39449d7615b3cd4c3b8e55d9d3a2f10cddaabe30e9b4487f85f13d96a4fc2e76

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
boxing.exe
Size 82.8MB
Sample260528-b79bbaez6w
SHA256 39449d7615b3cd4c3b8e55d9d3a2f10cddaabe30e9b4487f85f13d96a4fc2e76
MD5 e778ba974f686785b3aab691b3e96058
SHA1 e67ca7a39c064fb8d1e02b3b9c270dc6359fc571
SHA512 3876def13a3eaa643ca49a116a365912853de965eedfb1a94f5d85430c6d3a39846d47ee246e034dfbe010844a4fdc3abce46c3b55486ac4e1d0879e047a7896
SSDEEP 786432:IVb5kVFll9iFx/l21oXFExFB1VM8US1Srh1ROdfN5ZYdxB8hmd9NF+Z2zZoDA/Zs:iJ9AD
TLSH
T13C182805BA9BA9ADD45AC8B0834A4A236E2130DB0735B9FF45D446353F7EBF41B3C618
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\symbols\dll\user32.pdb	boxing.exe
File opened for modification	C:\Windows\System32\win32u.pdb	boxing.exe
File opened for modification	C:\Windows\System32\dll\win32u.pdb	boxing.exe
File opened for modification	C:\Windows\System32\symbols\exe\main.pdb	boxing.exe
File opened for modification	C:\Windows\SYSTEM32\DLL\kernel32.pdb	boxing.exe
File opened for modification	C:\Windows\SYSTEM32\symbols\DLL\kernel32.pdb	boxing.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	boxing.exe
File opened for modification	C:\Windows\SYSTEM32\symbols\dll\ntdll.pdb	boxing.exe
File opened for modification	C:\Windows\SYSTEM32\user32.pdb	boxing.exe
File opened for modification	C:\Windows\SYSTEM32\symbols\dll\user32.pdb	boxing.exe
File opened for modification	C:\Windows\system32\user32.pdb	boxing.exe
File opened for modification	C:\Windows\System32\exe\main.pdb	boxing.exe
File opened for modification	C:\Windows\SYSTEM32\kernel32.pdb	boxing.exe
File opened for modification	C:\Windows\System32\ntdll.pdb	boxing.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	boxing.exe
File opened for modification	C:\Windows\SYSTEM32\dll\user32.pdb	boxing.exe
File opened for modification	C:\Windows\System32\dll\user32.pdb	boxing.exe
File opened for modification	C:\Windows\system32\dll\user32.pdb	boxing.exe
File opened for modification	C:\Windows\system32\symbols\dll\user32.pdb	boxing.exe
File opened for modification	C:\Windows\SYSTEM32\symbols\exe\main.pdb	boxing.exe
File opened for modification	C:\Windows\SYSTEM32\ntdll.pdb	boxing.exe
File opened for modification	C:\Windows\System32\user32.pdb	boxing.exe
File opened for modification	C:\Windows\SYSTEM32\dll\win32u.pdb	boxing.exe
File opened for modification	C:\Windows\SYSTEM32\exe\main.pdb	boxing.exe
File opened for modification	C:\Windows\system32\main.pdb	boxing.exe
File opened for modification	C:\Windows\system32\exe\main.pdb	boxing.exe
File opened for modification	C:\Windows\System32\DLL\kernel32.pdb	boxing.exe
File opened for modification	C:\Windows\System32\symbols\dll\ntdll.pdb	boxing.exe
File opened for modification	C:\Windows\SYSTEM32\win32u.pdb	boxing.exe
File opened for modification	C:\Windows\SYSTEM32\symbols\dll\win32u.pdb	boxing.exe
File opened for modification	C:\Windows\System32\symbols\dll\win32u.pdb	boxing.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	boxing.exe
File opened for modification	C:\Windows\System32\main.pdb	boxing.exe
File opened for modification	C:\Windows\SYSTEM32\dll\ntdll.pdb	boxing.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	boxing.exe
File opened for modification	C:\Windows\system32\dll\win32u.pdb	boxing.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	boxing.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	boxing.exe
File opened for modification	C:\Windows\System32\dll\ntdll.pdb	boxing.exe
File opened for modification	C:\Windows\system32\win32u.pdb	boxing.exe
File opened for modification	C:\Windows\system32\symbols\dll\win32u.pdb	boxing.exe
File opened for modification	C:\Windows\SYSTEM32\main.pdb	boxing.exe
File opened for modification	C:\Windows\system32\symbols\exe\main.pdb	boxing.exe
File opened for modification	C:\Windows\System32\kernel32.pdb	boxing.exe
File opened for modification	C:\Windows\System32\symbols\DLL\kernel32.pdb	boxing.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	boxing.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	boxing.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	boxing.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	boxing.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4396	boxing.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4396	boxing.exe

C:\Users\Admin\AppData\Local\Temp\boxing.exe
"C:\Users\Admin\AppData\Local\Temp\boxing.exe"
1⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crash.log

Path C:\Users\Admin\AppData\Local\Temp\crash.log
Size 5KB
SHA256 89b944f8e3d10edc073f3e04620019b630edd5fd879aab63323a1b7891c62b71
MD5 2f11ff69e2e58fd96d07c0b71b81ca96
SHA1 57949a4651fdf90aca45c199005110aeb4afeb9f
SHA512 366cf7e0d0c7790d1e87d66a1dc379d07cc70532aef8939faba4f6ca833a0ae00c14e82d0cde3e8fe8747b115591e4224718336d3700bc1b6c4677d2363188fc
SSDEEP 96:H/dOqd9EMeQSdYf29Y3CpDwDeY927UpCV29Y3CpDwDeY927UpC3gllgD7CJWb4d4:H/dOqd9EdQSGbIrxe
TLSH
T1C1B1A65199E9ABF9571C03B83CD103D88056D30EC3A91FB98ACA7F92485B35B731D28B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4396-0-0x0000022BD22D0000-0x0000022BD22D1000-memory.dmp

Download

memory/4396-1-0x0000022BD22D0000-0x0000022BD22D1000-memory.dmp

Download

memory/4396-2-0x0000022BD22D0000-0x0000022BD22D1000-memory.dmp

Download

memory/4396-125-0x0000022BD22D0000-0x0000022BD22D1000-memory.dmp

Download

memory/4396-124-0x0000022BD22D0000-0x0000022BD22D1000-memory.dmp

Download

memory/4396-123-0x0000022BD22D0000-0x0000022BD22D1000-memory.dmp

Download

memory/4396-122-0x0000022BD22D0000-0x0000022BD22D1000-memory.dmp

Download

memory/4396-121-0x0000022BD22D0000-0x0000022BD22D1000-memory.dmp

Download

memory/4396-120-0x0000022BD22D0000-0x0000022BD22D1000-memory.dmp

Download

memory/4396-119-0x0000022BD22D0000-0x0000022BD22D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads