Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
157s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
-
submitted
19/12/2023, 23:00
General
-
Target
3c6e7a1cad00b778db327cc111555be7
-
Size
119KB
-
MD5
3c6e7a1cad00b778db327cc111555be7
-
SHA1
8f180bc2edcc254a066e23882d9a474b7b84f4f1
-
SHA256
ee74deef2f2b57bac35bda9af95b0d9b68093cf925c0208e530fe61c50abcb30
-
SHA512
b10e26ee8b3c3033a2e8a96ec829f660d7c0fd8f03503a7a74786a27f3cd9693a59b7fec9d57ac6f97b4d539380097e943a7436b1391c6befbb98e2e36c3d8c7
-
SSDEEP
3072:+0NpTxEWmmhhtAG1QXUFp8puatAdVmqoOcqinKnDjc:xHqe26p8pDuTmqoOcqinKnDjc
Malware Config
Signatures
-
Contacts a large (46870) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/3c6e7a1cad00b778db327cc111555be7/tmp/3c6e7a1cad00b778db327cc111555be71⤵
- Changes its process name
- Reads system routing table
- Reads system network configuration