e01a0e423483e9780d8733d97e3bfb1d3f415adb433b4b1cd75942a4f9f5769a

Analysis

user interaction
yes
max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BoostEmpire.exe
Size 1.7MB
Sample260730-cczztsac87
SHA256 e01a0e423483e9780d8733d97e3bfb1d3f415adb433b4b1cd75942a4f9f5769a
MD5 78934ccf393f0f1d79131d83604f7a21
SHA1 6329db94196ab785982f2a0e826e0212e61ff4a7
SHA512 a0fb69889238b985a76b0f1e8f4c771221e1e686bebaa817b0cffc8818ca8efdbac65a28405ddc3bd9efbc5ce5d032a5e4b498d7e3d919a49619670a43f593b4
SSDEEP 49152:dHroOXido2M8DhlnGvRfeiCtgxV98kGiWYkQm:dQM8DbnGpeYCiWYF
TLSH
T103857D0763E501FCE1B6D379CEE59813EB72B8190F60AACF179044A25FA27D05E79722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Power Settings 1 TTPs 3 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5776	powercfg.exe
4224	powercfg.exe
3624	powercfg.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BoostEmpire.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	BoostEmpire.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	BoostEmpire.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5776	powercfg.exe
Token: SeCreatePagefilePrivilege	5776	powercfg.exe
Token: SeShutdownPrivilege	4224	powercfg.exe
Token: SeCreatePagefilePrivilege	4224	powercfg.exe
Token: SeShutdownPrivilege	3624	powercfg.exe
Token: SeCreatePagefilePrivilege	3624	powercfg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
936	BoostEmpire.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
936	BoostEmpire.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
936	BoostEmpire.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 5776	936	BoostEmpire.exe	90
PID 936 wrote to memory of 4224	936	BoostEmpire.exe	93
PID 936 wrote to memory of 3624	936	BoostEmpire.exe	96

C:\Users\Admin\AppData\Local\Temp\BoostEmpire.exe
"C:\Users\Admin\AppData\Local\Temp\BoostEmpire.exe"
1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /getactivescheme
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5776
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /query SCHEME_CURRENT SUB_SLEEP STANDBYIDLE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4224
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /query SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMIN
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads