Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
156s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
-
submitted
19/12/2023, 23:31
General
-
Target
6c991505be6bf923b847cfde37271856
-
Size
114KB
-
MD5
6c991505be6bf923b847cfde37271856
-
SHA1
6b8ddcd0dc140ba9414a7a659cbf803bd0b6e1d3
-
SHA256
302b70aa755d29e3a21dd3b70eb53011dd158b2085c756122be37465dab698a6
-
SHA512
c9c42c6082050e9579b36b9eae57a584f1147c3e6bf6b23e700f17df70f585e4f26f16d18255bff2cbf016e4b8e8f4ea7310acf867385753f3302a6c802b27c0
-
SSDEEP
3072:GZQMf63hq7S3OHKUayixFNJ3KLmNonVqfHXF/4Nb:jmMOq5laLmNonVqfHXF/4Nb
Malware Config
Signatures
-
Contacts a large (23365) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/6c991505be6bf923b847cfde37271856/tmp/6c991505be6bf923b847cfde372718561⤵
- Changes its process name
- Reads system routing table
- Reads system network configuration