\easyinject-defender-out.txt"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1488
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\easyinject-defender-ensure.ps1" -TargetPath "C:\Users\Admin\.config\Toolscreen\dlls" -SelfExePath "C:\Users\Admin\AppData\Local\Temp\Toolscreen.exe" -OutFile "C:\Users\Admin\AppData\Local\Temp\easyinject-defender-out.txt"
              3⤵
              • Windows security bypass
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4712
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:4500

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                powershell.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                • Size 2KB
                • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 2d206e0c67bac38429a3c306e7ab325ef514565e3cf61f5f26bf754946cd1a76
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 0025a82d5c9ef9b1786333fb007e72601dfbf9340d75230f8a3e687e6a107889
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                __PSScriptPolicyTest_gzbxqze1.duw.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gzbxqze1.duw.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                easyinject-defender-ensure.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\easyinject-defender-ensure.ps1
                • Size 2KB
                • SHA256 849cfcff2b2f8cc61f2e8b131933632fa8a5f1534d9fae43756400d541f90026
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                easyinject-defender-out.txt
                • Path C:\Users\Admin\AppData\Local\Temp\easyinject-defender-out.txt
                • Size 43B
                • SHA256 f29b6d92c15a642e23865af77a9c1de1605991e424b8a0cf85db0935bb024a60
                • MD5 SHA1 SHA512
                Submit Download

                memory/3980-1-0x00007FFF75090000-0x00007FFF753E5000-memory.dmp
                Download

                memory/3980-7-0x0000023C697F0000-0x0000023C69812000-memory.dmp
                Download

                memory/3980-12-0x00007FFF75090000-0x00007FFF753E5000-memory.dmp
                Download