Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
06/04/2024, 19:21
Behavioral task
behavioral1
Sample
1544-1-0x0000000008048000-0x00000000080578e0-memory.dmp
Resource
ubuntu1804-amd64-20240226-en
General
-
Target
1544-1-0x0000000008048000-0x00000000080578e0-memory.dmp
-
Size
56KB
-
MD5
5715a74e0b0ad91cfd8057aafa2a3ad8
-
SHA1
6a084798592f8485e2df2b42376688cf3ca1237d
-
SHA256
9967045f1441b11c9b5bbfa9fbbc8b25201642cea0d0e883187b563449e1723e
-
SHA512
30bcdb372a9bb1719fe375bc68b81c591a0674ef1cf7ceed45faf7365793666891f8f2191f4bbb8d7bc369abac9eaa469a0ee6f3cd3dae932674c33feb8e087a
-
SSDEEP
1536:gL2Hj8HfU6vJkcwECNLkcXsdwKG5HKJN8uTH0s:gMj8HfU6vJkcwECacXsd5GxKb8QH/
Malware Config
Signatures
-
Contacts a large (113868) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /var/Sofia 1556 1544-1-0x0000000008048000-0x00000000080578e0-memory.dmp -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 1544-1-0x0000000008048000-0x00000000080578e0-memory.dmp File opened for modification /dev/misc/watchdog 1544-1-0x0000000008048000-0x00000000080578e0-memory.dmp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/31/cmdline File opened for reading /proc/1104/cmdline File opened for reading /proc/1119/cmdline File opened for reading /proc/14/cmdline File opened for reading /proc/1198/cmdline File opened for reading /proc/1255/cmdline File opened for reading /proc/1310/cmdline File opened for reading /proc/661/cmdline File opened for reading /proc/168/cmdline File opened for reading /proc/169/cmdline File opened for reading /proc/173/cmdline File opened for reading /proc/318/cmdline File opened for reading /proc/490/cmdline File opened for reading /proc/1024/cmdline File opened for reading /proc/1091/cmdline File opened for reading /proc/1/cmdline File opened for reading /proc/1480/cmdline File opened for reading /proc/1149/cmdline File opened for reading /proc/13/cmdline File opened for reading /proc/177/cmdline File opened for reading /proc/206/cmdline File opened for reading /proc/257/cmdline File opened for reading /proc/455/cmdline File opened for reading /proc/479/cmdline File opened for reading /proc/958/cmdline File opened for reading /proc/8/cmdline File opened for reading /proc/34/cmdline File opened for reading /proc/161/cmdline File opened for reading /proc/166/cmdline File opened for reading /proc/526/cmdline File opened for reading /proc/1203/cmdline File opened for reading /proc/17/cmdline File opened for reading /proc/1095/cmdline File opened for reading /proc/1128/cmdline File opened for reading /proc/1457/cmdline File opened for reading /proc/167/cmdline File opened for reading /proc/1077/cmdline File opened for reading /proc/32/cmdline File opened for reading /proc/445/cmdline File opened for reading /proc/1177/cmdline File opened for reading /proc/137/cmdline File opened for reading /proc/505/cmdline File opened for reading /proc/611/cmdline File opened for reading /proc/1560/cmdline File opened for reading /proc/115/cmdline File opened for reading /proc/12/cmdline File opened for reading /proc/28/cmdline File opened for reading /proc/36/cmdline File opened for reading /proc/82/cmdline File opened for reading /proc/84/cmdline File opened for reading /proc/98/cmdline File opened for reading /proc/501/cmdline File opened for reading /proc/9/cmdline File opened for reading /proc/1561/cmdline File opened for reading /proc/968/cmdline File opened for reading /proc/1312/cmdline File opened for reading /proc/509/cmdline File opened for reading /proc/26/cmdline File opened for reading /proc/30/cmdline File opened for reading /proc/80/cmdline File opened for reading /proc/165/cmdline File opened for reading /proc/487/cmdline File opened for reading /proc/504/cmdline File opened for reading /proc/1158/cmdline