Analysis
- user interaction
yes - max time kernel
615s - max time network
560s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
05/08/2026, 00:49
Errors
General
- Target WinScreenFix/WinScreenFix.exe
- Size 1.2MB
- Sample260805-a6rt7sbb96
- SHA256 a26cfa10face75f2def36c530204c7d95c492ff3c947c1413111828bb58d12f0
Malware Config
Signatures
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WinScreenFix\WinScreenFix.exe"C:\Users\Admin\AppData\Local\Temp\WinScreenFix\WinScreenFix.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4fc 0x3081⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
wallpaper_temp.jpeg
memory/2544-271-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-268-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-88-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-172-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-250-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-251-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-252-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-253-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-256-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-259-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-260-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-261-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-262-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-265-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-266-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-267-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-0-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-269-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-10-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-270-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-275-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-273-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-274-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-272-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-276-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-277-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-278-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-279-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-280-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-281-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-282-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-283-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-284-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-287-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-290-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-293-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-296-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-299-0x00007FF64B060000-0x00007FF64B122000-memory.dmp
memory/2544-302-0x00007FF64B060000-0x00007FF64B122000-memory.dmp