Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    46s
  • max time network
    157s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20240221-en
  • resource tags

    arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    04/03/2025, 00:08

General

  • Target

    arm7.elf

  • Size

    176KB

  • MD5

    6d9b4dcc2c4b2637afc33319812aa90f

  • SHA1

    d80a6578c832c51f43492e2be770d2945816fdb8

  • SHA256

    2ff81e6c4d5d914652cf18225e6dfbdd6e70b03eb94b7218eb3ecd1a1d9fcf09

  • SHA512

    d84acabcbe7243b1b2e0c08ec52683cb393dd7a97ab5b5c880b5a30415365e67aeff69c22d5438250b90674f8bcbdf5d93e0a4ecbf55367bce4e8e92f820455d

  • SSDEEP

    3072:nXsaq0wQFD2URQlMpChL6fmffpagi/12kwwT738vRRIx+ZI1M/9TnMRQ:nXsaLwQFyURmMA6Mpagi/12NwM5ax+ZX

Malware Config

Signatures

  • Contacts a large (199340) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Changes its process name 1 IoCs
  • Reads runtime system information 32 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/arm7.elf
    /tmp/arm7.elf
    1⤵
    • Modifies Watchdog functionality
    • Changes its process name
    • Reads runtime system information
    PID:706

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads