f87e88c9ebf0b5c7a7e92b7c093397abce3e78488b4557da404161a4faf8004c

Analysis

user interaction
yes
max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/05/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Lifenz Booster Utility.exe
Size 110KB
Sample260510-cdsl5sa14k
SHA256 f87e88c9ebf0b5c7a7e92b7c093397abce3e78488b4557da404161a4faf8004c
MD5 b712ab811fc10bc72333f92fdab20ee4
SHA1 6544ab0292a7ed95c74fd7af43bfd52dfb32c2b3
SHA512 256c27de023f27b74da2164335f895a5c01974f9e081f26a8c236f1972e71370e440f79cd96f8c9bcd744cad495dc9521cb050caf30c83b1a6250234e5acf989
SSDEEP 3072:c4wL2/G2oxpVevlb42QlfGWzBe+mEKUk:lmovNdG/lbmY
TLSH
T1B3B3F04513A8C95BD2EF4F7D7972261247B1EA022006EB9E0DCD68FFE857B044A117AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 17 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe\PerfOptions\CpuPriorityClass = "1"	Lifenz Booster Utility.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe\PerfOptions\IoPriority = "0"	Lifenz Booster Utility.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe\PerfOptions\PagePriority = "1"	Lifenz Booster Utility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrustedInstaller.exe\PerfOptions	Lifenz Booster Utility.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TiWorker.exe\PerfOptions\IoPriority = "0"	Lifenz Booster Utility.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe\PerfOptions\IoPriority = "0"	Lifenz Booster Utility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe\PerfOptions	Lifenz Booster Utility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	Lifenz Booster Utility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrustedInstaller.exe	Lifenz Booster Utility.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrustedInstaller.exe\PerfOptions\IoPriority = "0"	Lifenz Booster Utility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TiWorker.exe	Lifenz Booster Utility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe\PerfOptions	Lifenz Booster Utility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe	Lifenz Booster Utility.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TiWorker.exe\PerfOptions\CpuPriorityClass = "1"	Lifenz Booster Utility.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe\PerfOptions\CpuPriorityClass = "1"	Lifenz Booster Utility.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrustedInstaller.exe\PerfOptions\CpuPriorityClass = "1"	Lifenz Booster Utility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TiWorker.exe\PerfOptions	Lifenz Booster Utility.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	Lifenz Booster Utility.exe

