Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240611-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
11/08/2024, 18:03
Behavioral task
behavioral1
Sample
8b68168778df50cc2390678bc1744a32_JaffaCakes118
Resource
ubuntu2004-amd64-20240611-en
General
-
Target
8b68168778df50cc2390678bc1744a32_JaffaCakes118
-
Size
1.2MB
-
MD5
8b68168778df50cc2390678bc1744a32
-
SHA1
4a508e301183920439776f8abbf0b8bcf93aa5f9
-
SHA256
bd7fc5fa571373babbc3a125580ca5a622656020d2bd4b72e23fbe1ddf4bc2ef
-
SHA512
5633bb5357ff78c43717591815e8ffdc0f7b716b9ea75e20fcc3d962b852210e22abf78ba6c2c4c7366537d6a5c60ad39e92e96d9dec210918ef6c4052125cf3
-
SSDEEP
24576:e845rUHu6gVJKG75oFpA0VWiX4G2y1q2rJp0:7451RVJKGtSA0VWioVu9p0
Malware Config
Signatures
-
MrBlack trojan 1 IoCs
resource yara_rule behavioral1/files/fstream-4.dat family_mrblack -
Executes dropped EXE 2 IoCs
ioc pid Process /usr/bin/bsd-port/getty 1464 getty /usr/bin/.sshd 1480 .sshd -
description ioc Process File opened for modification /etc/init.d/DbSecuritySpt 8b68168778df50cc2390678bc1744a32_JaffaCakes118 File opened for modification /etc/init.d/selinux getty -
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route getty -
Write file to user bin folder 1 TTPs 12 IoCs
description ioc Process File opened for modification /usr/bin/bsd-port/getty cp File opened for modification /usr/bin/dpkgd/lsof cp File opened for modification /usr/bin/dpkgd/ps cp File opened for modification /usr/bin/dpkgd/ss cp File opened for modification /usr/bin/lsof cp File opened for modification /usr/bin/ss cp File opened for modification /usr/bin/bsd-port/conf.n getty File opened for modification /usr/bin/bsd-port/getty.lock 8b68168778df50cc2390678bc1744a32_JaffaCakes118 File opened for modification /usr/bin/bsd-port/getty.lock getty File opened for modification /usr/bin/.sshd cp File opened for modification /usr/bin/ps cp File opened for modification /usr/bin/bsd-port/udevd.lock 8b68168778df50cc2390678bc1744a32_JaffaCakes118 -
Writes file to system bin folder 1 TTPs 3 IoCs
description ioc Process File opened for modification /bin/ss cp File opened for modification /bin/lsof cp File opened for modification /bin/ps cp -
Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo getty File opened for reading /proc/cpuinfo 8b68168778df50cc2390678bc1744a32_JaffaCakes118 -
Reads system network configuration 1 TTPs 4 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/dev getty File opened for reading /proc/net/dev 8b68168778df50cc2390678bc1744a32_JaffaCakes118 File opened for reading /proc/net/route getty File opened for reading /proc/net/arp getty -
Reads runtime system information 37 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/meminfo getty File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/stat getty File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/sys/kernel/version 8b68168778df50cc2390678bc1744a32_JaffaCakes118 File opened for reading /proc/filesystems mkdir File opened for reading /proc/sys/kernel/version .sshd File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/meminfo 8b68168778df50cc2390678bc1744a32_JaffaCakes118 File opened for reading /proc/sys/kernel/version getty File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/stat 8b68168778df50cc2390678bc1744a32_JaffaCakes118 File opened for reading /proc/cmdline insmod -
Writes file to tmp directory 7 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/moni.lod .sshd File opened for modification /tmp/notify.file .sshd File opened for modification /tmp/gates.lod .sshd File opened for modification /tmp/moni.lod 8b68168778df50cc2390678bc1744a32_JaffaCakes118 File opened for modification /tmp/bill.lock 8b68168778df50cc2390678bc1744a32_JaffaCakes118 File opened for modification /tmp/gates.lod 8b68168778df50cc2390678bc1744a32_JaffaCakes118 File opened for modification /tmp/notify.file 8b68168778df50cc2390678bc1744a32_JaffaCakes118
Processes
-
/tmp/8b68168778df50cc2390678bc1744a32_JaffaCakes118/tmp/8b68168778df50cc2390678bc1744a32_JaffaCakes1181⤵
- Modifies init.d
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1398 -
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"2⤵PID:1446
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt3⤵PID:1447
-
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"2⤵PID:1448
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt3⤵PID:1449
-
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"2⤵PID:1450
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt3⤵PID:1451
-
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"2⤵PID:1452
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt3⤵PID:1453
-
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"2⤵PID:1454
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt3⤵PID:1455
-
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"2⤵PID:1456
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port3⤵
- Reads runtime system information
PID:1457
-
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"2⤵PID:1458
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port3⤵
- Reads runtime system information
PID:1459
-
-
-
/bin/shsh -c "cp -f /tmp/8b68168778df50cc2390678bc1744a32_JaffaCakes118 /usr/bin/bsd-port/getty"2⤵PID:1460
-
/usr/bin/cpcp -f /tmp/8b68168778df50cc2390678bc1744a32_JaffaCakes118 /usr/bin/bsd-port/getty3⤵
- Write file to user bin folder
- Reads runtime system information
PID:1461
-
-
-
/bin/shsh -c /usr/bin/bsd-port/getty2⤵PID:1463
-
/usr/bin/bsd-port/getty/usr/bin/bsd-port/getty3⤵
- Executes dropped EXE
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
PID:1464 -
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"4⤵PID:1472
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux5⤵PID:1473
-
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"4⤵PID:1474
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux5⤵PID:1475
-
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"4⤵PID:1476
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux5⤵PID:1477
-
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"4⤵PID:1481
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux5⤵PID:1482
-
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"4⤵PID:1483
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux5⤵PID:1484
-
-
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"4⤵PID:1485
-
/usr/bin/mkdirmkdir -p /usr/bin/dpkgd5⤵
- Reads runtime system information
PID:1486
-
-
-
/bin/shsh -c "cp -f /bin/lsof /usr/bin/dpkgd/lsof"4⤵PID:1487
-
/usr/bin/cpcp -f /bin/lsof /usr/bin/dpkgd/lsof5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1488
-
-
-
/bin/shsh -c "mkdir -p /bin"4⤵PID:1489
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1490
-
-
-
/bin/shsh -c "mkdir -p /bin"4⤵PID:1491
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1492
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/lsof"4⤵PID:1493
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /bin/lsof5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1494
-
-
-
/bin/shsh -c "chmod 0755 /bin/lsof"4⤵PID:1495
-
/usr/bin/chmodchmod 0755 /bin/lsof5⤵PID:1496
-
-
-
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"4⤵PID:1497
-
/usr/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1498
-
-
-
/bin/shsh -c "mkdir -p /bin"4⤵PID:1499
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1500
-
-
-
/bin/shsh -c "mkdir -p /bin"4⤵PID:1501
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1502
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"4⤵PID:1503
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ps5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1504
-
-
-
/bin/shsh -c "chmod 0755 /bin/ps"4⤵PID:1505
-
/usr/bin/chmodchmod 0755 /bin/ps5⤵PID:1506
-
-
-
/bin/shsh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"4⤵PID:1507
-
/usr/bin/cpcp -f /bin/ss /usr/bin/dpkgd/ss5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1508
-
-
-
/bin/shsh -c "mkdir -p /bin"4⤵PID:1509
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1510
-
-
-
/bin/shsh -c "mkdir -p /bin"4⤵PID:1511
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1512
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"4⤵PID:1513
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ss5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1514
-
-
-
/bin/shsh -c "chmod 0755 /bin/ss"4⤵PID:1515
-
/usr/bin/chmodchmod 0755 /bin/ss5⤵PID:1516
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1517
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1518
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1519
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1520
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"4⤵PID:1521
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/lsof5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1522
-
-
-
/bin/shsh -c "chmod 0755 /usr/bin/lsof"4⤵PID:1523
-
/usr/bin/chmodchmod 0755 /usr/bin/lsof5⤵PID:1524
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1525
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1526
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1527
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1528
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/ps"4⤵PID:1529
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/ps5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1530
-
-
-
