Analysis
- user interaction
yes - max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
06/08/2026, 02:20
General
- Target BoosterX.exe
- Size 31.6MB
- Sample260806-csskpa1gpf
- SHA256 d51335c79bda0192cb99154d5885a3039e480d8f66f7c8e682560644a007e837
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies boot configuration data using bcdedit 2 IoCs
- Power Settings 1 TTPs 2 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 4 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 7 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 16 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\BoosterX.exe"C:\Users\Admin\AppData\Local\Temp\BoosterX.exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\wevtutil.exe"wevtutil.exe" gl Microsoft-Windows-SleepStudy/Diagnostic2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\wevtutil.exe"wevtutil.exe" gl Microsoft-Windows-Kernel-Processor-Power/Diagnostic2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\wevtutil.exe"wevtutil.exe" gl Microsoft-Windows-UserModePowerService/Diagnostic2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit.exe" /enum {current} /v2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c chcp 437 & "C:\Users\Admin\AppData\Roaming\BoosterX\pnp\pnputil.exe" /enum-devices2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 4373⤵
-
-
C:\Users\Admin\AppData\Roaming\BoosterX\pnp\pnputil.exe"C:\Users\Admin\AppData\Roaming\BoosterX\pnp\pnputil.exe" /enum-devices3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit.exe" /enum {current} /v2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\wevtutil.exe"wevtutil.exe" gl Microsoft-Windows-SleepStudy/Diagnostic2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\wevtutil.exe"wevtutil.exe" gl Microsoft-Windows-Kernel-Processor-Power/Diagnostic2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\wevtutil.exe"wevtutil.exe" gl Microsoft-Windows-UserModePowerService/Diagnostic2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c chcp 437 & "C:\Users\Admin\AppData\Roaming\BoosterX\pnp\pnputil.exe" /enum-devices2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 4373⤵
-
-
C:\Users\Admin\AppData\Roaming\BoosterX\pnp\pnputil.exe"C:\Users\Admin\AppData\Roaming\BoosterX\pnp\pnputil.exe" /enum-devices3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c chcp 437 & "C:\Users\Admin\AppData\Roaming\BoosterX\pnp\pnputil.exe" /enum-devices /disconnected2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 4373⤵
-
-
C:\Users\Admin\AppData\Roaming\BoosterX\pnp\pnputil.exe"C:\Users\Admin\AppData\Roaming\BoosterX\pnp\pnputil.exe" /enum-devices /disconnected3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powercfg /export "C:\Users\Admin\AppData\Roaming\BoosterX\BackUpPower.pow" 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c2⤵
- Power Settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /export "C:\Users\Admin\AppData\Roaming\BoosterX\BackUpPower.pow" 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp995D.tmpC:\Users\Admin\AppData\Local\Temp\tmp995D.tmp1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_2ff0e5ab.uuc.ps1
tmp995D.tmp
pnputil.exe.mui
pnputil.exe
memory/4596-33-0x00000207E6D60000-0x00000207E6E6A000-memory.dmp
memory/4596-54-0x00000207E8D50000-0x00000207E8D70000-memory.dmp
memory/4596-108-0x00000207EAD30000-0x00000207EAD36000-memory.dmp
memory/4596-20-0x00000207E02F0000-0x00000207E02F8000-memory.dmp
memory/4596-22-0x00000207DA080000-0x00000207DA090000-memory.dmp
memory/4596-21-0x00000207DA080000-0x00000207DA090000-memory.dmp
memory/4596-23-0x00000207E1370000-0x00000207E13A8000-memory.dmp
memory/4596-24-0x00000207E03B0000-0x00000207E03BE000-memory.dmp