Power Settings 1 TTPs 18 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1920	powercfg.exe
1680	powercfg.exe
1856	powercfg.exe
5056	powercfg.exe
5084	powercfg.exe
1444	cmd.exe
1604	powercfg.exe
4116	powercfg.exe
2620	powercfg.exe
540	powercfg.exe
2380	powercfg.exe
4580	powercfg.exe
3392	powercfg.exe
2952	powercfg.exe
4992	powercfg.exe
3344	powercfg.exe
3824	powercfg.exe
4164	powercfg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies Control Panel 8 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\Desktop\MenuShowDelay = "0"	Lifenz Booster Utility.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\Mouse\MouseSensitivity = "20"	Lifenz Booster Utility.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\Mouse\MouseSpeed = "0"	Lifenz Booster Utility.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\Mouse\MouseThreshold1 = "0"	Lifenz Booster Utility.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\Mouse\MouseThreshold2 = "0"	Lifenz Booster Utility.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\Desktop\WaitToKillAppTimeout = "2000"	Lifenz Booster Utility.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\Desktop\HungAppTimeout = "2000"	Lifenz Booster Utility.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\Desktop\AutoEndTasks = "1"	Lifenz Booster Utility.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3960	Lifenz Booster Utility.exe
3960	Lifenz Booster Utility.exe
3960	Lifenz Booster Utility.exe
3960	Lifenz Booster Utility.exe
3960	Lifenz Booster Utility.exe
3960	Lifenz Booster Utility.exe
3960	Lifenz Booster Utility.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3960	Lifenz Booster Utility.exe
Token: SeIncreaseQuotaPrivilege	3960	Lifenz Booster Utility.exe
Token: SeSecurityPrivilege	3960	Lifenz Booster Utility.exe
Token: SeTakeOwnershipPrivilege	3960	Lifenz Booster Utility.exe
Token: SeLoadDriverPrivilege	3960	Lifenz Booster Utility.exe
Token: SeSystemProfilePrivilege	3960	Lifenz Booster Utility.exe
Token: SeSystemtimePrivilege	3960	Lifenz Booster Utility.exe
Token: SeProfSingleProcessPrivilege	3960	Lifenz Booster Utility.exe
Token: SeIncBasePriorityPrivilege	3960	Lifenz Booster Utility.exe
Token: SeCreatePagefilePrivilege	3960	Lifenz Booster Utility.exe
Token: SeBackupPrivilege	3960	Lifenz Booster Utility.exe
Token: SeRestorePrivilege	3960	Lifenz Booster Utility.exe
Token: SeShutdownPrivilege	3960	Lifenz Booster Utility.exe
Token: SeDebugPrivilege	3960	Lifenz Booster Utility.exe
Token: SeSystemEnvironmentPrivilege	3960	Lifenz Booster Utility.exe
Token: SeRemoteShutdownPrivilege	3960	Lifenz Booster Utility.exe
Token: SeUndockPrivilege	3960	Lifenz Booster Utility.exe
Token: SeManageVolumePrivilege	3960	Lifenz Booster Utility.exe
Token: 33	3960	Lifenz Booster Utility.exe
Token: 34	3960	Lifenz Booster Utility.exe
Token: 35	3960	Lifenz Booster Utility.exe
Token: 36	3960	Lifenz Booster Utility.exe
Token: SeIncreaseQuotaPrivilege	3960	Lifenz Booster Utility.exe
Token: SeSecurityPrivilege	3960	Lifenz Booster Utility.exe
Token: SeTakeOwnershipPrivilege	3960	Lifenz Booster Utility.exe
Token: SeLoadDriverPrivilege	3960	Lifenz Booster Utility.exe
Token: SeSystemProfilePrivilege	3960	Lifenz Booster Utility.exe
Token: SeSystemtimePrivilege	3960	Lifenz Booster Utility.exe
Token: SeProfSingleProcessPrivilege	3960	Lifenz Booster Utility.exe
Token: SeIncBasePriorityPrivilege	3960	Lifenz Booster Utility.exe
Token: SeCreatePagefilePrivilege	3960	Lifenz Booster Utility.exe
Token: SeBackupPrivilege	3960	Lifenz Booster Utility.exe
Token: SeRestorePrivilege	3960	Lifenz Booster Utility.exe
Token: SeShutdownPrivilege	3960	Lifenz Booster Utility.exe
Token: SeDebugPrivilege	3960	Lifenz Booster Utility.exe
Token: SeSystemEnvironmentPrivilege	3960	Lifenz Booster Utility.exe
Token: SeRemoteShutdownPrivilege	3960	Lifenz Booster Utility.exe
Token: SeUndockPrivilege	3960	Lifenz Booster Utility.exe
Token: SeManageVolumePrivilege	3960	Lifenz Booster Utility.exe
Token: 33	3960	Lifenz Booster Utility.exe
Token: 34	3960	Lifenz Booster Utility.exe
Token: 35	3960	Lifenz Booster Utility.exe
Token: 36	3960	Lifenz Booster Utility.exe
Token: SeIncreaseQuotaPrivilege	3960	Lifenz Booster Utility.exe
Token: SeSecurityPrivilege	3960	Lifenz Booster Utility.exe
Token: SeTakeOwnershipPrivilege	3960	Lifenz Booster Utility.exe
Token: SeLoadDriverPrivilege	3960	Lifenz Booster Utility.exe
Token: SeSystemProfilePrivilege	3960	Lifenz Booster Utility.exe
Token: SeSystemtimePrivilege	3960	Lifenz Booster Utility.exe
Token: SeProfSingleProcessPrivilege	3960	Lifenz Booster Utility.exe
Token: SeIncBasePriorityPrivilege	3960	Lifenz Booster Utility.exe
Token: SeCreatePagefilePrivilege	3960	Lifenz Booster Utility.exe
Token: SeBackupPrivilege	3960	Lifenz Booster Utility.exe
Token: SeRestorePrivilege	3960	Lifenz Booster Utility.exe
Token: SeShutdownPrivilege	3960	Lifenz Booster Utility.exe
Token: SeDebugPrivilege	3960	Lifenz Booster Utility.exe
Token: SeSystemEnvironmentPrivilege	3960	Lifenz Booster Utility.exe
Token: SeRemoteShutdownPrivilege	3960	Lifenz Booster Utility.exe
Token: SeUndockPrivilege	3960	Lifenz Booster Utility.exe
Token: SeManageVolumePrivilege	3960	Lifenz Booster Utility.exe
Token: 33	3960	Lifenz Booster Utility.exe
Token: 34	3960	Lifenz Booster Utility.exe
Token: 35	3960	Lifenz Booster Utility.exe
Token: 36	3960	Lifenz Booster Utility.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 4700	3960	Lifenz Booster Utility.exe	86
PID 4700 wrote to memory of 5104	4700	csc.exe	88
PID 3960 wrote to memory of 2380	3960	Lifenz Booster Utility.exe	101
PID 3960 wrote to memory of 1680	3960	Lifenz Booster Utility.exe	102
PID 3960 wrote to memory of 3344	3960	Lifenz Booster Utility.exe	103
PID 3960 wrote to memory of 5084	3960	Lifenz Booster Utility.exe	104
PID 3960 wrote to memory of 1444	3960	Lifenz Booster Utility.exe	105
PID 1444 wrote to memory of 1856	1444	cmd.exe	107
PID 1444 wrote to memory of 4580	1444	cmd.exe	108
PID 1444 wrote to memory of 3392	1444	cmd.exe	109
PID 1444 wrote to memory of 1604	1444	cmd.exe	110
PID 1444 wrote to memory of 2952	1444	cmd.exe	111
PID 1444 wrote to memory of 4116	1444	cmd.exe	112
PID 1444 wrote to memory of 3824	1444	cmd.exe	113
PID 1444 wrote to memory of 4992	1444	cmd.exe	114
PID 1444 wrote to memory of 4164	1444	cmd.exe	115
PID 1444 wrote to memory of 1920	1444	cmd.exe	116
PID 1444 wrote to memory of 2620	1444	cmd.exe	117
PID 1444 wrote to memory of 5056	1444	cmd.exe	118
PID 3960 wrote to memory of 540	3960	Lifenz Booster Utility.exe	119
PID 3960 wrote to memory of 4348	3960	Lifenz Booster Utility.exe	122
PID 4348 wrote to memory of 1632	4348	cmd.exe	124
PID 4348 wrote to memory of 4896	4348	cmd.exe	125
PID 4348 wrote to memory of 3344	4348	cmd.exe	126
PID 4348 wrote to memory of 2920	4348	cmd.exe	127

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableStartupSound = "1"	Lifenz Booster Utility.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI	Lifenz Booster Utility.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\DisablePasswordReveal = "1"	Lifenz Booster Utility.exe

C:\Users\Admin\AppData\Local\Temp\Lifenz Booster Utility.exe
"C:\Users\Admin\AppData\Local\Temp\Lifenz Booster Utility.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\o34kiavj\o34kiavj.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5697.tmp" "c:\Users\Admin\AppData\Local\Temp\o34kiavj\CSC6124759B262482DBABD74831B7AA5DF.TMP"
    3⤵
    PID:5104
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /list
  2⤵
  - Power Settings
  PID:2380
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /list
  2⤵
  - Power Settings
  PID:1680
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
  2⤵
  - Power Settings
  PID:3344
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /changename 37f649f6-6aba-429b-b278-f8f7b4e87511 "Core Powerplan" "Lifenz Booster Utility 2 — gaming-tuned plan"
  2⤵
  - Power Settings
  PID:5084
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 54533251-82be-4824-96c1-47b60b740d00 893dee8e-2bef-41e0-89c6-b55d0929964c 5 & powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 54533251-82be-4824-96c1-47b60b740d00 bc5038f7-23e0-4960-96da-33abaf5935ec 100 & powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 54533251-82be-4824-96c1-47b60b740d00 be337238-0d82-4146-a960-4f3749d470c7 1 & powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 54533251-82be-4824-96c1-47b60b740d00 45bcc044-d885-43e2-8605-ee0ec6e96b59 60 & powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 54533251-82be-4824-96c1-47b60b740d00 0cc5b647-c1df-4637-891a-dec35c318583 100 & powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 54533251-82be-4824-96c1-47b60b740d00 ea062031-0e34-4ff1-9b6d-eb1059334028 100 & powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 54533251-82be-4824-96c1-47b60b740d00 4d2b0152-7d5c-498b-88e2-34345392a2c5 0 & powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 54533251-82be-4824-96c1-47b60b740d00 94d3a615-a899-4ac5-ae2b-e4d8f634367f 1 & powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 0012ee47-9041-4b5d-9b77-535fba8b1442 6738e2c4-e8a5-4a42-b16a-e040e769756e 0 & powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0 & powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 501a4d13-42af-4429-9fd1-a8218c268e20 ee12f906-d277-404b-b6da-e5fa1a576df5 1 & powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 7516b95f-f776-4464-8c53-06167f40cc99 3c0bc021-c8a8-4e07-a973-6b14cbcb2b7e 0
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\system32\powercfg.exe
    powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 54533251-82be-4824-96c1-47b60b740d00 893dee8e-2bef-41e0-89c6-b55d0929964c 5
    3⤵
    - Power Settings
    PID:1856
- - C:\Windows\system32\powercfg.exe
    powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 54533251-82be-4824-96c1-47b60b740d00 bc5038f7-23e0-4960-96da-33abaf5935ec 100
    3⤵
    - Power Settings
    PID:4580
- - C:\Windows\system32\powercfg.exe
    powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 54533251-82be-4824-96c1-47b60b740d00 be337238-0d82-4146-a960-4f3749d470c7 1
    3⤵
    - Power Settings
    PID:3392
- - C:\Windows\system32\powercfg.exe
    powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 54533251-82be-4824-96c1-47b60b740d00 45bcc044-d885-43e2-8605-ee0ec6e96b59 60
    3⤵
    - Power Settings
    PID:1604
- - C:\Windows\system32\powercfg.exe
    powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 54533251-82be-4824-96c1-47b60b740d00 0cc5b647-c1df-4637-891a-dec35c318583 100
    3⤵
    - Power Settings
    PID:2952
- - C:\Windows\system32\powercfg.exe
    powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 54533251-82be-4824-96c1-47b60b740d00 ea062031-0e34-4ff1-9b6d-eb1059334028 100
    3⤵
    - Power Settings
    PID:4116
- - C:\Windows\system32\powercfg.exe
    powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 54533251-82be-4824-96c1-47b60b740d00 4d2b0152-7d5c-498b-88e2-34345392a2c5 0
    3⤵
    - Power Settings
    PID:3824
- - C:\Windows\system32\powercfg.exe
    powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 54533251-82be-4824-96c1-47b60b740d00 94d3a615-a899-4ac5-ae2b-e4d8f634367f 1
    3⤵
    - Power Settings
    PID:4992
- - C:\Windows\system32\powercfg.exe
    powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 0012ee47-9041-4b5d-9b77-535fba8b1442 6738e2c4-e8a5-4a42-b16a-e040e769756e 0
    3⤵
    - Power Settings
    PID:4164
- - C:\Windows\system32\powercfg.exe
    powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
    3⤵
    - Power Settings
    PID:1920
- - C:\Windows\system32\powercfg.exe
    powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 501a4d13-42af-4429-9fd1-a8218c268e20 ee12f906-d277-404b-b6da-e5fa1a576df5 1
    3⤵
    - Power Settings
    PID:2620
- - C:\Windows\system32\powercfg.exe
    powercfg /setacvalueindex 37f649f6-6aba-429b-b278-f8f7b4e87511 7516b95f-f776-4464-8c53-06167f40cc99 3c0bc021-c8a8-4e07-a973-6b14cbcb2b7e 0
    3⤵
    - Power Settings
    PID:5056
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /setactive 37f649f6-6aba-429b-b278-f8f7b4e87511
  2⤵
  - Power Settings
  PID:540
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c netsh int tcp set global autotuninglevel=normal & netsh int tcp set global rss=enabled & netsh int tcp set global chimney=disabled & netsh int tcp set heuristics disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\system32\netsh.exe
    netsh int tcp set global autotuninglevel=normal
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1632
- - C:\Windows\system32\netsh.exe
    netsh int tcp set global rss=enabled
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4896
- - C:\Windows\system32\netsh.exe
    netsh int tcp set global chimney=disabled
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3344
- - C:\Windows\system32\netsh.exe
    netsh int tcp set heuristics disabled
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

log.txt

Path C:\Users\Admin\AppData\Local\Lifenz\BoosterUtility2\log.txt
Size 4KB
SHA256 af6ed9b20f2d89c7d100881ffc5f32124ad00308a36449938387dae5f5f0bcc7
MD5 eddca7541c18c597d906a0556cd4a545
SHA1 f2a2809b3392344b24e01da6b6ed6977b32879a9
SHA512 c57fb4db674c488536d6199bff64687401b8b03166b3fdb033a5452befb3dd839c8181c9459e9afd1874c62eba99a4d3840781c004800f07867dfee3d44b9229
SSDEEP 48:o+CoVqtvlBiAxQlEeWaQuW7Fo+g7i+47koXt:o+DVEEANPd
TLSH
T1C091AC22B35D6A2B04D117849B99CE507CAA73237266AC04F3E85814BDEBC39DF3E615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.json

Path C:\Users\Admin\AppData\Local\Lifenz\BoosterUtility2\state.json
Size 8KB
SHA256 aa5c422f324b7eaa4049d29745e3f01489220ee779d02a5b3dfa0c3dc3e26457
MD5 270c689c69c0840953cd861009bf918a
SHA1 223866f015b9d8df29edfc86a12d76ffaf750eac
SHA512 18c72076fe739065d97d9ae2d103a53c8b5609b866668bd37e163961ed3cf21309dfcbbf8139f3e22e5953a87b9d5072df2f75da24bd7e10fa94293a8022277d
SSDEEP 192:LSBF+1QBnB+Bz9Ir6WDrdP4fBhHrfGyZxxHChteH5TnTZLnLZLnLYAXznmZr:LSBFKQBnB+Bz9Ir6WDrdP4fBhHrfGyZI
TLSH
T16C02D14C1060CA3DDAD13909A28BBEBB52BC2763F1855D5780CAF608E5E63A24371A77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.json

Path C:\Users\Admin\AppData\Local\Lifenz\BoosterUtility2\state.json
Size 11KB
SHA256 56832a81f2d90f4cb04bef065c6eafa341d2f06591096e3a980272ecfee9bb5c
MD5 b9116c03ee19895b43a2c8e84a54b6b9
SHA1 ebaf8aa795afee5f8e46b71d6f5639d6e0c4cdf3
SHA512 660879535e18636f82c20a78627507f750edc647b13819ef3ea7fab3eddfc609ec504a7bd2f2ea919c0d7b556336206a75548478e27bcd422fd558933a8236c3
SSDEEP 192:LSBF+12kE68QBnB+BKa3T7g/0/enz9IfhzoXR06WDrdP4fBhHrfGyZxxbdHChytf:LSBFK2kE68QBnB+BKa3T7qWenz9Ifhz4
TLSH
T1E532CF4C1030C93DEAE13909A28BBEB753BC66A7F1845D5780CAF608E5E67D24371E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.json

