Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
154s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
20/12/2023, 14:24
Behavioral task
behavioral1
Sample
c680e3001c7e967082a7430cc4fc7467
Resource
ubuntu1804-amd64-20231215-en
ubuntu-18.04-amd64
3 signatures
150 seconds
General
-
Target
c680e3001c7e967082a7430cc4fc7467
-
Size
53KB
-
MD5
c680e3001c7e967082a7430cc4fc7467
-
SHA1
e808bc854c18fb89055d5b06130c56bbf53ed9b1
-
SHA256
16daa6fa6f624d3f4acec3b9438ade2ebda25b0a8f888f4ae5edd9cc9f72c216
-
SHA512
3ee798d9e283cb4ad26aeb69178bd3ca236af40a84566e1cfc6f4257a3b57040187256dfc66f8f93cfb9125644a899b8565ba2bbde702c9a01ac0f0669aa3abd
-
SSDEEP
768:3iLkCaxMz7IcpCMCpzHOEHfdfjI3ParASPEywgtkg4MzIq79cy3mgx:SwxYIchCZxdI/arASEywEuMzr5cy3mg
Score
7/10
Malware Config
Signatures
-
Unexpected DNS network traffic destination 17 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 84.200.69.80 Destination IP 91.239.100.100 Destination IP 84.200.69.80 Destination IP 84.200.69.80 Destination IP 84.200.70.40 Destination IP 84.200.70.40 Destination IP 84.200.70.40 Destination IP 84.200.69.80 Destination IP 84.200.69.80 Destination IP 84.200.70.40 Destination IP 84.200.69.80 Destination IP 84.200.69.80 Destination IP 84.200.69.80 Destination IP 84.200.69.80 Destination IP 84.200.70.40 Destination IP 84.200.69.80 Destination IP 91.239.100.100 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/1091/status File opened for reading /proc/1131/status File opened for reading /proc/1135/fd File opened for reading /proc/1181/fd File opened for reading /proc/1235/exe File opened for reading /proc/1517/status File opened for reading /proc/953/status File opened for reading /proc/1167/status File opened for reading /proc/1131/exe File opened for reading /proc/1149/exe File opened for reading /proc/1355/cmdline File opened for reading /proc/1374/cmdline File opened for reading /proc/1127/cmdline File opened for reading /proc/963/exe File opened for reading /proc/1043/exe File opened for reading /proc/1067/status File opened for reading /proc/1169/status File opened for reading /proc/948/exe File opened for reading /proc/1072/fd File opened for reading /proc/1152/exe File opened for reading /proc/953/fd File opened for reading /proc/1123/status File opened for reading /proc/1135/exe File opened for reading /proc/1169/cmdline File opened for reading /proc/1069/fd File opened for reading /proc/1184/exe File opened for reading /proc/1187/exe File opened for reading /proc/1099/exe File opened for reading /proc/1037/exe File opened for reading /proc/1168/cmdline File opened for reading /proc/1169/fd File opened for reading /proc/1302/exe File opened for reading /proc/1037/fd File opened for reading /proc/1242/status File opened for reading /proc/1516/exe File opened for reading /proc/1189/fd File opened for reading /proc/1072/cmdline File opened for reading /proc/1152/cmdline File opened for reading /proc/1167/fd File opened for reading /proc/1352/cmdline File opened for reading /proc/1043/status File opened for reading /proc/1154/exe File opened for reading /proc/1127/fd File opened for reading /proc/1162/fd File opened for reading /proc/1173/cmdline File opened for reading /proc/1235/cmdline File opened for reading /proc/1514/status File opened for reading /proc/1139/cmdline File opened for reading /proc/1433/status File opened for reading /proc/1456/cmdline File opened for reading /proc/1127/status File opened for reading /proc/1186/status File opened for reading /proc/1152/status File opened for reading /proc/1186/cmdline File opened for reading /proc/1187/fd File opened for reading /proc/1338/exe File opened for reading /proc/1067/cmdline File opened for reading /proc/1037/status File opened for reading /proc/1099/cmdline File opened for reading /proc/1135/status File opened for reading /proc/1515/cmdline File opened for reading /proc/1515/exe File opened for reading /proc/1023/cmdline File opened for reading /proc/1149/status