e01a0e423483e9780d8733d97e3bfb1d3f415adb433b4b1cd75942a4f9f5769a

Analysis

user interaction
yes
max time kernel
16s
max time network
20s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BoostEmpire.exe
Size 1.7MB
Sample260730-cczztsac87
SHA256 e01a0e423483e9780d8733d97e3bfb1d3f415adb433b4b1cd75942a4f9f5769a
MD5 78934ccf393f0f1d79131d83604f7a21
SHA1 6329db94196ab785982f2a0e826e0212e61ff4a7
SHA512 a0fb69889238b985a76b0f1e8f4c771221e1e686bebaa817b0cffc8818ca8efdbac65a28405ddc3bd9efbc5ce5d032a5e4b498d7e3d919a49619670a43f593b4
SSDEEP 49152:dHroOXido2M8DhlnGvRfeiCtgxV98kGiWYkQm:dQM8DbnGpeYCiWYF
TLSH
T103857D0763E501FCE1B6D379CEE59813EB72B8190F60AACF179044A25FA27D05E79722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1528	powercfg.exe
1376	powercfg.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BoostEmpire.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	BoostEmpire.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	BoostEmpire.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1376	powercfg.exe
Token: SeCreatePagefilePrivilege	1376	powercfg.exe
Token: SeShutdownPrivilege	1528	powercfg.exe
Token: SeCreatePagefilePrivilege	1528	powercfg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3892	BoostEmpire.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3892	BoostEmpire.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3892	BoostEmpire.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 1376	3892	BoostEmpire.exe	91
PID 3892 wrote to memory of 1528	3892	BoostEmpire.exe	93

C:\Users\Admin\AppData\Local\Temp\BoostEmpire.exe
"C:\Users\Admin\AppData\Local\Temp\BoostEmpire.exe"
1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /getactivescheme
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1376
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /query SCHEME_CURRENT SUB_SLEEP STANDBYIDLE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads