Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

8

7546b0b643...a61d6d

debian-9-mips

7

Analysis

  • max time kernel
    17s
  • max time network
    49s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20231215-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20231215-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    25/01/2024, 19:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7546b0b643c6138637aa072bbda61d6d

  • Size

    204KB

  • MD5

    7546b0b643c6138637aa072bbda61d6d

  • SHA1

    98eea3fa6d56d5457049479980ca53affa7db72a

  • SHA256

    379fb36f6e1f8c1161528d11a1e5b79e09b9d202a692b674f3b2ffe8df320ba3

  • SHA512

    3b7055f369ccb220a224687fa07e80edef2786f3089129885ef1985b07b2583cc01e5bbddf9b10d732dd552447839d9fdedcb6e60049a7f55ed7ea10fe323a0b

  • SSDEEP

    3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6co:7O/QJHZweEL/NOjCHm7FZZnc

Score
7/10

Malware Config

Signatures

  • Changes its process name 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

  • Writes file to system bin folder 1 TTPs 2 IoCs
  • Reads system network configuration 1 TTPs 3 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/7546b0b643c6138637aa072bbda61d6d
    /tmp/7546b0b643c6138637aa072bbda61d6d
    1⤵
    • Enumerates active TCP sockets
    • Reads system network configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:723
  • /bin/sh
    sh -c "killall -9 telnetd utelnetd scfgmgr"
    1⤵
      PID:726
      • /usr/bin/killall
        killall -9 telnetd utelnetd scfgmgr
        2⤵
        • Reads runtime system information
        PID:729

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads