adb6096165ea6e4ec05618ecad9ec4c6dc7b72ac50808b6028f9d35334ea0b7a | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

adb6096165...7a.exe

windows7-x64

8

adb6096165...7a.exe

windows10-2004-x64

8

Sharing

General

Target

adb6096165ea6e4ec05618ecad9ec4c6dc7b72ac50808b6028f9d35334ea0b7a
Size

252KB
Sample

221127-kqzvzshb3x
MD5

e5382d90e47531b8aa08b79890d6117e
SHA1

b406c242c22611f38903603cc24d23d7c3b36d3d
SHA256

adb6096165ea6e4ec05618ecad9ec4c6dc7b72ac50808b6028f9d35334ea0b7a
SHA512

e977b8ef5f3b3e50e70de4d26840d0f013de88810aae6d56bad8dd71659c0caa4d29220160ddad6b42a7c4c94544855cc1a87c10d21276938f84f1ea6b3ceb0e
SSDEEP

6144:VQqpccNcO2MLbILFvMImp2oc4G8ZFdrmlopP4hc1HGr+deRPILQ:t2EIFvXmvG8ZFolwPoc1HvLQ

Score

8^/10

bootkit discovery persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

adb6096165ea6e4ec05618ecad9ec4c6dc7b72ac50808b6028f9d35334ea0b7a.exe

Resource

win7-20220812-en

bootkit discovery persistence

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

adb6096165ea6e4ec05618ecad9ec4c6dc7b72ac50808b6028f9d35334ea0b7a.exe

Resource

win10v2004-20220812-en

bootkit discovery persistence

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  adb6096165ea6e4ec05618ecad9ec4c6dc7b72ac50808b6028f9d35334ea0b7a
- Size
  
  252KB
- MD5
  
  e5382d90e47531b8aa08b79890d6117e
- SHA1
  
  b406c242c22611f38903603cc24d23d7c3b36d3d
- SHA256
  
  adb6096165ea6e4ec05618ecad9ec4c6dc7b72ac50808b6028f9d35334ea0b7a
- SHA512
  
  e977b8ef5f3b3e50e70de4d26840d0f013de88810aae6d56bad8dd71659c0caa4d29220160ddad6b42a7c4c94544855cc1a87c10d21276938f84f1ea6b3ceb0e
- SSDEEP
  
  6144:VQqpccNcO2MLbILFvMImp2oc4G8ZFdrmlopP4hc1HGr+deRPILQ:t2EIFvXmvG8ZFolwPoc1HvLQ
Score

8^/10

bootkit discovery persistence
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoverypersistence

behavioral2

bootkitdiscoverypersistence

© 2018-2025

Terms | Privacy