psr.exe

  • File Path: C:\Windows\SysWOW64\psr.exe
  • Description: Steps Recorder

Hashes

Type Hash
MD5 3117B8F9AF28E7E720739A2C13F919C2
SHA1 8B5D904B77B061B2100374D6B98DB276459352D3
SHA256 4092750B7E9792B6D6CC9D3599B2EBE40BC5D797E51A05985C3CDE4CE4095DC4
SHA384 A40D1D0EAF912DB55DC9E435CFC0EAE29A7C576048F5B49804BD5A4D60A90626C252E81A046B29BC6E8EA81763311541
SHA512 D85338EB07F7B6A3484EA5A283B3AD68B3B4CDE982054F23036EF832AA3588B7B49B37866B29F65168E5CA32E88D630AB166CF1E449F772A0FCA0715D05A609E
SSDEEP 3072:FWnjIUy51jrku1O/dUNVNv8NDKt93Bgk/3MlgLnBMO3034A20HvBrg7bsJt2:AnUUy51jr5O/6NVNv8e9zdFMOk34A3PQ
IMP A4D09DAF661F529D8CFB9BB71F32E84E
PESHA1 99F48C90EB246FA10142A20840497C7C79BA2C94
PE256 D1AD878987E071B64BFA089D8DB7FC4AAB31682CCFAA768F247680018BEEDDBA

Runtime Data

Window Title:

Steps Recorder Error

Open Handles:

Path Type
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\en-US\psr.exe.mui File
(R-D) C:\Windows\SystemResources\imageres.dll.mun File
(RW-) C:\Users\user File
(RW-) C:\Windows File
(RW-) C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.488_none_11b1e5df2ffd8627 File
(RW-) C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.685_none_4299dbb28a92ae3e File
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2 Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\Sessions\1\Windows\Theme1175649999 Section
\Windows\Theme601709542 Section

Loaded Modules:

Path
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll
C:\Windows\SysWOW64\psr.exe

Signature

  • Status: Signature verified.
  • Serial: 330000023241FB59996DCC4DFF000000000232
  • Thumbprint: FF82BC38E1DA5E596DF374C53E3617F7EDA36B06
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: psr.exe
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/74
  • VirusTotal Link: https://www.virustotal.com/gui/file/4092750b7e9792b6d6cc9d3599b2ebe40bc5d797e51a05985c3cde4ce4095dc4/detection

Possible Misuse

The following table contains possible examples of psr.exe being misused. While psr.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_susp_psr_capture_screenshots.yml title: Psr.exe Capture Screenshots DRL 1.0
sigma proc_creation_win_susp_psr_capture_screenshots.yml description: The psr.exe captures desktop screenshots and saves them on the local machine DRL 1.0
sigma proc_creation_win_susp_psr_capture_screenshots.yml Image\|endswith: '\Psr.exe' DRL 1.0
LOLBAS Psr.yml Name: Psr.exe  
LOLBAS Psr.yml - Command: psr.exe /start /gui 0 /output c:\users\user\out.zip  
LOLBAS Psr.yml - Command: psr.exe /start /maxsc 100 /gui 0 /output c:\users\user\out.zip  
LOLBAS Psr.yml - Command: psr.exe /stop  
LOLBAS Psr.yml - C:\Windows\System32\Psr.exe  
LOLBAS Psr.yml - C:\Windows\SysWOW64\Psr.exe  
LOLBAS Psr.yml Name: Psr.exe  
LOLBAS Psr.yml - Command: psr.exe /start /output D:\test.zip /sc 1 /gui 0  
LOLBAS Psr.yml Description: Record a user screen without creating a GUI. You should use "psr.exe /stop" to stop recording and create output file.  
LOLBAS Psr.yml - Path: c:\windows\system32\psr.exe  
LOLBAS Psr.yml - Path: c:\windows\syswow64\psr.exe  
LOLBAS Psr.yml - IOC: psr.exe spawned  
atomic-red-team T1113.md Use Psr.exe binary to collect screenshots of user display. Test will do left mouse click to simulate user behaviour MIT License. © 2018 Red Canary
atomic-red-team T1113.md cmd /c start /b psr.exe /start /output #{output_file} /sc 1 /gui 0 /stopevent 12 MIT License. © 2018 Red Canary
atomic-red-team T1113.md cmd /c “timeout #{recording_time} > NULL && psr.exe /stop” MIT License. © 2018 Red Canary

MIT License. Copyright (c) 2020-2021 Strontic.