bdbc35721238ef0c38acf962295c36bae59c6472b70bb469439c1c370ce472f6 | Triage

Analysis

max time kernel
148s
max time network
206s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23-11-2024 18:22

Sharing

Report Analysis Logs

General

Target

cve_2024_6387/arm5
Size

5.0MB
MD5

f88f1c803432b72243da85089264bc92
SHA1

380f766eec0b181cb094b51e366487deabd0d312
SHA256

1d37cf0bbe88047caf8442db890edad597a52a70fbab49ce258a51f9ea1b3163
SHA512

c6e56e053c0b6c0d623d2babf45bd4ffeddc3fbb7a886cda96f28f03430420b01d860e00691c6da3fc804be441536466183c2a60b340d903f6c874a476d04113
SSDEEP

49152:wagnab47zaAs4cqq0OM9VpiOMXwXpfdmFEo:wagn8cVs4cqq6ZdmFEo

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
defense_evasion

Impair Defenses
T1562

Processes:

arm5

description ioc process

File opened for modification /dev/watchdog arm5
File opened for modification /dev/misc/watchdog arm5

Creates/modifies environment variables 1 TTPs 3 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

Processes:

arm5

description	ioc	process
File opened for modification	/etc/profile.d/bash.cfg	arm5
File opened for modification	/etc/profile.d/bash.cfg.sh	arm5
File opened for modification	/etc/profile.d/gateway.sh	arm5

Modifies init.d 2 TTPs 18 IoCs

Adds/modifies system service, likely for persistence.

Boot or Logon Autostart Execution

RC Scripts

Processes:

arm5

description	ioc	process
File opened for modification	/etc/init.d/rsyslog	arm5
File opened for modification	/etc/init.d/selinux-autorelabel	arm5
File opened for modification	/etc/init.d/ssh	arm5
File opened for modification	/etc/init.d/cron	arm5
File opened for modification	/etc/init.d/hwclock.sh	arm5
File opened for modification	/etc/init.d/sudo	arm5
File opened for modification	/etc/init.d/auditd	arm5
File opened for modification	/etc/init.d/console-setup.sh	arm5
File opened for modification	/etc/init.d/procps	arm5
File opened for modification	/etc/init.d/udev	arm5
File opened for modification	/etc/init.d/x11-common	arm5
File opened for modification	/etc/init.d/dns-udp4	arm5
File opened for modification	/etc/init.d/exim4	arm5
File opened for modification	/etc/init.d/networking	arm5
File opened for modification	/etc/init.d/keyboard-setup.sh	arm5
File opened for modification	/etc/init.d/kmod	arm5
File opened for modification	/etc/init.d/alsa-utils	arm5
File opened for modification	/etc/init.d/dbus	arm5

Modifies Bash startup script 2 TTPs 3 IoCs

Boot or Logon Autostart Execution

Unix Shell Configuration Modification

Processes:

arm5

description	ioc	process
File opened for modification	/etc/profile.d/bash.cfg	arm5
File opened for modification	/etc/profile.d/bash.cfg.sh	arm5
File opened for modification	/etc/profile.d/gateway.sh	arm5

Enumerates kernel/hardware configuration 1 TTPs 7 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

Processes:

arm5systemctlsystemctlsystemctlsystemctlsystemctlarm5

description	ioc	process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	arm5
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	arm5

Reads runtime system information 22 IoCs

Reads data from /proc virtual filesystem.

Processes:

systemctlsystemctlsystemctlsystemctlsystemctlsedmount

description	ioc	process
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/filesystems	systemctl

/tmp/cve_2024_6387/arm5
/tmp/cve_2024_6387/arm5
1⤵
- Enumerates kernel/hardware configuration
PID:765
- /tmp/cve_2024_6387/arm5
  /tmp/cve_2024_6387/arm5 " "
  2⤵
  - Modifies Watchdog functionality
  - Creates/modifies environment variables
  - Modifies init.d
  - Modifies Bash startup script
  - Enumerates kernel/hardware configuration
  PID:769
- - /usr/sbin/update-rc.d
    update-rc.d dns-udp4 defaults
    3⤵
    PID:776
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:777
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:777
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:777
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:777
  - - /sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:777
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:777
- - /bin/mount
    mount -o bind /tmp/ /proc/769
    3⤵
    - Reads runtime system information
    PID:778
- - /usr/sbin/service
    service cron start
    3⤵
    PID:779
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:780
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:781
  - - /bin/systemctl
      systemctl --quiet is-active multi-user.target
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:782
  - - /bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:784
  - - /bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      Reads runtime system information
      PID:785
- - /usr/local/sbin/systemctl
    systemctl "--job-mode=ignore-dependencies" start cron.service
    3⤵
    PID:779
- - /usr/local/bin/systemctl
    systemctl "--job-mode=ignore-dependencies" start cron.service
    3⤵
    PID:779
- - /usr/sbin/systemctl
    systemctl "--job-mode=ignore-dependencies" start cron.service
    3⤵
    PID:779
- - /usr/bin/systemctl
    systemctl "--job-mode=ignore-dependencies" start cron.service
    3⤵
    PID:779
- - /sbin/systemctl
    systemctl "--job-mode=ignore-dependencies" start cron.service
    3⤵
    PID:779
- - /bin/systemctl
    systemctl "--job-mode=ignore-dependencies" start cron.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:779
- - /bin/systemctl
    systemctl start crond.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:786

