Analysis
- user interaction
yes - max time kernel
151s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 14:21
General
- Target boosterx/BoosterX.exe
- Size 33.8MB
- Sample260705-rpexracy8x
- SHA256 457650023111ecaa72ed5ac809d6b1204518f4591e3d81e62a732334026261b1
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 38 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 54 IoCs
- Suspicious use of SendNotifyMessage 45 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\boosterx\BoosterX.exe"C:\Users\Admin\AppData\Local\Temp\boosterx\BoosterX.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\wevtutil.exe"wevtutil.exe" gl Microsoft-Windows-SleepStudy/Diagnostic2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\wevtutil.exe"wevtutil.exe" gl Microsoft-Windows-Kernel-Processor-Power/Diagnostic2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\wevtutil.exe"wevtutil.exe" gl Microsoft-Windows-UserModePowerService/Diagnostic2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c chcp 437 & "C:\Users\Admin\AppData\Roaming\BoosterX\pnp\pnputil.exe" /enum-devices2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 4373⤵
-
-
C:\Users\Admin\AppData\Roaming\BoosterX\pnp\pnputil.exe"C:\Users\Admin\AppData\Roaming\BoosterX\pnp\pnputil.exe" /enum-devices3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
libskiasharp.dll
pnputil.exe.mui
pnputil.exe
memory/1096-47-0x0000017EB20E0000-0x0000017EB2138000-memory.dmp
memory/1096-63-0x0000017EACD90000-0x0000017EACDA8000-memory.dmp
memory/1096-4-0x00007FFD07640000-0x00007FFD07FE4000-memory.dmp
memory/1096-5-0x0000017EA85A0000-0x0000017EA8ED6000-memory.dmp
memory/1096-7-0x00007FFD07640000-0x00007FFD07FE4000-memory.dmp
memory/1096-10-0x00007FFD07640000-0x00007FFD07FE4000-memory.dmp
memory/1096-11-0x00007FFD07640000-0x00007FFD07FE4000-memory.dmp
memory/1096-12-0x00007FFD07640000-0x00007FFD07FE4000-memory.dmp
memory/1096-13-0x0000017EA8EE0000-0x0000017EAB37C000-memory.dmp
memory/1096-15-0x0000017E8F930000-0x0000017E8F940000-memory.dmp
memory/1096-14-0x0000017E8F920000-0x0000017E8F928000-memory.dmp
memory/1096-17-0x0000017E8FA70000-0x0000017E8FA9E000-memory.dmp
memory/1096-16-0x0000017E8FA00000-0x0000017E8FA20000-memory.dmp
memory/1096-19-0x0000017EA83E0000-0x0000017EA83EC000-memory.dmp
memory/1096-18-0x0000017E8FC00000-0x0000017E8FC08000-memory.dmp
memory/1096-20-0x0000017EA8530000-0x0000017EA856E000-memory.dmp
memory/1096-21-0x0000017EABE80000-0x0000017EABF38000-memory.dmp
memory/1096-23-0x0000017EACB20000-0x0000017EACB3C000-memory.dmp
memory/1096-25-0x0000017EABF50000-0x0000017EABF58000-memory.dmp
memory/1096-27-0x0000017EACC30000-0x0000017EACC56000-memory.dmp
memory/1096-31-0x0000017EACCA0000-0x0000017EACCAA000-memory.dmp
memory/1096-30-0x0000017EACC90000-0x0000017EACC98000-memory.dmp
memory/1096-29-0x0000017EACC60000-0x0000017EACC86000-memory.dmp
memory/1096-28-0x0000017EACB10000-0x0000017EACB24000-memory.dmp
memory/1096-32-0x0000017EAF690000-0x0000017EAF698000-memory.dmp
memory/1096-33-0x0000017EB0B60000-0x0000017EB0B9E000-memory.dmp
memory/1096-49-0x0000017EB0D30000-0x0000017EB0D38000-memory.dmp
memory/1096-35-0x00007FFD07640000-0x00007FFD07FE4000-memory.dmp
memory/1096-26-0x0000017EACB00000-0x0000017EACB14000-memory.dmp
memory/1096-36-0x00007FFD07640000-0x00007FFD07FE4000-memory.dmp
memory/1096-24-0x0000017EABF40000-0x0000017EABF48000-memory.dmp
memory/1096-22-0x0000017EA8580000-0x0000017EA8588000-memory.dmp
memory/1096-37-0x00007FFD07640000-0x00007FFD07FE4000-memory.dmp
memory/1096-38-0x00007FFD07640000-0x00007FFD07FE4000-memory.dmp
