Analysis
- max time kernel
614s - max time network
465s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/08/2026, 00:49
Errors
General
- Target WinScreenFix/WinScreenFix.exe
- Size 1.2MB
- Sample260805-a6rt7sbb96
- SHA256 a26cfa10face75f2def36c530204c7d95c492ff3c947c1413111828bb58d12f0
Malware Config
Signatures
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WinScreenFix\WinScreenFix.exe"C:\Users\Admin\AppData\Local\Temp\WinScreenFix\WinScreenFix.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004DC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
wallpaper_temp.jpeg
memory/4112-382-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-379-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-140-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-253-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-361-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-362-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-363-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-364-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-367-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-370-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-371-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-372-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-373-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-376-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-377-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-378-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-0-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-380-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-16-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-381-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-386-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-384-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-385-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-383-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-387-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-388-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-389-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-390-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-391-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-392-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-393-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-396-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-397-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-400-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-403-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-406-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-409-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-412-0x00007FF67D480000-0x00007FF67D542000-memory.dmp
memory/4112-415-0x00007FF67D480000-0x00007FF67D542000-memory.dmp