Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
130s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
-
submitted
01/09/2024, 20:30
General
-
Target
smartsynchronize/jre/bin/rmiregistry
-
Size
12KB
-
MD5
d2fc10c84b8781856273e6879f10ffd7
-
SHA1
6f2d5e2b515b3cb68d68b18ca1f3903af545e5c8
-
SHA256
3c9b4192f11b5ef7cd6825f808f078da3bc8c1754875ac4ee2326fe47ceb90f9
-
SHA512
7d2b8cf150760199bcc4b9368bff5331a906c09249dad8c24795ebe5a3c7a48a07c4d45e99374cd5b4a24a6cb4e0bd71c3b7f1e68840ae4c942a8e356519ac29
-
SSDEEP
96:RCWT+KFq8cgBXBRFKPo7DPPll2X37u3F6qYfoi2N3kNc/up7/XEV8cgBXB/t6UAD:RjZL1dKAHPH2X3EYqs2WpTD1/6/
Malware Config
Signatures
-
Changes its process name 13 IoCs
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads CPU attributes 1 TTPs 2 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 7 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/smartsynchronize/jre/bin/rmiregistry/tmp/smartsynchronize/jre/bin/rmiregistry1⤵
- Checks CPU configuration
- Reads CPU attributes
- Reads system network configuration
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD52b55842f2d55ed3e6af74c56e109cbb7
SHA1b5f5e545253bd8cc9ad1dd96c123e822d0029036
SHA256492feb0d5117b61692e3618e41c5900c74e8ba1268da2564545a56b82de3b66e
SHA51208fa77e7b333519b9b7f14afeee64ed673baab9ad1a046583878a1db9ebe78ca73ccbb05094ee455203602024e110754f271af7f6364aac82f21c9086f498522