Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    116s
  • max time network
    127s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    10/01/2025, 20:22

General

  • Target

    ssd.elf

  • Size

    135KB

  • MD5

    c7212063b2e285ec072d0ab348ee208e

  • SHA1

    5f8830f178b92946bedef6f8a58a6a762792a698

  • SHA256

    58042feda2e514f3c0badf4d7c527c8bf044e21169f287b895f7fa66e5a9c7f1

  • SHA512

    b77b00b30c424c7a2892f43373a783064c174cfc6df7ab73a944d512f11cd2c0ff6c808d656a30c3f891f28f2c46920bcd611ee48cceadc9e0a2e63b7ecd8c39

  • SSDEEP

    3072:sh+Radi7iaPw5388shgZl1AzqcZRQNeN0eaLmhxQu72m/RZ:qXaPw5Rl1AzqY0eaLmhxQu72m/RZ

Malware Config

Signatures

  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

  • Changes its process name 1 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

Processes

  • /tmp/ssd.elf
    /tmp/ssd.elf
    1⤵
    • Modifies Watchdog functionality
    • Reads system routing table
    • Changes its process name
    • Reads system network configuration
    PID:655

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads