Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
128s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
27/12/2024, 01:43
Behavioral task
behavioral1
Sample
JaffaCakes118_ffc1115fbe418e1cdc08a4383cfd4a806309846c6c618e21b7781eb4e3516444
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
JaffaCakes118_ffc1115fbe418e1cdc08a4383cfd4a806309846c6c618e21b7781eb4e3516444
-
Size
115KB
-
MD5
c6be6b21576843795f37a6e33be8dfaa
-
SHA1
af03fd73cf0b7ed9015dfbe91acd7f661000933b
-
SHA256
ffc1115fbe418e1cdc08a4383cfd4a806309846c6c618e21b7781eb4e3516444
-
SHA512
e81ab216960d9024904bfd633f0f2d2732b20d2133bf73361237d6ab28bee19f5a93adc4a29e01a9b7900de8518e21ad1d57321abdf1d14d8474a12ec843f522
-
SSDEEP
3072:pKky8tri60kFqa5qdU7e/hWoVlphadtAeAniyILAv0lLF:aWri5qH74A+phad+eAniyIsv0lLF
Malware Config
Signatures
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route JaffaCakes118_ffc1115fbe418e1cdc08a4383cfd4a806309846c6c618e21b7781eb4e3516444 -
Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 2442 JaffaCakes118_ffc1115fbe418e1cdc08a4383cfd4a806309846c6c618e21b7781eb4e3516444 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/route JaffaCakes118_ffc1115fbe418e1cdc08a4383cfd4a806309846c6c618e21b7781eb4e3516444