a3f42145e3e7e48f2cac34abd60883351dbd83d525fa81296dd8d43a0d7d0777

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 01:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
boykisser.exe
Size 2.1MB
Sample260709-bgzzyscs3z
SHA256 a3f42145e3e7e48f2cac34abd60883351dbd83d525fa81296dd8d43a0d7d0777
MD5 a9bfec5b3939571fface3136ccf59db1
SHA1 b4e9f3a113ab962fa1c797da35e8f48207278079
SHA512 cd4afe175ace9f66f39c19a93351c2777952a636c6b1666f9bf8caf247f0a8745c534f674e091b81c1970cf2f48a097a3d2a57d5d121f18813712b22a7b63c71
SSDEEP 24576:e2RBviMrnzhv0X9PAaNoraAtm2tLBTEl/BEzTKuNz5oicKtcC15WkBgfEW735Ug:e2RBhrnGEzTKSzBJtceXBM2g
TLSH
T17DA5394F7FB15198D0F980B4D257F422AE27B84B171999A673DC9320EB61A0336C86FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

ransomware

Malware Config

Signatures

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\updwall.jpg"	boykisser.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4368	boykisser.exe
4368	boykisser.exe
4368	boykisser.exe
4368	boykisser.exe
4368	boykisser.exe
4368	boykisser.exe
4368	boykisser.exe
4368	boykisser.exe
4368	boykisser.exe
4368	boykisser.exe
4368	boykisser.exe
4368	boykisser.exe
4368	boykisser.exe
4368	boykisser.exe

C:\Users\Admin\AppData\Local\Temp\boykisser.exe
"C:\Users\Admin\AppData\Local\Temp\boykisser.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

boykisser_step.log

Path C:\Users\Admin\AppData\Local\Temp\boykisser_step.log
Size 36B
SHA256 486921c831e2176675ef452919cbffd2f2ee65566f25b5b252ac8259f4b0b3eb
MD5 a26fcf1d30c63f3d8834b22fc920f6d6
SHA1 2454c4cdce8e461293c4b1a6a1e4ea2c2a0dfff4
SHA512 03892aa4b91d5e6701f8b1965eee4fcd753d09d2dc7a418fb4a7897bd1c374191b82facff5001167a000ab26a850fc97c509b07e277bdeddcbc7a597e5a07c8c
MD5 SHA1 SHA512

Submit Download

memory/4368-13-0x00007FF65C760000-0x00007FF65C989000-memory.dmp

Download