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Boot or Logon Initialization Scripts

RC Scripts

Event Triggered Execution

Unix Shell Configuration Modification

Hijack Execution Flow

Path Interception by PATH Environment Variable

Privilege Escalation

Boot or Logon Autostart Execution

Boot or Logon Initialization Scripts

RC Scripts

Event Triggered Execution

Unix Shell Configuration Modification

Hijack Execution Flow

Path Interception by PATH Environment Variable

Defense Evasion

Hijack Execution Flow

Path Interception by PATH Environment Variable

Impair Defenses

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/.mod

Filesize
27B

MD5
f449ef47c4f79ab4ecfe3d11022333d5

SHA1
61ebb524cee5a049cc96bf2cbf339a47dcb1b622

SHA256
503dffa20530956c5f61187e00935f20fe508c35dbb1fcf665b5d28d07d3d704

SHA512
a7015de8bd582dbf7ce6df708a58a725e1b1cd472c6616fbb89a9738c533c042ac39c071ca0cf2fc5df8e56f33bf8a28b1ebd3076570f5028cff773af89031f6

Download Submit
/boot/system.pub

Filesize
5.0MB

MD5
f88f1c803432b72243da85089264bc92

SHA1
380f766eec0b181cb094b51e366487deabd0d312

SHA256
1d37cf0bbe88047caf8442db890edad597a52a70fbab49ce258a51f9ea1b3163

SHA512
c6e56e053c0b6c0d623d2babf45bd4ffeddc3fbb7a886cda96f28f03430420b01d860e00691c6da3fc804be441536466183c2a60b340d903f6c874a476d04113

Download Submit
/etc/.cfg

Filesize
57B

MD5
25bfc97b9241077f7ee65c9d5831c0ae

SHA1
4d1e84cfe6f0619642400cbcc77ee008d452f622

SHA256
7e18da2137e9453fd98ed61aa79420a173383b2f7a5fe6538b70fbb560f9b3f6

SHA512
e3686c1fe664e67fc503275c6c0fa831ee43c1b081d8f826a616314505e3f952f98a8697911d1799e3f8c1957cd3a1bb5f888766877e5081b32942a6f2d8bff3

Download Submit
/etc/.cfg

Filesize
106B

MD5
6fd96b90f8916d08c2a314e18748d82a

SHA1
7ba0dd2a9aa46bc9471eba430adc77de593368cc

SHA256
308f37a527d75997fd540f997423d85efbaa39c63258e2ea50db358b8cd9229f

SHA512
ec1b0cf9da3fd137ef1ecfe72659690dc83c8050371b9586fbccd854965b319a197129a5824a438ddf8ff6f00ea5cd0b0a29a44fc3488ebbf74307f0000c6d08

Download Submit
/etc/init.d/dns-udp4

Filesize
159B

MD5
79f1a0bf1a838c817142e43a5818733a

SHA1
768ed04a737dbdc969165092694e0e977321ca19

SHA256
a3f7d4499b03a14ff2de76122b6a61c221151f59daa6a63a78ae5a805c95a482

SHA512
b6d6f76f3e5b768a6670e05276724b70609259c856ba90ad34f8a782ac40134b9cf5cdabebb4aa55f076a786cedf8491adda9835f9d4aee90bd1820a45b2fbce

Download Submit
/etc/profile.d/gateway.sh

Filesize
693B

MD5
6285c9d7cf3df422e4bd5d7506c9e45a

SHA1
b6c8e06f5ef8558c64b30a6a0e5fea93f2cfd915

SHA256
269c17e2c2b958a8943f20ab9a00741c1f446323b6fa947acd1b21aab6045973

SHA512
bea934b29d519bac6aa271bf07ae97924ee7a1a3b674bce66f0f5a6f01ee3da3647dedc765a3e5054b5ed34426854e327b3bdc1e585b29c326c2ddb2bb1ea8a4

Download Submit