Path C:\Users\Admin\AppData\Local\Lifenz\BoosterUtility2\state.json
Size 13KB
SHA256 d7ba6595d5856472571af5b5f8d1d14fa50599df9eaa1fb0d8996831d124eae5
MD5 b40bb32d12178c792f5f6bb8a6a31213
SHA1 7da69e92cea6cfb388f2e431fe685eee8f2b48e9
SHA512 bbbaa232ef4d7d4f1e173870e518a0f2743dc3a88e4e6c4a9210078d5c3fdae6f51d6e0807580dfb31e8392f03042e9fd6e8d20aa85846f7af21fb9b5f5e2631
SSDEEP 384:nw2+kHrffhzoXtnrzGyZxx4fBnXznmHChQBnB+B+TnTZLnLZLnL2kE68Ss2jdPpf:nXJZiWi1f
TLSH
T1FF52DE0C5030C93DDAE13909A18BBEB753BC66A7F0945D57C0CAB608E5E67E28371D67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.json

Path C:\Users\Admin\AppData\Local\Lifenz\BoosterUtility2\state.json
Size 14KB
SHA256 38f76c1aaf0f113cf76d9db3b9be08ddee19beddb3e9ccc01fc6b8879859aacb
MD5 87599299222a03e9498b631f72271a35
SHA1 b0ad958af1d51b54480495a53318855c83a290f1
SHA512 38851f127d26e225e49f902ac72d43462e9b72cbfc1a9358b4ed098ec008bfb7d07d07df271946ea1ce9b83a71c35937799446d8ded67cf3ef0ac1ec093cfc37
SSDEEP 384:nw2+kHrfACfhzoXtnrzGyZxx4fBnXznmHChQBnB+B+TnTZLnLZLnL2kE68Ss2jdR:n8AJf+iCi7yf
TLSH
T1F262EE0C5030C93DDAE13909A18BBEB793FC66A7F0941D5780CAB608E5E67E28371D67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.json

Path C:\Users\Admin\AppData\Local\Lifenz\BoosterUtility2\state.json
Size 22KB
SHA256 c1fe03abcada2fc40114553176c6d0c3253e1eee478a6989730f15fbccb2d533
MD5 b4a3f37653105752bdfe25c8784b14e5
SHA1 3feff8bffef921e57d197e14e055b9bd81c81a45
SHA512 ef7764d582955a7555f7dd8046aae2ca64393bbcec90fb9ea341691c77b8f8fb59a3501eac87d0c4b8d51740c68bc74dc1c6109f636fc8c9b820f8b0e8d9a9fe
SSDEEP 384:nw2+kHrfACuiGfhzoXtnrzGyZxx4fBnXznm/AAr4ChQBnB+B+TnTZLnLZLnL2kE8:n8NHfYiQ17af
TLSH
T1E6A2F1496070CD3DDAE53D0DB05B7DB762BC6697F0801D5A80CAE708E5E63E283B19A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.json

Path C:\Users\Admin\AppData\Local\Lifenz\BoosterUtility2\state.json
Size 26KB
SHA256 fb7854c0923c44c27d6fd0d913d9cacc962b56c33310d5056e2633ff441c2911
MD5 65fd94096e77db9e81b5ae6f0b01269c
SHA1 1fb45995f8058e636822929ebf4e7ef32d693f88
SHA512 ddb95b619d1949f2b8e7dcbe7310532f5172b581c10347213b9603e0fa7d3678ebaa16c23a0fa9ff64711cfb59c9b702a9d4b084fdc7dce78f6a62ab4cf4169f
SSDEEP 384:nw2+kHrfACF5qa5uE7huiGfhzoXtnrzyGyZxx4fBnXznm/AAr4ChQBnB+B+TnTZ9:n8eHfMiK17yf
TLSH
T15AC2F0096070CD3DDAE53D09B05B7DB7A2BC2697F0841D5780CAE708E5E67E283B19A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.json

