Analysis
- user interaction
yes - max time kernel
59s - max time network
35s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/10/2026, 16:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BOOM.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
60 seconds
Behavioral task
behavioral2
Sample
BOOM.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
60 seconds
General
- Target BOOM.exe
- Size 7.7MB
- Sample261024-vfpmdavzev
- SHA256 f97b039d8cddd3dde068dfc4e971c448d0a1fdbeac3c9fd6e9fe4c392896a581
- MD5 ca8f3e6276da2347078b9f75871e98a3
- SHA1 bfb1b4a3880dd0e684b344a4f14f02b041dc34fe
- SHA512 5c496fa75ec1b4530bbddf3951aea47645963dd001afb907cd301146c76858872b0a1b2b74792c6c50b154bb5aeb2e29d75c93f1b7b1450cc9aa90b46b309ff5
- SSDEEP 196608:tq8bDAdeMi6X6Q710ywPj3q8bDAdeMi6X6Q710ywPj8pT2pTpu:AMZL6XLyywmMZL6XLyywIU
- TLSH T19E862329ACE9C98DC7D7C87D6FB0A42ED7B89A225D7A4502E271A5CC8530FDD2DC0247
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BOOM.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4884 taskmgr.exe Token: SeSystemProfilePrivilege 4884 taskmgr.exe Token: SeCreateGlobalPrivilege 4884 taskmgr.exe - Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe - Suspicious use of SendNotifyMessage 39 IoCs
pid Process 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe 4884 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BOOM.exe"C:\Users\Admin\AppData\Local\Temp\BOOM.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1308
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3d8 0x2d41⤵PID:1988
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4884