Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
09/09/2024, 10:58
Behavioral task
behavioral1
Sample
d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
7 signatures
150 seconds
General
-
Target
d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118
-
Size
64KB
-
MD5
d62cfd3907009f82c45fb994c1c45bc5
-
SHA1
3b19c3cfe8af964b41ecb049f067d617973ce064
-
SHA256
aadd07ede7b53f90d841dee7af847a3f6b29d3da7583186c2fd5bb2c1b88e2b7
-
SHA512
3928fee2d964e10c5fc316f0c2f0b0942fd05b6396e0337da9cf53a1bd227fb454171efd9f7c36ff6126765ab50aeef3aa1d59e3302a435c6387c9175b837956
-
SSDEEP
1536:+rl46QWtBrYQPNseLL337hiloH6WSWuX/MMOCs2qg6U4e:G46QWtBrYQPNsef9im/SWs/dOC3qR9e
Score
9/10
Malware Config
Signatures
-
Contacts a large (20365) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for modification /dev/misc/watchdog d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 -
description ioc Process File opened for reading /proc/777/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1080/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1195/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/731/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/744/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1426/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/762/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1395/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1578/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/628/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/980/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/644/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1059/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1323/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1088/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1158/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1174/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/744/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1051/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1206/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/373/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/599/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1175/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1157/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1172/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1180/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/589/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1075/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1395/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/988/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/582/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1158/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/589/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/725/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/832/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/606/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1323/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/837/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1250/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/628/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/839/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1319/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/584/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1299/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1551/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/837/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1619/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1299/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/779/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1096/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1407/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/446/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1075/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1401/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1129/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1528/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1578/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/584/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1547/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1109/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1173/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1471/exe d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/644/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118 File opened for reading /proc/1031/fd d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118