Path C:\Users\Admin\AppData\Local\Lifenz\BoosterUtility2\state.json
Size 28KB
SHA256 4c349b6fc11458be624d1657099ee2f9e0b6bb3c8836fed499c1ac547519be40
MD5 f4bedd2c115921c54fa67dc8a7b8c2bc
SHA1 bc7323b05f8a86d08cdb68048419bbe9f454d11f
SHA512 244443488fd1409ba11009ff9ed54eb1f1b1f560c8452da079e34def7fa1f301fe890d13519dd5979972d0e75dcebfe8d6462f563381832d619561a33d4b7d65
SSDEEP 384:nw2+kHrf3ACF5qa5uE7huiGfhzoXtnrzyGyZxx4fBnXznm/AAr4ChQBnB+B+TnTK:nEeHf5wiR17Of
TLSH
T1D2D200086070CD3DDAE53D08B15B7DB7A2EC6693F1841D5780CAEB08E5E67E283719A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES5697.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5697.tmp
Size 1KB
SHA256 99ee96b31d08002a3b08857b8ff91ae3d1f8a522fdf8672c18ec7924b79b1d77
MD5 4958c51d857f48b657965c265e07f040
SHA1 4e28fa46fa1e0e6c2a8d4bfde2b3ad7a944ec7be
SHA512 40f3e4e7eb31681e281daaa51ef9dccd137abe05ae80e402d7a22798985f01b6e1df759ab07b55956f527dab883b30ad3b8f50b68bcb91acbb789ca57e961daf
TLSH
T17D216A0483E8474AF0B3573279F5172BA268FDA9AFA1935F894142281851114EEE0F73
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_thcbbdav.zfw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_thcbbdav.zfw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

o34kiavj.dll

Path C:\Users\Admin\AppData\Local\Temp\o34kiavj\o34kiavj.dll
Size 25KB
SHA256 22ee3df00ff7701efed6f8eeb103ea85244e113924b8830e5fc2ec9f5383ad27
MD5 03478664b4607ed2b20237c5f2b425c0
SHA1 075c42767c5f114795e1f99d907f0d617176884f
SHA512 b55039a7afd822fc6823be4f2f48d24d2619e38497451aa0a5086010b551832caa228591c9e00764b343b7a51807a5997aa2b3ba8ec671b3688b587e59096f2b
SSDEEP 384:3PW32OZ1S3Q7b5KeR6oCSCIII/Ma3+aWTrohkl8wd/gVel5R2DUSVgrXxD:382V6bMoaSCP+KU/eZwaBD
TLSH
T15FB2191BA7D87175E2AE073994B20629B3B0D16B4623BF4709DD44742EBB3EC87097E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC6124759B262482DBABD74831B7AA5DF.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\o34kiavj\CSC6124759B262482DBABD74831B7AA5DF.TMP
Size 652B
SHA256 97534e35e464cb64a068db9200e6fc233e8376735800d1b38c69b2103a8218cc
MD5 f8e5180f6dfa9572daa786eb2a367d70
SHA1 728eebda4c610207b3ca036e1f708b2b97b208c2
SHA512 33317478ac59b88e2e65ba72f704d08382fa146867c852d052590ef9347dd609c39ee069d6852c428d376a2598c2a07ca1426590e9bcd5186630ae9d8e8b5a72
TLSH
T134F05E09A3F8020EF0F34B31BDF6437391A8BC66DE7293ED1940435968645149AA2FB3
MD5 SHA1 SHA512 TLSH

