Analysis
- max time kernel
115s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
26/06/2026, 07:56
General
- Target _59d7669d35b5ab90a327d7fdd4b2b4b51d2327432a40791643cb639320bb0500.exe
- Size 6.9MB
- Sample260626-jsrfysaw3p
- SHA256 59d7669d35b5ab90a327d7fdd4b2b4b51d2327432a40791643cb639320bb0500
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 2 IoCs
- UPX packed file 50 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies data under HKEY_USERS 1 IoCs
- Modifies registry class 7 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 5 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\_59d7669d35b5ab90a327d7fdd4b2b4b51d2327432a40791643cb639320bb0500.exe"C:\Users\Admin\AppData\Local\Temp\_59d7669d35b5ab90a327d7fdd4b2b4b51d2327432a40791643cb639320bb0500.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_59d7669d35b5ab90a327d7fdd4b2b4b51d2327432a40791643cb639320bb0500.exe"C:\Users\Admin\AppData\Local\Temp\_59d7669d35b5ab90a327d7fdd4b2b4b51d2327432a40791643cb639320bb0500.exe" -gpipe \\.\pipe\PCommand97kxcpszixqprnkznz1 -gui2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\_59d7669d35b5ab90a327d7fdd4b2b4b51d2327432a40791643cb639320bb0500.exe"C:\Users\Admin\AppData\Local\Temp\_59d7669d35b5ab90a327d7fdd4b2b4b51d2327432a40791643cb639320bb0500.exe" -cpipe \\.\pipe\PCommand96vnonawaajgokyxuk -cmem 0000pipe0PCommand96vnonawaajgokyxukvcaf7dfcsa5orvs -child2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\_59d7669d35b5ab90a327d7fdd4b2b4b51d2327432a40791643cb639320bb0500.exe"C:\Users\Admin\AppData\Local\Temp\_59d7669d35b5ab90a327d7fdd4b2b4b51d2327432a40791643cb639320bb0500.exe" -cpipe \\.\pipe\PCommand96vnonawaajgokyxuk -cmem 0000pipe0PCommand96vnonawaajgokyxukqsmr2pw4p0ez7t0 -child2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\_59d7669d35b5ab90a327d7fdd4b2b4b51d2327432a40791643cb639320bb0500.exe"C:\Users\Admin\AppData\Local\Temp\_59d7669d35b5ab90a327d7fdd4b2b4b51d2327432a40791643cb639320bb0500.exe" -epipe \\.\pipe\PCommand98yedkenskxtrctpsr -environment2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\_59d7669d35b5ab90a327d7fdd4b2b4b51d2327432a40791643cb639320bb0500.exe"C:\Users\Admin\AppData\Local\Temp\_59d7669d35b5ab90a327d7fdd4b2b4b51d2327432a40791643cb639320bb0500.exe" -cpipe \\.\pipe\PCommand96vnonawaajgokyxuk -cmem 0000pipe0PCommand96vnonawaajgokyxukpptjiqp0mi4d0z9 -child2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
-
-
C:\ProgramData\getscreen\turbo\getscreen.exe"C:\ProgramData\getscreen\turbo\getscreen.exe" -install2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Getscreen.me\seuoxgvsjqvneknplhkuzsaijvjsbeub-elevate.exe"C:\ProgramData\Getscreen.me\seuoxgvsjqvneknplhkuzsaijvjsbeub-elevate.exe" -elevate \\.\pipe\elevateGS512seuoxgvsjqvneknplhkuzsaijvjsbeub1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Getscreen.me\getscreen.exe"C:\Program Files (x86)\Getscreen.me\getscreen.exe" -service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Getscreen.me\getscreen.exe"C:\Program Files (x86)\Getscreen.me\getscreen.exe" -cpipe \\.\pipe\PCommand96Getscreen.me -cmem 0000pipe0PCommand96Getscreen0me0opyt4wy44etp99 -child2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Getscreen.me\getscreen.exe"C:\Program Files (x86)\Getscreen.me\getscreen.exe" -gpipe \\.\pipe\PCommand99Getscreen.me1 -guihide2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
20260626.log
20260626.capture.log
20260626.capture.log
20260626.gui.log
20260626.log
20260626.log
20260626.log
20260626.log
20260626.log
0000pipe0PCommand96vnonawaajgokyxukvcaf7dfcsa5orvs
settings.dat
seuoxgvsjqvneknplhkuzsaijvjsbeub-elevate.exe
getscreen.exe
settings.dat
memory/1160-14-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/1160-18-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/1196-55-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/1204-122-0x0000000000520000-0x00000000025D4000-memory.dmp
memory/1204-117-0x0000000000520000-0x00000000025D4000-memory.dmp
memory/1204-112-0x0000000000520000-0x00000000025D4000-memory.dmp
memory/1204-127-0x0000000000520000-0x00000000025D4000-memory.dmp
memory/1532-60-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/3172-5-0x0000000000D50000-0x0000000002E04000-memory.dmp
memory/3172-8-0x0000000000D50000-0x0000000002E04000-memory.dmp
memory/4088-24-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/4088-63-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/4088-116-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/4088-26-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/4088-57-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/4088-109-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/4088-28-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/4088-13-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/4088-15-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/4088-30-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/4088-121-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/4088-22-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/4088-66-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/4088-20-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/4088-126-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/4848-115-0x0000000000520000-0x00000000025D4000-memory.dmp
memory/5028-105-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/5028-125-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/5028-65-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/5028-119-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/5028-114-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/5224-108-0x0000000000520000-0x00000000025D4000-memory.dmp
memory/5952-29-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/5952-25-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/5952-56-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/5952-113-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/5952-0-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/5952-82-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/5952-27-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/5952-58-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/5952-118-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/5952-64-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/5952-23-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/5952-21-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/5952-123-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/5952-12-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/5952-19-0x00000000009F0000-0x0000000002AA4000-memory.dmp
memory/6084-77-0x0000000000E10000-0x0000000002EC4000-memory.dmp