memory/1096-39-0x00007FFD07640000-0x00007FFD07FE4000-memory.dmp
memory/1096-41-0x0000017EB0C20000-0x0000017EB0C2A000-memory.dmp
memory/1096-40-0x0000017EB0C10000-0x0000017EB0C16000-memory.dmp
memory/1096-42-0x0000017EB0CF0000-0x0000017EB0CF6000-memory.dmp
memory/1096-43-0x0000017EB0D20000-0x0000017EB0D2A000-memory.dmp
memory/1096-44-0x0000017EB1FD0000-0x0000017EB20E0000-memory.dmp
memory/1096-45-0x0000017EB2AB0000-0x0000017EB3028000-memory.dmp
memory/1096-46-0x0000017EB0D50000-0x0000017EB0D6A000-memory.dmp
memory/1096-2-0x0000017E8BB10000-0x0000017E8DCE8000-memory.dmp
memory/1096-50-0x0000017EB0D70000-0x0000017EB0D7A000-memory.dmp
memory/1096-34-0x0000017EB0B30000-0x0000017EB0B3E000-memory.dmp
memory/1096-3-0x00007FFD07640000-0x00007FFD07FE4000-memory.dmp
memory/1096-61-0x0000017EACD40000-0x0000017EACD4C000-memory.dmp
memory/1096-52-0x0000017EB66D0000-0x0000017EB67AE000-memory.dmp
memory/1096-54-0x00007FFD07640000-0x00007FFD07FE4000-memory.dmp
memory/1096-59-0x0000017EACDB0000-0x0000017EACDC2000-memory.dmp
memory/1096-51-0x00007FFD07640000-0x00007FFD07FE4000-memory.dmp
memory/1096-57-0x0000017EACD60000-0x0000017EACD6E000-memory.dmp
memory/1096-56-0x0000017EACD00000-0x0000017EACD3E000-memory.dmp
memory/1096-65-0x00007FFD07640000-0x00007FFD07FE4000-memory.dmp
memory/1096-48-0x0000017EB2140000-0x0000017EB21F8000-memory.dmp
memory/1096-62-0x0000017EACE30000-0x0000017EACE52000-memory.dmp
memory/1096-60-0x0000017EACDD0000-0x0000017EACDFA000-memory.dmp
memory/1096-58-0x0000017EACD70000-0x0000017EACD8A000-memory.dmp
memory/1096-55-0x0000017EACCE0000-0x0000017EACD00000-memory.dmp
memory/1096-64-0x0000017EACD50000-0x0000017EACD58000-memory.dmp
memory/1096-73-0x00007FFD07640000-0x00007FFD07FE4000-memory.dmp
memory/1096-72-0x0000017EACE90000-0x0000017EACE96000-memory.dmp
memory/1096-71-0x0000017EACE80000-0x0000017EACE86000-memory.dmp
memory/1096-70-0x0000017EACE70000-0x0000017EACE7A000-memory.dmp
memory/1096-69-0x0000017EACE60000-0x0000017EACE70000-memory.dmp
memory/1096-68-0x0000017EACE20000-0x0000017EACE2E000-memory.dmp
memory/1096-67-0x0000017EACE00000-0x0000017EACE24000-memory.dmp
memory/1096-66-0x0000017EACDC0000-0x0000017EACDC6000-memory.dmp
memory/1096-94-0x0000017EACF20000-0x0000017EACF78000-memory.dmp
memory/1096-93-0x0000017EACEF0000-0x0000017EACF18000-memory.dmp
memory/1096-230-0x0000017EAD000000-0x0000017EAD00C000-memory.dmp
memory/1096-228-0x0000017EACFA0000-0x0000017EACFF6000-memory.dmp
memory/1096-227-0x0000017EACF90000-0x0000017EACF9A000-memory.dmp
memory/1096-273-0x00007FFD07640000-0x00007FFD07FE4000-memory.dmp
memory/1096-271-0x0000017EAD300000-0x0000017EAD310000-memory.dmp
memory/1096-272-0x0000017EAD310000-0x0000017EAD32E000-memory.dmp
memory/1096-260-0x0000017EAD020000-0x0000017EAD028000-memory.dmp
memory/1096-226-0x0000017EACF80000-0x0000017EACF86000-memory.dmp
memory/1096-1-0x00007FFD07640000-0x00007FFD07FE4000-memory.dmp
memory/1096-0-0x00007FFD077CF000-0x00007FFD077D0000-memory.dmp
memory/1096-259-0x0000017EAD010000-0x0000017EAD016000-memory.dmp
memory/1096-262-0x0000017EAD040000-0x0000017EAD05E000-memory.dmp
memory/1096-261-0x0000017EAD030000-0x0000017EAD040000-memory.dmp
memory/5536-111-0x000001CD1B0A0000-0x000001CD1B1A0000-memory.dmp
memory/5536-144-0x000001CD1B4C0000-0x000001CD1B4E0000-memory.dmp
memory/5536-98-0x000001CD06450000-0x000001CD06550000-memory.dmp
memory/5536-99-0x000001CD06450000-0x000001CD06550000-memory.dmp
memory/5536-125-0x000001CD07DE0000-0x000001CD07E00000-memory.dmp
memory/5536-109-0x000001CD07CA0000-0x000001CD07CC0000-memory.dmp
memory/5536-100-0x000001CD06450000-0x000001CD06550000-memory.dmp