78bbdc7efd2afa13ba43476c04afbe99108a1fd86a33923bc388ee569e090050 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

3

78bbdc7efd...50.exe

windows7-x64

9

78bbdc7efd...50.exe

windows10-2004-x64

9

Sharing

General

Target

78bbdc7efd2afa13ba43476c04afbe99108a1fd86a33923bc388ee569e090050
Size

4.0MB
Sample

240526-jvg1ascg24
MD5

ff51d0152c58b9d85cf353eee7ff73ad
SHA1

bc2aa9286fde02c12d6c7dff50c48ae02874a16a
SHA256

78bbdc7efd2afa13ba43476c04afbe99108a1fd86a33923bc388ee569e090050
SHA512

9370bc0483c9de3775b1e66a87773540dc45c86c2743868426a50e4ea85b52c8ef612e13b6ab808de9afc6441b3c5c4518de51cbac8a333aeaec7244af9a8d9b
SSDEEP

98304:eSjiJiKlFDlv0WEe2kh8qZJcKObpEQIj6s1yCQx/ouxOq:eSjM1FDlv0WE0Jcxpv6yCKor

Score

9^/10

bootkit evasion persistence trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

78bbdc7efd2afa13ba43476c04afbe99108a1fd86a33923bc388ee569e090050.exe

Resource

win7-20240221-en

bootkit evasion persistence trojan upx

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

78bbdc7efd2afa13ba43476c04afbe99108a1fd86a33923bc388ee569e090050.exe

Resource

win10v2004-20240426-en

bootkit evasion persistence trojan upx

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  78bbdc7efd2afa13ba43476c04afbe99108a1fd86a33923bc388ee569e090050
- Size
  
  4.0MB
- MD5
  
  ff51d0152c58b9d85cf353eee7ff73ad
- SHA1
  
  bc2aa9286fde02c12d6c7dff50c48ae02874a16a
- SHA256
  
  78bbdc7efd2afa13ba43476c04afbe99108a1fd86a33923bc388ee569e090050
- SHA512
  
  9370bc0483c9de3775b1e66a87773540dc45c86c2743868426a50e4ea85b52c8ef612e13b6ab808de9afc6441b3c5c4518de51cbac8a333aeaec7244af9a8d9b
- SSDEEP
  
  98304:eSjiJiKlFDlv0WEe2kh8qZJcKObpEQIj6s1yCQx/ouxOq:eSjM1FDlv0WE0Jcxpv6yCKor
Score

9^/10

bootkit evasion persistence trojan upx
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks whether UAC is enabled
  evasion trojan
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Pre-OS Boot

Bootkit

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitevasionpersistencetrojanupx

behavioral2

bootkitevasionpersistencetrojanupx

© 2018-2025

Terms | Privacy