memory/4596-27-0x00000207DA080000-0x00000207DA090000-memory.dmp
memory/4596-28-0x00000207DA080000-0x00000207DA090000-memory.dmp
memory/4596-31-0x00000207E6C40000-0x00000207E6C98000-memory.dmp
memory/4596-34-0x00000207E6E70000-0x00000207E73C4000-memory.dmp
memory/4596-35-0x00000207E73E0000-0x00000207E73FA000-memory.dmp
memory/4596-0-0x00000207BD990000-0x00000207BF926000-memory.dmp
memory/4596-32-0x00000207E6CA0000-0x00000207E6D58000-memory.dmp
memory/4596-30-0x00000207E6C20000-0x00000207E6C28000-memory.dmp
memory/4596-29-0x00000207E6250000-0x00000207E6256000-memory.dmp
memory/4596-40-0x00000207E7480000-0x00000207E74C8000-memory.dmp
memory/4596-41-0x00000207E74D0000-0x00000207E7582000-memory.dmp
memory/4596-39-0x00000207E6C30000-0x00000207E6C38000-memory.dmp
memory/4596-38-0x00000207E7410000-0x00000207E742A000-memory.dmp
memory/4596-37-0x00000207E73C0000-0x00000207E73C8000-memory.dmp
memory/4596-36-0x00000207E7400000-0x00000207E740E000-memory.dmp
memory/4596-43-0x00000207E7440000-0x00000207E744A000-memory.dmp
memory/4596-47-0x00000207DA080000-0x00000207DA090000-memory.dmp
memory/4596-45-0x00000207DA080000-0x00000207DA090000-memory.dmp
memory/4596-46-0x00000207DA080000-0x00000207DA090000-memory.dmp
memory/4596-42-0x00000207D9EA0000-0x00000207D9EA8000-memory.dmp
memory/4596-49-0x00000207E8D80000-0x00000207E8DA2000-memory.dmp
memory/4596-48-0x00000207E7BF0000-0x00000207E7BFE000-memory.dmp
memory/4596-51-0x00000207E8DB0000-0x00000207E8E08000-memory.dmp
memory/4596-50-0x00000207E7C00000-0x00000207E7C28000-memory.dmp
memory/4596-19-0x00000207DA050000-0x00000207DA076000-memory.dmp
memory/4596-18-0x00000207D9EB0000-0x00000207D9EC4000-memory.dmp
memory/4596-5-0x00000207DA080000-0x00000207DA090000-memory.dmp
memory/4596-55-0x00000207DA080000-0x00000207DA090000-memory.dmp
memory/4596-56-0x00000207E7C30000-0x00000207E7C31000-memory.dmp
memory/4596-57-0x00000207E8D70000-0x00000207E8D76000-memory.dmp
memory/4596-58-0x00000207E8E10000-0x00000207E8E18000-memory.dmp
memory/4596-59-0x00000207E8E20000-0x00000207E8E38000-memory.dmp
memory/4596-60-0x00000207E8E40000-0x00000207E8E4E000-memory.dmp
memory/4596-17-0x00000207DA030000-0x00000207DA04C000-memory.dmp
memory/4596-68-0x00000207E9170000-0x00000207E917A000-memory.dmp
memory/4596-69-0x00000207E91F0000-0x00000207E9216000-memory.dmp
memory/4596-70-0x00000207E9360000-0x00000207E9376000-memory.dmp
memory/4596-84-0x00000207E9430000-0x00000207E943C000-memory.dmp
memory/4596-82-0x00000207E93D0000-0x00000207E9426000-memory.dmp
memory/4596-2-0x00000207DC050000-0x00000207DD872000-memory.dmp
memory/4596-1-0x00000207DA080000-0x00000207DA090000-memory.dmp
memory/4596-91-0x00000207DA080000-0x00000207DA090000-memory.dmp
memory/4596-90-0x00000207DA080000-0x00000207DA090000-memory.dmp
memory/4596-89-0x00000207DA080000-0x00000207DA090000-memory.dmp
memory/4596-93-0x00000207E99F0000-0x00000207E99F8000-memory.dmp
memory/4596-92-0x00000207E9440000-0x00000207E9446000-memory.dmp
memory/4596-95-0x00000207E9A10000-0x00000207E9A2E000-memory.dmp
memory/4596-94-0x00000207E9A00000-0x00000207E9A10000-memory.dmp
memory/4596-96-0x00000207DA080000-0x00000207DA090000-memory.dmp
memory/4596-97-0x00000207E9A50000-0x00000207E9A58000-memory.dmp
memory/4596-98-0x00000207E7BD0000-0x00000207E7BE0000-memory.dmp
memory/4596-100-0x00000207EA260000-0x00000207EA27E000-memory.dmp
memory/4596-99-0x00000207E9280000-0x00000207E9288000-memory.dmp
memory/4596-103-0x00000207EAC80000-0x00000207EAC86000-memory.dmp
memory/4596-104-0x00000207EAC90000-0x00000207EACC6000-memory.dmp
memory/4596-107-0x00000207EACF0000-0x00000207EAD2A000-memory.dmp
memory/4596-109-0x00000207EAD40000-0x00000207EAD48000-memory.dmp
memory/5016-53-0x0000000000010000-0x0000000000017000-memory.dmp