Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    123s
  • max time network
    150s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240418-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    22/08/2024, 01:15

General

  • Target

    28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf

  • Size

    80KB

  • MD5

    b15a935246018d21335632060ff6db6c

  • SHA1

    79e80a929268f8361242e53f97db3d93a94a4650

  • SHA256

    28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86

  • SHA512

    75cc9ab1f28dbc80d187f7b80ddf1540ef8093b1ea404cb51950714c23d59de922b91bfac7e883bd1449d7cf3cab3ac34d4208991374290e8f87d9623a25b579

  • SSDEEP

    1536:c5dkjueVIuJjj6kZONnONgpNFGIv3W9tmgFUBeI9KJZC2:cHJeVIuJH6kuvG93FUfKfb

Score
9/10

Malware Config

Signatures

  • Contacts a large (54036) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Renames itself 1 IoCs
  • Unexpected DNS network traffic destination 11 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf
    /tmp/28b5bc34206b2ba9c56e2c1d05d900280df04ea9f71fd422a9ce01e7c78aaa86.elf
    1⤵
    • Renames itself
    • Changes its process name
    • Reads runtime system information
    PID:730

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads