75e031525e0566d086846590eabc4eeb8e7d860335b7e55b76fa39e10f539e78

Analysis

user interaction
yes
max time kernel
56s
max time network
32s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
boykisser.exe
Size 2.4MB
Sample260709-a2k6vsa15l
SHA256 75e031525e0566d086846590eabc4eeb8e7d860335b7e55b76fa39e10f539e78
MD5 9784f1d08b1e25bebacf5ca9ad22f26e
SHA1 9c6358c86c80c1f99d0b4c70deb92f123813c426
SHA512 f6621ace9aec5fbf3168be174071cad32f62934cde99daa4d8305f9f42eb9ccc6c3dbbb663049229cd0f90e0cb86c483c818ade491365401d2cee98a7e462679
SSDEEP 24576:9dZzDtfMrdWv0X9PAaNoraAtm2tLBTEl/2DJFrimqWLLG8KtcC15WkBgfEW735UM:9dZzDOrWtNZhLaptceXBM2gZ
TLSH
T1B7B5294F7FB15198D0F981B4D257F022AE67B84B231999A673DC9320DB21A0336C96FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

ransomware

Malware Config

Signatures

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\updwall.jpg"	boykisser.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5760	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5860	boykisser.exe
5860	boykisser.exe
5860	boykisser.exe
5860	boykisser.exe
5860	boykisser.exe
5860	boykisser.exe
5860	boykisser.exe
5860	boykisser.exe
5860	boykisser.exe
5860	boykisser.exe
5860	boykisser.exe
5860	boykisser.exe

C:\Users\Admin\AppData\Local\Temp\boykisser.exe
"C:\Users\Admin\AppData\Local\Temp\boykisser.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
PID:5860

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4132

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\boykisser_step.log
1⤵
- Opens file in notepad (likely ransom note)
PID:5760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

boykisser_step.log

Path C:\Users\Admin\AppData\Local\Temp\boykisser_step.log
Size 77B
SHA256 2a683806161d6979f3cce8b088cc01ab8546bb6538ece3cb58e6858100e5c20b
MD5 2dee749bfee458e4cd5bcf862e70663a
SHA1 c8b0079c1943cb6a22d191c4747c73b6a9793e0e
SHA512 099358635506e2c6749603902392b91f3d55f21ac28c88ead2dddbab80dd09d1d9a9bd3ccbc948a387067aab46bf45b12533144ee8cefa8d256357fb8ab91efb
TLSH
T102A002581404A3238280173106786350C810C03225F00374323CD061EF53052D635549
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5860-10-0x00007FF680480000-0x00007FF6806E4000-memory.dmp

Download