/bin/shsh -c "chmod 0755 /usr/bin/ps"4⤵PID:1531
-
/usr/bin/chmodchmod 0755 /usr/bin/ps5⤵PID:1532
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1533
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1534
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1535
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1536
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/ss"4⤵PID:1537
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/ss5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1538
-
-
-
/bin/shsh -c "chmod 0755 /usr/bin/ss"4⤵PID:1539
-
/usr/bin/chmodchmod 0755 /usr/bin/ss5⤵PID:1540
-
-
-
/bin/shsh -c "insmod /usr/bin/bsd-port/xpacket.ko"4⤵PID:1544
-
/usr/sbin/insmodinsmod /usr/bin/bsd-port/xpacket.ko5⤵
- Reads runtime system information
PID:1546
-
-
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"2⤵PID:1466
-
/usr/bin/mkdirmkdir -p /usr/bin3⤵
- Reads runtime system information
PID:1467
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"2⤵PID:1468
-
/usr/bin/mkdirmkdir -p /usr/bin3⤵
- Reads runtime system information
PID:1469
-
-
-
/bin/shsh -c "cp -f /tmp/8b68168778df50cc2390678bc1744a32_JaffaCakes118 /usr/bin/.sshd"2⤵PID:1470
-
/usr/bin/cpcp -f /tmp/8b68168778df50cc2390678bc1744a32_JaffaCakes118 /usr/bin/.sshd3⤵
- Write file to user bin folder
- Reads runtime system information
PID:1471
-
-
-
/bin/shsh -c /usr/bin/.sshd2⤵PID:1479
-
/usr/bin/.sshd/usr/bin/.sshd3⤵
- Executes dropped EXE
- Reads runtime system information
- Writes file to tmp directory
PID:1480
-
-
-
/bin/shsh -c "insmod /tmp/xpacket.ko"2⤵PID:1547
-
/usr/sbin/insmodinsmod /tmp/xpacket.ko3⤵
- Reads runtime system information
PID:1548
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64B
MD52453cbac49e8613bcbdbc5b6aa72e4a0
SHA1f70409358c2b70bcdfeb234d4ae80ca16411b34f
SHA2567b3d1e18f747d397b6287658187eefcbd6cd2a19f12050ecccb2162098d9c14f
SHA5126ab4d928ce32375c6a92e4f6ac6015ea1045ca97a49a9915cabfdb7418372adb2409943a7b783a9b4bb8f271d49c78ffd55f1a0caa4909ca63d4678d76054cc8
-
Filesize
36B
MD5993cc15058142d96c3daf7852c3d5ee8
SHA10950b8b391b04dd3895ea33cd3141543ebd2525d
SHA2568171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208
SHA5120c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928
-
Filesize
4B
MD57b5b23f4aadf9513306bcd59afb6e4c9
SHA162634625ada7c706b0be053ed4469260300d5658
SHA256efe8564971192c24d29c7aedb7c5230aeaf13dbac7815bb7bd2206bdcc483350
SHA51263d1a1fedea606170e37fc9343ff8e946df63db5a8a46ccc7324240ea8df8a752b76310412f6d0f247cd937449921e24f059094f69e274dcdf0df3fcee4ab636
-
Filesize
4B
MD51373b284bc381890049e92d324f56de0
SHA1d05785002742a30502dde3731b28883334e46040
SHA256477e2d13152129e72c4a47a5abed06ce422daff2ca0e99d33bc527477effee34
SHA512b409dbef7cad909beab9e2b251590e7a6773e6ef7bc3782a9adb4be3a2765fdefca68cb96b9b31e92e0edb23d521aa3adfb7c90ade660e75b1a04832d19d59f4
-
Filesize
51B
MD5a2c36bdeccb298f91e9432365a58e25c
SHA17f89088a53b288da210521d4c3e25f3cb4d63cc7
SHA2563500b1a7ac4b03c92fa65f21d540ee205a7c37e899d26c67b89c83ac2ec228bc
SHA512c9a1f8fce78cbe47f7ec5a499a7716270007a962bce8c98fc3a287d114ce5cc0fb745b34761bc970afee3a33bc4c0b9e50f97bbacf9c4d73ef3d12e290645f24
-
Filesize
73B
MD50e400bc415ed53782888252ec7a7d0b1
SHA11998d84dddadcb4ad00439aa8aa3905645c882c9
SHA256b88858fadc6974259aaecec051b326b4a731a09588f1515b90250d36b4697688
SHA512fc7e099c011e913432f9caac4a14ba7b563adf774f87a769e7966cac64311706e318a19ea2f6236b22b7bc3b2a6d5eb379d11806c1d602a9cdfc7a118c0921f2
-
Filesize
1.2MB
MD58b68168778df50cc2390678bc1744a32
SHA14a508e301183920439776f8abbf0b8bcf93aa5f9
SHA256bd7fc5fa571373babbc3a125580ca5a622656020d2bd4b72e23fbe1ddf4bc2ef
SHA5125633bb5357ff78c43717591815e8ffdc0f7b716b9ea75e20fcc3d962b852210e22abf78ba6c2c4c7366537d6a5c60ad39e92e96d9dec210918ef6c4052125cf3
-
Filesize
171KB
MD5061386937ec7acf924438a2643a32be0
SHA101a044b9e58839bea3e58c66cb32acc16241bf91
SHA2568a26bbae9eb85aa98ef29cfe5b0a291234db6eb394c3e0c2841983dcf7dda959
SHA5122de2e56ac4c32f47b4a1945ccfb0db378e6d59019ee8004e3e5d2ec8935efb5aa8ee14b8a0b21c61a267e195d42a3232a6dcade8720de06118fd579277f59db7
-
Filesize
134KB
MD5d194576b899af45b1d2a448612ec21e5
SHA1492f7d8f28cd4397ce22fcf0d8bf3304ea93465a
SHA256a8cf81f3a1137c999c3cf336507ce120b3065e633ade01db6280d427b7d986ca
SHA512b323babd9580b91772cde29c9f22ae75b27f5ce8ce0268a48ca41713c3545dd72409932a5c48f6af66ac6e43127eb5461d1f686bd667fa1b0e56a1564db3c539
-
Filesize
164KB
MD551d83131b398a97dd38555ba57084721
SHA17d392a87f7db787dfa85fbcdf2a5ba6f0b59b4ed
SHA256e429f9d16a4cd64593b94dee8309a427fe8ca57765bf0d2e7b822efd123fe768
SHA512adc7137df75410c2535986c1e86c2e92e58f9bee70094f72f1f7adf3db125720ce281eb3f48474b0e192d672e96cbb1bc6e1ef6b26b10bf76a412c4516948216