Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
1.x/autorun
ubuntu-18.04-amd64
6.x/autorun
debian-9-armhf
6.x/autorun
debian-9-mips
1.x/autorun
debian-9-mipsel
6.x/crond
ubuntu-18.04-amd64
.x/inst
ubuntu-18.04-amd64
3.x/inst
debian-9-armhf
3.x/inst
debian-9-mips
3.x/inst
debian-9-mipsel
1.x/m.vbs
windows7-x64
1.x/m.vbs
windows10-2004-x64
1.x/run
ubuntu-18.04-amd64
1.x/run
debian-9-armhf
1.x/run
debian-9-mips
1.x/run
debian-9-mipsel
1.x/start
ubuntu-18.04-amd64
1.x/start
debian-9-armhf
1.x/start
debian-9-mips
1.x/start
debian-9-mipsel
1Analysis
-
max time kernel
4s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20231215-en -
resource tags
arch:mipselimage:debian9-mipsel-20231215-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
22/12/2023, 13:14
Static task
static1
Behavioral task
behavioral1
Sample
.x/autorun
Resource
ubuntu1804-amd64-20231222-en
Behavioral task
behavioral2
Sample
.x/autorun
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral3
Sample
.x/autorun
Resource
debian9-mipsbe-20231215-en
Behavioral task
behavioral4
Sample
.x/autorun
Resource
debian9-mipsel-20231215-en
Behavioral task
behavioral5
Sample
.x/crond
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral6
Sample
.x/inst
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral7
Sample
.x/inst
Resource
debian9-armhf-20231222-en
Behavioral task
behavioral8
Sample
.x/inst
Resource
debian9-mipsbe-20231222-en
Behavioral task
behavioral9
Sample
.x/inst
Resource
debian9-mipsel-20231222-en
Behavioral task
behavioral10
Sample
.x/m.vbs
Resource
win7-20231215-en
Behavioral task
behavioral11
Sample
.x/m.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral12
Sample
.x/run
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral13
Sample
.x/run
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral14
Sample
.x/run
Resource
debian9-mipsbe-20231215-en
Behavioral task
behavioral15
Sample
.x/run
Resource
debian9-mipsel-20231215-en
Behavioral task
behavioral16
Sample
.x/start
Resource
ubuntu1804-amd64-20231222-en
Behavioral task
behavioral17
Sample
.x/start
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral18
Sample
.x/start
Resource
debian9-mipsbe-20231222-en
Behavioral task
behavioral19
Sample
.x/start
Resource
debian9-mipsel-20231215-en
General
-
Target
.x/autorun
-
Size
317B
-
MD5
9729c037cb0a32811ba3eb15e3c8a789
-
SHA1
6e67d4929c0b87dd05afe1b3f5f0aed2852885c4
-
SHA256
5f03b45dc87f35120fd01f18150d2c3c807c9dc22d9433208d1bd14d5d581260
-
SHA512
ed9131f48df4f3f6503b38f064ef07c7d9a235280ecf03a0a2852f268b98e42b8b445931536bd4a4a4344fefb8a05594dae094e7e7795c9690ab5ca568b1ff8c
Malware Config
Signatures
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.9BENUL crontab -
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/filesystems crontab File opened for reading /proc/filesystems crontab -
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.x/update autorun File opened for modification /tmp/.x/mech.dir autorun File opened for modification /tmp/.x/cron.d autorun
Processes
-
/tmp/.x/autorun/tmp/.x/autorun1⤵
- Writes file to tmp directory
PID:707 -
/bin/catcat mech.dir2⤵PID:709
-
-
/usr/bin/crontabcrontab cron.d2⤵
- Creates/modifies Cron job
- Reads runtime system information
PID:711
-
-
/usr/bin/crontabcrontab -l2⤵
- Reads runtime system information
PID:716
-
-
/bin/grepgrep update2⤵PID:717
-
-
/bin/chmodchmod u+x update2⤵PID:719
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8B
MD52c625c530af099178ebf25db3d496e85
SHA149563d434be5b2dfed1c9a1057f541846d3b3377
SHA256e9d5c9174e95a00160537bb8bb8dd0aa6f437cafe50d6c36890c4e2c8fbab521
SHA512d5bb977a4a7bd4102adadbcc409677af4b4fb090e91e1d67b354921dca2b1c64257405af97f04d16988be2520b78f8405e4b78f49eebbd067e3d1de40142755b
-
Filesize
151B
MD51b1f896da06b075365ee36698edebfdf
SHA1dfea6699a342b9eed33d46d4613511bcd862c862
SHA25619eb8ba65188a4eddb7eb6682a1c4440aa8060a745088dce57c23d3af8be242a
SHA512b18c72da1016fb4149288e5329509f47bc58026b3ff4076f6cb68da3e5e6f7e92bdba1a6c7f1a596b04ef9534f09b5adc89c78c3d7ce6b00e291c742e5403b89
-
Filesize
221B
MD56cb9d72a91f788bdf670c34b7e43ffb7
SHA15668878e82ab68cbf67d96698d2af87a71de67e1
SHA2562b20de2ba21ae528b6ffe6e52428b9eb25417f73b3ffd4e8397a1b458014f6c5
SHA5121194445cb003872ca25439428112ba8edbbcf8aba7f8ac9cd06c3ae8741e9af9343dfaa0c7b8e9d74269106a3ed05911a8d1e49fc5ee8cb349e026664484aae5