0df513e001320b7a3b29ad81189a1bd49ec3e6da1281fdf41b3f67be65c37389

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
boykisser.exe
Size 3.0MB
Sample260701-fa5zvaev6q
SHA256 0df513e001320b7a3b29ad81189a1bd49ec3e6da1281fdf41b3f67be65c37389
MD5 4fa708c6cafb249c1895175bd0434c0c
SHA1 fd62286ad01ad3801cd0d42869c76c59d5ed8efe
SHA512 4c889d2e6a964d0a74aaf7649a44d5eb31b6fde365d0f600a2ae64486c38b7f4bca674d98a0398f858be36f6ed7ea18e706654eb868a6ed6f2bb1bd51d7dc391
SSDEEP 98304:uQgF/fYLeCbIJpxuCmrbu3k4ge6kRgixkPn+l3:uQSRCYxuC6bu3+kRg+h
TLSH
T1F1E533C1F96FF09CE64D1ABE84621B70E71014B53ACD5A701FFCA66C912E4BAEA15B01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion persistence ransomware

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	boykisser.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\boykisser_wallpaper.png"	boykisser.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
4740	reg.exe
1920	reg.exe
1652	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5176	powershell.exe
5176	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5176	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 5176	440	boykisser.exe	88
PID 5176 wrote to memory of 5732	5176	powershell.exe	90
PID 5732 wrote to memory of 4740	5732	boykisser.exe	91
PID 5732 wrote to memory of 1920	5732	boykisser.exe	92
PID 5732 wrote to memory of 5488	5732	boykisser.exe	95
PID 5488 wrote to memory of 1652	5488	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\boykisser.exe
"C:\Users\Admin\AppData\Local\Temp\boykisser.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGIAbwB5AGsAaQBzAHMAZQByAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAC0ALQBlAGwAZQB2AGEAdABlAGQAJwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5176
- - C:\Users\Admin\AppData\Local\Temp\boykisser.exe
    "C:\Users\Admin\AppData\Local\Temp\boykisser.exe" --elevated
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Sets desktop wallpaper using registry
    - Suspicious use of WriteProcessMemory
    PID:5732
  - - C:\Windows\system32\reg.exe
      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4740
  - - C:\Windows\system32\reg.exe
      "reg" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1920
  - - C:\Windows\system32\cmd.exe
      "cmd" /c reg delete HKLM\BCD00000000 /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5488
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\BCD00000000 /f
        5⤵
        Modifies registry key
        
        PID:1652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/440-0-0x00007FF6F8440000-0x00007FF6F89A4000-memory.dmp

Download

memory/440-1-0x00007FF6F8440000-0x00007FF6F89A4000-memory.dmp

Download

memory/440-2-0x00007FF6F8440000-0x00007FF6F89A4000-memory.dmp

Download

memory/5176-3-0x00007FFB0AFDF000-0x00007FFB0AFE0000-memory.dmp

Download

memory/5176-4-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp

Download

memory/5176-7-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp

Download

memory/5176-8-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp

Download

memory/5176-9-0x00000255FB830000-0x00000255FB852000-memory.dmp

Download

memory/5176-10-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp

Download

memory/5176-11-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp

Download

memory/5176-12-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp

Download

memory/5176-14-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp

Download

memory/5176-15-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp

Download

memory/5732-16-0x00007FF6F8440000-0x00007FF6F89A4000-memory.dmp

Download

memory/5732-18-0x00007FF6F8440000-0x00007FF6F89A4000-memory.dmp

Download