psr.exe

  • File Path: C:\Windows\system32\psr.exe
  • Description: Steps Recorder

Hashes

Type Hash
MD5 AD53EAD5379985081B7C3F1F357E545A
SHA1 6F5AA32C1D15FBF073558FADAFD046D97B60184E
SHA256 4F0144F0E3E721B44BABBF41B513942E4117F730546105480571F9C8FCE56A1F
SHA384 33A6407776AA332373F2435C6B4811D278E8564580A59C528228975E0BE95BCEDF2A9F329EA727C7BEDFC193FD8A480C
SHA512 433098BD74C34FBADFA447EF45CFA9DC076AEF4CF7F2A0A6FE79D5E67F2504EEBE8AA31FC1B7A4C5EEB20EDE2C5485F75AD0FD77B4ECBA3D68CA63313E6F6EA0
SSDEEP 6144:4L4XIiZNNbLfYhTREhgXhW7LygUovIARZ8:4L4XBtwTR5XhMLyg6ARa
IMP CE85341362AC483FF77CC7E0BBB03ABF
PESHA1 55B40A48730433B7F6B652415984A25C53C03626
PE256 07EB52F9E4F7823BBB856F82138E321981ACF2142299EA18DEFF8FEBCBF322BF

Runtime Data

Window Title:

Steps Recorder Error

Open Handles:

Path Type
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\en-US\psr.exe.mui File
(R-D) C:\Windows\SystemResources\imageres.dll.mun File
(RW-) C:\Users\user File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.1320_none_91a11828cc8ae445 File
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2 Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\Sessions\1\Windows\Theme449731986 Section
\Windows\Theme1396518710 Section

Loaded Modules:

Path
C:\Windows\System32\ADVAPI32.dll
C:\Windows\System32\GDI32.dll
C:\Windows\System32\gdi32full.dll
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\System32\msvcp_win.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\system32\psr.exe
C:\Windows\System32\RPCRT4.dll
C:\Windows\System32\sechost.dll
C:\Windows\System32\ucrtbase.dll
C:\Windows\System32\USER32.dll
C:\Windows\System32\win32u.dll

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: psr.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/73
  • VirusTotal Link: https://www.virustotal.com/gui/file/4f0144f0e3e721b44babbf41b513942e4117f730546105480571f9c8fce56a1f/detection

Possible Misuse

The following table contains possible examples of psr.exe being misused. While psr.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_susp_psr_capture_screenshots.yml title: Psr.exe Capture Screenshots DRL 1.0
sigma proc_creation_win_susp_psr_capture_screenshots.yml description: The psr.exe captures desktop screenshots and saves them on the local machine DRL 1.0
sigma proc_creation_win_susp_psr_capture_screenshots.yml Image\|endswith: '\Psr.exe' DRL 1.0
LOLBAS Psr.yml Name: Psr.exe  
LOLBAS Psr.yml - Command: psr.exe /start /gui 0 /output c:\users\user\out.zip  
LOLBAS Psr.yml - Command: psr.exe /start /maxsc 100 /gui 0 /output c:\users\user\out.zip  
LOLBAS Psr.yml - Command: psr.exe /stop  
LOLBAS Psr.yml - C:\Windows\System32\Psr.exe  
LOLBAS Psr.yml - C:\Windows\SysWOW64\Psr.exe  
LOLBAS Psr.yml Name: Psr.exe  
LOLBAS Psr.yml - Command: psr.exe /start /output D:\test.zip /sc 1 /gui 0  
LOLBAS Psr.yml Description: Record a user screen without creating a GUI. You should use "psr.exe /stop" to stop recording and create output file.  
LOLBAS Psr.yml - Path: c:\windows\system32\psr.exe  
LOLBAS Psr.yml - Path: c:\windows\syswow64\psr.exe  
LOLBAS Psr.yml - IOC: psr.exe spawned  
atomic-red-team T1113.md Use Psr.exe binary to collect screenshots of user display. Test will do left mouse click to simulate user behaviour MIT License. © 2018 Red Canary
atomic-red-team T1113.md cmd /c start /b psr.exe /start /output #{output_file} /sc 1 /gui 0 /stopevent 12 MIT License. © 2018 Red Canary
atomic-red-team T1113.md cmd /c “timeout #{recording_time} > NULL && psr.exe /stop” MIT License. © 2018 Red Canary

MIT License. Copyright (c) 2020-2021 Strontic.