0368d987a18a7e83f71a34da927abdae4ede03cacf63a9df5f9afd87018ef6c9 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

0368d987a1...c9.exe

windows7-x64

9

0368d987a1...c9.exe

windows10-2004-x64

9

Sharing

General

Target

0368d987a18a7e83f71a34da927abdae4ede03cacf63a9df5f9afd87018ef6c9
Size

242KB
Sample

240309-xsswnsgc61
MD5

acb903d62903881a12e88770b6b7de46
SHA1

871159c6af7b0e3ca30bb5823387a5dadc3ae944
SHA256

0368d987a18a7e83f71a34da927abdae4ede03cacf63a9df5f9afd87018ef6c9
SHA512

e6b52a982fda88d3a6f28d9c35bacc0c7cbc003aa69dfdaba13a0b1e220897275d94d799469658a8ac88390dbfa5e309ccc5a2ca69543aef7849392adf9b5cfe
SSDEEP

6144:vkeENDvTSn2SV/GuhYdViC7X57+nM0dxPA0wlyxDs:vNEND/k/GLPX57+nHdrs

Score

10^/10

bootkit persistence upx

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

0368d987a18a7e83f71a34da927abdae4ede03cacf63a9df5f9afd87018ef6c9.exe

Resource

win7-20240221-en

bootkit persistence upx

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

0368d987a18a7e83f71a34da927abdae4ede03cacf63a9df5f9afd87018ef6c9.exe

Resource

win10v2004-20240226-en

bootkit persistence upx

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  0368d987a18a7e83f71a34da927abdae4ede03cacf63a9df5f9afd87018ef6c9
- Size
  
  242KB
- MD5
  
  acb903d62903881a12e88770b6b7de46
- SHA1
  
  871159c6af7b0e3ca30bb5823387a5dadc3ae944
- SHA256
  
  0368d987a18a7e83f71a34da927abdae4ede03cacf63a9df5f9afd87018ef6c9
- SHA512
  
  e6b52a982fda88d3a6f28d9c35bacc0c7cbc003aa69dfdaba13a0b1e220897275d94d799469658a8ac88390dbfa5e309ccc5a2ca69543aef7849392adf9b5cfe
- SSDEEP
  
  6144:vkeENDvTSn2SV/GuhYdViC7X57+nM0dxPA0wlyxDs:vNEND/k/GLPX57+nHdrs
Score

9^/10

bootkit persistence upx
- UPX dump on OEP (original entry point)
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistenceupx

behavioral2

bootkitpersistenceupx

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.