Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240611-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    04/07/2024, 08:56

General

  • Target

    70fba938d2e205844b8858e271469b11.elf

  • Size

    45KB

  • MD5

    70fba938d2e205844b8858e271469b11

  • SHA1

    494453698f35da0855c392426379e81c655c3608

  • SHA256

    b945e14f52049b7385e55d5f2a810fdd1a870c5c30d6f4ad663df306761fd1d3

  • SHA512

    71584fda0343c2758e87df94aa85be495028eba26358dffefa4ba0cb150abf7eb78edafe519e071ed62a1560e4b97c9b7e73a1e08ba20d2258a77db99d2b4c06

  • SSDEEP

    768:cnNI/V8f31EUmCh7fz7QHPkGqqDEwecrOvgwiD7dcRfwr0IecL1FdHWWQkNylUtA:zVSq67b7QpqqDEUw6qeIry1R0

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Contacts a large (20449) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 39 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/70fba938d2e205844b8858e271469b11.elf
    /tmp/70fba938d2e205844b8858e271469b11.elf
    1⤵
    • Modifies Watchdog functionality
    • Enumerates active TCP sockets
    • Reads system network configuration
    • Reads runtime system information
    PID:707

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads