Analysis
- user interaction
yes - max time kernel
17s - max time network
19s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
07/05/2026, 22:37
Errors
General
- Target Step on my pc/Step on my pc.exe
- Size 65.6MB
- Sample260507-2j96tabt7s
- SHA256 a6438b41a9ad8aee18e8a385275182c70fe68b0a30c4df693194ed78ee85181c
Malware Config
Signatures
- Disables Task Manager via registry modification
- Drops startup file 1 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 15 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Step on my pc\Step on my pc.exe"C:\Users\Admin\AppData\Local\Temp\Step on my pc\Step on my pc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\wscript.exe"wscript.exe" "C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs"2⤵
- Drops startup file
-
-
C:\Windows\SYSTEM32\shutdown.exe"shutdown.exe" /r /t 5 /f /c "System restart required to complete setup"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\PROGRA~3\EKmeow\BooruOverlay.exeC:\PROGRA~3\EKmeow\BOORUO~1.EXE1⤵
- Executes dropped EXE
-
C:\ProgramData\EKmeow\BooruOverlay.exeC:\ProgramData\EKmeow\BooruOverlay.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\PickerHost.exeC:\Windows\System32\PickerHost.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a1f055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
BooruOverlay.deps.json
BooruOverlay.dll
BooruOverlay.runtimeconfig.json
BooruOverlay.exe
createshortcut.vbs
memory/1480-30-0x00000248D6F30000-0x00000248D7006000-memory.dmp
memory/1516-19-0x000001EF69AF0000-0x000001EF69AFC000-memory.dmp
memory/2252-28-0x0000022C5EAA0000-0x0000022C5EB76000-memory.dmp
memory/3704-17-0x00000233BFA00000-0x00000233BFA0C000-memory.dmp
memory/3704-21-0x00000233BFA00000-0x00000233BFA0C000-memory.dmp
memory/3704-20-0x000001F326D60000-0x000001F326E36000-memory.dmp
memory/3704-18-0x00000233C2580000-0x00000233C2592000-memory.dmp
memory/3704-15-0x000001F326D60000-0x000001F326E36000-memory.dmp
memory/4488-29-0x0000026B5DB90000-0x0000026B5DC66000-memory.dmp