e9439e8877834ac247d1e2c3fc63ce22614854b648ea4ce50187bbe13e3ace40

Analysis

max time kernel
150s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
boykisser.exe
Size 2.2MB
Sample260709-a6fryab17w
SHA256 e9439e8877834ac247d1e2c3fc63ce22614854b648ea4ce50187bbe13e3ace40
MD5 4e2dee024e427af144ae6c2a82d9b789
SHA1 3e229e1118a8233e22bf471b6dc96d2103052ae1
SHA512 be914b0816a4c08e9b60fc5b7032ce0f6e8b4126fee8f18ca0c4ac92a4f0ac2c95fc678714f4b97dd0f333ddacf059a443d79e59441744d4504762a094314931
SSDEEP 24576:cPmhA/KT/bv0X9PAaNoraAtm2tLBTEl/plSBaDBrC1RuwKtcC15WkBgfEW735Uvj:cPmhBT+SBa9riRmtceXBM2
TLSH
T12EB5294F7FB15198D0F981B4D253F422AE67B84B131999A673DC9320EB61A0336C86FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

ransomware

Malware Config

Signatures

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\updwall.jpg"	boykisser.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5032	boykisser.exe
5032	boykisser.exe
5032	boykisser.exe
5032	boykisser.exe
5032	boykisser.exe
5032	boykisser.exe
5032	boykisser.exe
5032	boykisser.exe
5032	boykisser.exe
5032	boykisser.exe
5032	boykisser.exe
5032	boykisser.exe

C:\Users\Admin\AppData\Local\Temp\boykisser.exe
"C:\Users\Admin\AppData\Local\Temp\boykisser.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

boykisser_step.log

Path C:\Users\Admin\AppData\Local\Temp\boykisser_step.log
Size 39B
SHA256 3e73a0511d3f1d238b07354d25a3fd548993929b5b4d363af32b01dc77a1ac9a
MD5 7fac88d25c2132ba027254884805cc18
SHA1 c71256e24a3d62fe1638f27d87f5793e17a53600
SHA512 4e4215c9053b5c6330d6c14b8a07f0f3f72669a9bbbe9853607aa30be0dea556bea79f9f38fd32aff1642d6e694f05cd05b2654f8b1fb6c7873cac777b9f9216
MD5 SHA1 SHA512

Submit Download

memory/5032-14-0x00007FF6DA540000-0x00007FF6DA77C000-memory.dmp

Download