Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
20/06/2026, 00:16
General
- Target getscreen.exe
- Size 8.9MB
- Sample260620-akww2act4n
- SHA256 a3b3e45b2652c5451b6c4c3fe6f33e7eb1edad35a0ba88d93f86a57465306f13
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- UPX packed file 36 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\getscreen.exe"C:\Users\Admin\AppData\Local\Temp\getscreen.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\getscreen.exe"C:\Users\Admin\AppData\Local\Temp\getscreen.exe" -gpipe \\.\pipe\PCommand97Getscreen.me1 -gui2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\getscreen.exe"C:\Users\Admin\AppData\Local\Temp\getscreen.exe" -cpipe \\.\pipe\PCommand96Getscreen.me -cmem 0000pipe0PCommand96Getscreen0mevvi4spumy07smzw -child2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\getscreen.exe"C:\Users\Admin\AppData\Local\Temp\getscreen.exe" -cpipe \\.\pipe\PCommand96Getscreen.me -cmem 0000pipe0PCommand96Getscreen0mekwzm0e38md1akp1 -child2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\ProgramData\Getscreen.me\tnaxhzzocrzmmflhduracaqawanfnujx-elevate.exe"C:\ProgramData\Getscreen.me\tnaxhzzocrzmmflhduracaqawanfnujx-elevate.exe" -elevate \\.\pipe\elevateGS512tnaxhzzocrzmmflhduracaqawanfnujx1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
20260620.capture.log
20260620.log
20260620.log
20260620.log
0000pipe0PCommand96Getscreen0mevvi4spumy07smzw
settings.dat
tnaxhzzocrzmmflhduracaqawanfnujx-elevate.exe
settings.dat
memory/1984-57-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/1984-24-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/1984-69-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/1984-67-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/1984-65-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/1984-20-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/1984-63-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/1984-22-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/1984-61-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/1984-13-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/1984-59-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/1984-26-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/1984-30-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/1984-28-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/4448-5-0x00007FF772520000-0x00007FF774A89000-memory.dmp
memory/4448-8-0x00007FF772520000-0x00007FF774A89000-memory.dmp
memory/4960-55-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/5156-12-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/5156-23-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/5156-29-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/5156-27-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/5156-56-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/5156-0-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/5156-58-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/5156-25-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/5156-60-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/5156-15-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/5156-62-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/5156-21-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/5156-64-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/5156-19-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/5156-66-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/5156-68-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/5264-18-0x00007FF606240000-0x00007FF6087A9000-memory.dmp
memory/5264-14-0x00007FF606240000-0x00007FF6087A9000-memory.dmp