Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

97e4dbe470...67a4ed

ubuntu-18.04-amd64

6

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20231215-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    20/12/2023, 08:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    97e4dbe4706e92a98d061b9c1a67a4ed

  • Size

    7.0MB

  • MD5

    97e4dbe4706e92a98d061b9c1a67a4ed

  • SHA1

    0f9424e7cc5100015717c954eada312ab272320a

  • SHA256

    85fcfc24c30cea3006d3001aef4e8c0fcd44743f7b2e3bf236402f964f71368b

  • SHA512

    f6926c9d2a9a0c5e45c1fa06a23f6c48ef3ef9f71fb494c83e8ecb315834b9dc106377a9ca4f2f659f6f0d455625c95e905466371d1373ea246841167b98bdd2

  • SSDEEP

    98304:K4qmZmgSoh0iDxpRqVlaCMiieYCXfhxIX:1hZml0Dx3enipCXZx

Score
6/10
antivmpersistence

Malware Config

Signatures

  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence
  • Reads runtime system information 4 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 3 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/97e4dbe4706e92a98d061b9c1a67a4ed
    /tmp/97e4dbe4706e92a98d061b9c1a67a4ed
    1⤵
    • Reads runtime system information
    PID:1556
    • /bin/cat
      cat /proc/version
      2⤵
      • Reads runtime system information
      PID:1559
  • /bin/cat
    cat /proc/cpuinfo
    1⤵
    • Checks CPU configuration
    PID:1561
  • /bin/uname
    uname -a
    1⤵
      PID:1562
    • /usr/bin/getconf
      getconf LONG_BIT
      1⤵
        PID:1563
      • /tmp/97e4dbe4706e92a98d061b9c1a67a4ed
        "[stealth]"
        1⤵
        • Reads runtime system information
        PID:1564
        • /bin/cat
          cat /proc/version
          2⤵
          • Reads runtime system information
          PID:1567
      • /bin/cat
        cat /proc/cpuinfo
        1⤵
        • Checks CPU configuration
        PID:1569
      • /bin/uname
        uname -a
        1⤵
          PID:1570
        • /usr/bin/getconf
          getconf LONG_BIT
          1⤵
            PID:1571
          • /usr/bin/crontab
            /usr/bin/crontab /tmp/nip9iNeiph5chee
            1⤵
            • Creates/modifies Cron job
            PID:1576

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • /tmp/.pid
            Filesize

            4B

            MD5

            facf9f743b083008a894eee7baa16469

            SHA1

            fe286d02f80118de47f2226c2fce9f7be0bc04f0

            SHA256

            2163909115c0f6f1e638bd2c2279387cbe37cc327150a7b5cddfde3d1cd4ef0e

            SHA512

            7bd3d1d347d68f23d612a3ec7a1d2f4094874162441bae20122876ea980bbb76a3c46d5d2e393975ea0659fb2b58046a311d7660f226482a57a74e9ffd9b0f36

            Download Submit

          • /tmp/nip9iNeiph5chee
            Filesize

            66B

            MD5

            58a1f4e70f62d1aca14d8ffa827dc847

            SHA1

            26d6e02bc8a3918245d260f013c55f49afb4abde

            SHA256

            d6863f074ea575971e608fa5c76dd5d2d48202762f7679c1647e478cfd4c80b4

            SHA512

            82792311ddffe9e37c94c3f89764f54d69bf8ce491c1277827ad0e61fadea9caaf8b7fdb71c983bcb0e4242672c567f015b763ac7e8e37eb6b54ef3c2d5601b7

            Download Submit

          • /var/spool/cron/crontabs/tmp.195dkr
            Filesize

            260B

            MD5

            8027578d433498aaeeda329cab2adcc9

            SHA1

            b1eaa8f4c338c1ea95fb86a777ea45e34f49dac1

            SHA256

            6297bd568ec34487465f6cd3a732e8c7d59e3fd908ba2613d9dd778ac6b84773

            SHA512

            28870688a726bb583337373b58267dee10f390affa65816ba14555f196c7b9d4b91e6efe5747ec7961a9a277b66dc56d78af3e4494c59fefbf644ce2f14f3a5d

            Download Submit