Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
11/03/2025, 04:52
Behavioral task
behavioral1
Sample
c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
6 signatures
150 seconds
General
-
Target
c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf
-
Size
50KB
-
MD5
5a5c0e1c92b7937f2e88b11478bbf631
-
SHA1
358706dc4eaa65c3da0702a8ad9bba4de6bfafaf
-
SHA256
c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891
-
SHA512
2e0ea5f3db9bfdd04b33b7bf72b3eebb0fb06f8df6b0fca442856de6ccfd284536505d08b3b31167ea86ae1ca84456340a73bc87c4325cc598a4834aab3500a1
-
SSDEEP
768:TsHcXPbBIKrfx/RaK/3cgWQI9YvTuDorPg8rpI/h4B36OGVzONszaotkMgk:+cl9D3cNj9YvSug8dI5GqO6vFH
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for modification /dev/misc/watchdog c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf -
Renames itself 1 IoCs
pid Process 649 c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 152.53.15.127 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself systemd-udevd 649 c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf -
description ioc Process File opened for reading /proc/649/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/12/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/14/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/108/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/299/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/644/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/75/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/131/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/139/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/403/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/439/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/441/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/25/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/283/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/4/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/19/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/107/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/5/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/7/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/16/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/23/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/642/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/648/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/1/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/11/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/26/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/97/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/389/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/43/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/6/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/8/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/20/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/27/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/41/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/148/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/282/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/641/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/15/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/24/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/42/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/267/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/269/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/635/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/13/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/214/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/646/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/17/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/28/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/105/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/137/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/280/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/3/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/10/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/18/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/165/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/29/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/270/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/297/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/311/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/316/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/647/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/21/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/604/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf File opened for reading /proc/2/comm c767b3204bd8bfde69e411b3d0723f0eef5cf70a8091300cd00c50f4efe84891.elf