Submit Download

o34kiavj.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\o34kiavj\o34kiavj.0.cs
Size 49KB
SHA256 d33fe645da8fbf81028ceb2acf4fc328e33b7c9a02ea128deb213ab925db4b64
MD5 a9a35bc6944ffe7aa66729893990d9ef
SHA1 cfad397e4fd8ed7f4999409a265e58ebb1e2cf7a
SHA512 bc8cd9d134833f825265adc81247864a88e217835c9bbada394f2550c2b4825cd9d5ab18b1a3f74f58e05e4778c8e889df0729f4d062bddb44ff45189ca88733
SSDEEP 384:1lv0OhQ036hWlo+dbcwVm7iiYxGsNJY5N38KeYFIksKjoiiW2JO3AWmRCU2GH+kj:w038io+deHEoeYF+Oio3AWmxzW3G
TLSH
T17533A6451A03D9355293242E9FEE890DF323D03326BAFD24B95F47A0AF4672483B975E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

o34kiavj.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\o34kiavj\o34kiavj.cmdline
Size 369B
SHA256 f8b26f7a4c6c1c15c4c422d17176153761a1c022a0c2d536639b9e066c51e640
MD5 76711a6ce58ade1f1ccba89b24274d10
SHA1 59ab2bac6d314756f0344cd6a09eab20b6a43674
SHA512 3ac26584bbe387b76e28201ecba25369dbb62a5a932fa9429e3805a3d09b63e8f37fed3e07605093899830d2061d95979ef01c5b16f75578aad3d3b609a57441
TLSH
T1B5E0682AC346C2BE02D9100F2169C4AC927B0A4739403F9CA991484DD0670022BD1B41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3960-40-0x0000000001580000-0x0000000001590000-memory.dmp

Download

memory/3960-44-0x0000000001580000-0x0000000001590000-memory.dmp

Download

memory/3960-31-0x0000000021C80000-0x0000000021C88000-memory.dmp

Download

memory/3960-32-0x0000000021DF0000-0x0000000021E28000-memory.dmp

Download

memory/3960-33-0x0000000021DB0000-0x0000000021DBE000-memory.dmp

Download

memory/3960-34-0x0000000001580000-0x0000000001590000-memory.dmp

Download

memory/3960-35-0x0000000001580000-0x0000000001590000-memory.dmp

Download

memory/3960-36-0x0000000001580000-0x0000000001590000-memory.dmp

Download

memory/3960-37-0x00000000013C0000-0x00000000013CC000-memory.dmp

Download

memory/3960-38-0x0000000001580000-0x0000000001590000-memory.dmp

Download

memory/3960-39-0x0000000001580000-0x0000000001590000-memory.dmp

Download

memory/3960-24-0x0000000001590000-0x000000000159C000-memory.dmp

Download

memory/3960-41-0x0000000001580000-0x0000000001590000-memory.dmp

Download

memory/3960-28-0x0000000001580000-0x0000000001590000-memory.dmp

Download

memory/3960-60-0x000000001E390000-0x000000001E552000-memory.dmp

Download

memory/3960-61-0x0000000027AA0000-0x0000000027FC8000-memory.dmp

Download

memory/3960-0-0x0000000000C10000-0x0000000000C32000-memory.dmp

Download

memory/3960-8-0x0000000001580000-0x0000000001590000-memory.dmp

Download

memory/3960-133-0x000000001D5D0000-0x000000001D5E6000-memory.dmp

Download

memory/3960-134-0x000000001D5C0000-0x000000001D5CA000-memory.dmp

Download

memory/3960-135-0x000000001E310000-0x000000001E336000-memory.dmp

Download

memory/3960-9-0x00000000015C0000-0x00000000015E2000-memory.dmp

Download

memory/3960-27-0x0000000001580000-0x0000000001590000-memory.dmp

Download

memory/3960-26-0x000000001D140000-0x000000001D164000-memory.dmp

Download

memory/3960-25-0x000000001D140000-0x000000001D16A000-memory.dmp

Download

memory/4700-22-0x00000241D1910000-0x00000241D191C000-memory.dmp

Download

memory/5104-19-0x0000025EB5570000-0x0000025EB557C000-memory.dmp

Download