Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
140s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
27/07/2024, 04:07
Static task
static1
Behavioral task
behavioral1
Sample
76fe4fdd628218f630ba50f91ceba852_JaffaCakes118
Resource
ubuntu1804-amd64-20240729-en
General
-
Target
76fe4fdd628218f630ba50f91ceba852_JaffaCakes118
-
Size
8.7MB
-
MD5
76fe4fdd628218f630ba50f91ceba852
-
SHA1
6e90f2fe619597115e5b8dd8b0d1fb0c8ad33fa4
-
SHA256
041bc20ca8ac3161098cbc976e67e3c0f1b672ad36ecbe22fd21cbd53bcaa742
-
SHA512
7956505ae0d8479a92ddf97bb09a757566ef526934ee06b4273f0fc450e4da9204808ffa4f4674f4e6e313eb718a7c65f258ef8d23b9769b8aa12d47610d8011
-
SSDEEP
98304:f27or8Dynb9c4EHv9/fW/NQXPvTCaedHuaJE3fSdCnKg27Xk:f27or8DyO4UnwQfvTCXdHua4No
Malware Config
Signatures
-
Adds new SSH keys 1 IoCs
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
description ioc Process File opened for modification /root/.ssh/authorized_keys 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 -
Deletes itself 1 IoCs
pid 1513 -
Deletes log files 1 TTPs 1 IoCs
Deletes log files on the system.
description ioc Process File deleted /var/log/tmp/76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo cat -
Reads CPU attributes 1 TTPs 30 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online uptime File opened for reading /sys/devices/system/cpu/online free File opened for reading /sys/devices/system/cpu/online free File opened for reading /sys/devices/system/cpu/online free File opened for reading /sys/devices/system/cpu/online uptime File opened for reading /sys/devices/system/cpu/online free File opened for reading /sys/devices/system/cpu/online uptime File opened for reading /sys/devices/system/cpu/online free File opened for reading /sys/devices/system/cpu/online free File opened for reading /sys/devices/system/cpu/online uptime File opened for reading /sys/devices/system/cpu/online free File opened for reading /sys/devices/system/cpu/online uptime File opened for reading /sys/devices/system/cpu/online free File opened for reading /sys/devices/system/cpu/online free File opened for reading /sys/devices/system/cpu/online uptime File opened for reading /sys/devices/system/cpu/online uptime File opened for reading /sys/devices/system/cpu/online free File opened for reading /sys/devices/system/cpu/online free File opened for reading /sys/devices/system/cpu/online uptime File opened for reading /sys/devices/system/cpu/online uptime File opened for reading /sys/devices/system/cpu/online uptime File opened for reading /sys/devices/system/cpu/online uptime File opened for reading /sys/devices/system/cpu/online uptime File opened for reading /sys/devices/system/cpu/online free File opened for reading /sys/devices/system/cpu/online uptime File opened for reading /sys/devices/system/cpu/online free File opened for reading /sys/devices/system/cpu/online free File opened for reading /sys/devices/system/cpu/online uptime File opened for reading /sys/devices/system/cpu/online free File opened for reading /sys/devices/system/cpu/online uptime -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/554/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/1069/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/cmdline journalctl File opened for reading /proc/159/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/6/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/21/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/488/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/23/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/174/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/137/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/self/stat journalctl File opened for reading /proc/537/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/meminfo free File opened for reading /proc/167/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/17/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/1327/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/84/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/1052/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/meminfo free File opened for reading /proc/sys/kernel/osrelease uptime File opened for reading /proc/17/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/960/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/538/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/1069/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/4/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/uptime uptime File opened for reading /proc/1112/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/83/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/21/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/482/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/loadavg uptime File opened for reading /proc/1130/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/20/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/969/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/171/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/sys/kernel/osrelease uptime File opened for reading /proc/sys/kernel/osrelease free File opened for reading /proc/1175/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/137/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/7/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/418/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/451/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/sys/kernel/osrelease uptime File opened for reading /proc/sys/kernel/osrelease uptime File opened for reading /proc/169/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/sys/kernel/osrelease journalctl File opened for reading /proc/sys/kernel/osrelease free File opened for reading /proc/178/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/uptime uptime File opened for reading /proc/163/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/uptime uptime File opened for reading /proc/sys/kernel/osrelease free File opened for reading /proc/1336/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/sys/kernel/osrelease free File opened for reading /proc/loadavg uptime File opened for reading /proc/173/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/10/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/1017/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/27/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/1065/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/160/stat 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/1161/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/1318/cmdline 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118 File opened for reading /proc/sys/net/core/somaxconn 76fe4fdd628218f630ba50f91ceba852_JaffaCakes118
Processes
-
/tmp/76fe4fdd628218f630ba50f91ceba852_JaffaCakes118/tmp/76fe4fdd628218f630ba50f91ceba852_JaffaCakes1181⤵
- Adds new SSH keys
- Deletes log files
- Reads runtime system information
PID:1511 -
/bin/unameuname -a2⤵PID:1526
-
-
/bin/catcat /proc/cpuinfo2⤵
- Checks CPU configuration
PID:1527
-
-
/bin/catcat /etc/issue2⤵PID:1528
-
-
/usr/bin/freefree -m2⤵
- Reads CPU attributes
PID:1529
-
-
/usr/bin/uptimeuptime2⤵
- Reads CPU attributes
PID:1530
-
-
/bin/journalctljournalctl -S "@0" -u sshd2⤵
- Reads runtime system information
PID:1531
-
-
/bin/catcat "/var/log/auth*"2⤵PID:1532
-
-
/bin/zcatzcat "/var/log/auth*"2⤵PID:1533
-
-
/bin/gzipgzip -cd "/var/log/auth*"2⤵PID:1533
-
-
/usr/bin/freefree -m2⤵
- Reads CPU attributes
PID:1534
-
-
/usr/bin/uptimeuptime2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1535
-
-
/usr/bin/freefree -m2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1536
-
-
/usr/bin/uptimeuptime2⤵
- Reads CPU attributes
PID:1537
-
-
/usr/bin/freefree -m2⤵
- Reads CPU attributes
PID:1540
-
-
/usr/bin/uptimeuptime2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1541
-
-
/usr/bin/freefree -m2⤵
- Reads CPU attributes
PID:1542
-
-
/usr/bin/uptimeuptime2⤵
- Reads CPU attributes
PID:1543
-
-
/usr/bin/freefree -m2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1544
-
-
/usr/bin/uptimeuptime2⤵
- Reads CPU attributes
PID:1545
-
-
/usr/bin/freefree -m2⤵
- Reads CPU attributes
PID:1546
-
-
/usr/bin/uptimeuptime2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1547
-
-
/usr/bin/freefree -m2⤵
- Reads CPU attributes
PID:1548
-
-
/usr/bin/uptimeuptime2⤵
- Reads CPU attributes
PID:1549
-
-
/usr/bin/freefree -m2⤵
- Reads CPU attributes
PID:1550
-
-
/usr/bin/uptimeuptime2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1551
-
-
/usr/bin/freefree -m2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1552
-
-
/usr/bin/uptimeuptime2⤵
- Reads CPU attributes
PID:1553
-
-
/usr/bin/freefree -m2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1554
-
-
/usr/bin/uptimeuptime2⤵
- Reads CPU attributes
PID:1555
-
-
/usr/bin/freefree -m2⤵
- Reads CPU attributes
PID:1556
-
-
/usr/bin/uptimeuptime2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1557
-
-
/usr/bin/freefree -m2⤵
- Reads CPU attributes
PID:1558
-
-
/usr/bin/uptimeuptime2⤵
- Reads CPU attributes
PID:1559
-
-
/usr/bin/freefree -m2⤵
- Reads CPU attributes
PID:1560
-
-
/usr/bin/uptimeuptime2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1561
-
-
/usr/bin/freefree -m2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1562
-
-
/usr/bin/uptimeuptime2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1563
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
381B
MD59da18d38b6dd4c4aa84642378d63fa89
SHA1c5a976691e4b5963b5e760044f22cc9685268db6
SHA25643062900b2539d8d1f67f30fa7042c56b53541f63875b5f0de5d8fbde0e0a8bf
SHA512222b20b5b2ff8956c13dbac1f8d3f81435613b751913d65f4c4082ea9c1a7c8ae91be17a24ef4ae0c708bfe09daab552bb209615714d70acfaaed89c536c71b3