Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

45f345dd82...5179d2

ubuntu-18.04-amd64

8

45f345dd82...5179d2

debian-9-armhf

8

45f345dd82...5179d2

debian-9-mips

7

45f345dd82...5179d2

debian-9-mipsel

7

Analysis

  • max time kernel
    152s
  • max time network
    155s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20231215-en
  • resource tags

    arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    26/12/2023, 00:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    45f345dd8221ca7d1d2e9222f55179d2

  • Size

    97KB

  • MD5

    45f345dd8221ca7d1d2e9222f55179d2

  • SHA1

    76a3f069e80957124cdf1b1e041c13b6870dfffd

  • SHA256

    54c48edfc4b9ad5b5b4e97842ed5c269374b77759b1a5bef654df3089d75311d

  • SHA512

    7a35f04ccb5355e45c280ee1663b227e8b8570bcd5d64af0a03554f51f5235a35f780c60aec0739b2b4f7222e64600ed02163116cbd2d9973c8a94c222cad4e5

  • SSDEEP

    3072:SYCZj/EZjBA3Vmqxq+7zIqStTmjNBcB9Y446QrM4HLFSQnT:SpZj/EZjczrEQT

Score
8/10
discovery

Malware Config

Signatures

  • Contacts a large (1119) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Writes DNS configuration 1 TTPs 1 IoCs

    Writes data to DNS resolver config file.

  • Reads CPU attributes 1 TTPs 1 IoCs
  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/45f345dd8221ca7d1d2e9222f55179d2
    /tmp/45f345dd8221ca7d1d2e9222f55179d2
    1⤵
      PID:650
    • /usr/local/sbin/python2
      python2 /tmp/45f345dd8221ca7d1d2e9222f55179d2
      1⤵
        PID:650
      • /usr/local/bin/python2
        python2 /tmp/45f345dd8221ca7d1d2e9222f55179d2
        1⤵
          PID:650
        • /usr/sbin/python2
          python2 /tmp/45f345dd8221ca7d1d2e9222f55179d2
          1⤵
            PID:650
          • /usr/bin/python2
            python2 /tmp/45f345dd8221ca7d1d2e9222f55179d2
            1⤵
            • Reads runtime system information
            PID:650
            • /sbin/ldconfig
              /sbin/ldconfig -p
              2⤵
                PID:669
            • /bin/sh
              sh -c "uname -p 2> /dev/null"
              1⤵
                PID:696
                • /bin/uname
                  uname -p
                  2⤵
                    PID:698

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /tmp/.. /.backups
                  Filesize

                  3B

                  MD5

                  5dd9db5e033da9c6fb5ba83c7a7ebea9

                  SHA1

                  97e01b6f38ed3790a7fed91dda9b2f288222e77d

                  SHA256

                  00bebc5be79d19e1b8b3f250dc39aebfa9a054baf5f8d61380438d92394c476a

                  SHA512

                  af4932eb6d9be1bbce35decec06ecb977d25adb76e7d636bf751c3b28f595cb83a5d163a434ebf2130d22f964412d5dcc45e0c8abea84d0f4730a41f1c60019f

                  Download Submit