hxxps://collegereaction[.]iad1[.]qualtrics[.]com/jfe/form/SV_eJcHY0KH1MQ9Xf0?Q_DL=flvRqjA1lFsyLtR_eJcHY0KH1MQ9Xf0_CGC_xAeoMSgITjc2138&Q_CHL=email

max time kernel
5s
max time network
74s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
24-04-2024 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://collegereaction.iad1.qualtrics.com/jfe/form/SV_eJcHY0KH1MQ9Xf0?Q_DL=flvRqjA1lFsyLtR_eJcHY0KH1MQ9Xf0_CGC_xAeoMSgITjc2138&Q_CHL=email

Score

4^/10

antivm

Malware Config

Signatures

Changes its process name 64 IoCs

Processes:

firefox

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	gmain	1515
Changes the process name, possibly in an attempt to hide itself	gdbus	1521
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1522
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1524
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1524
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1524
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1551
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1551
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1550
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1550
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1549
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1549
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1548
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1552
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1548
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1553
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1547
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1547
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1555
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1555
Changes the process name, possibly in an attempt to hide itself	Timer	1546
Changes the process name, possibly in an attempt to hide itself	Timer	1546
Changes the process name, possibly in an attempt to hide itself	glxtest:disk$0	1557
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1558
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1558
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1559
Changes the process name, possibly in an attempt to hide itself	Cookie	1560
Changes the process name, possibly in an attempt to hide itself	Cookie	1560
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1561
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1561
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1563
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1562
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1564
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1564
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1565
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1565
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1566
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1566
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1569
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1569
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1568
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1568
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1567
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1571
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1571
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1570
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1572
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1607
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1607
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1606
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1606
Changes the process name, possibly in an attempt to hide itself	MainThread	1570	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1608
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1608
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1608
Changes the process name, possibly in an attempt to hide itself	Socket Process	1570	firefox
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1610
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1609
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1610
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1609
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	1611
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	1611
Changes the process name, possibly in an attempt to hide itself	Timer	1612
Changes the process name, possibly in an attempt to hide itself	Timer	1612

Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

firefox

description ioc process

File opened for reading /proc/cpuinfo firefox

description	ioc	process
File opened for reading	/proc/cpuinfo	firefox

Reads CPU attributes 1 TTPs 10 IoCs

System Information Discovery

T1082

Processes:

firefoxfirefoxnautilusfirefoxfirefoxfirefoxfirefox

description	ioc	process
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	nautilus
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

glxtestfirefoxfirefoxfirefoxfirefoxdbus-daemonfirefoxfirefox

description	ioc	process
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	glxtest
File opened for reading	/sys/bus/pci/devices	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	glxtest
File opened for reading	/sys/devices/system/cpu	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

firefoxfirefoxdbus-daemonfirefoxfirefoxgvfsdfirefoxxdg-permission-storenautilusfirefoxglxtestgvfsd-trashxdg-document-portalxdg-desktop-portal-gtkxdg-desktop-portaldconf-service

description	ioc	process
File opened for reading	/proc/self/task/1940/stat	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1482/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/85	firefox
File opened for reading	/proc/sys/kernel/cap_last_cap	dbus-daemon
File opened for reading	/proc/self/fd/41	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd	gvfsd
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/1722/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	nautilus
File opened for reading	/proc/1645/cmdline	dbus-daemon
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/self/fd/37	firefox
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/1629/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/96	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/task/1962/stat	firefox
File opened for reading	/proc/filesystems	glxtest
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/filesystems	gvfsd-trash
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/1727/cmdline	dbus-daemon
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/1520/attr/current	dbus-daemon
File opened for reading	/proc/1797/smaps	firefox
File opened for reading	/proc/1731/cmdline	dbus-daemon
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/task/1484/stat	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/1624/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/75	firefox
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/fd/30	firefox
File opened for reading	/proc/self/fd/38	firefox
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/filesystems	dconf-service
File opened for reading	/proc/self/mountinfo	gvfsd-trash
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/1520/status	dbus-daemon

Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

firefox

description ioc process

File opened for modification /tmp/firefox/.parentlock firefox

description	ioc	process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/firefox
firefox -new-tab "https://collegereaction.iad1.qualtrics.com/jfe/form/SV_eJcHY0KH1MQ9Xf0?Q_DL=flvRqjA1lFsyLtR_eJcHY0KH1MQ9Xf0_CGC_xAeoMSgITjc2138&Q_CHL=email"
1⤵
PID:1482

/usr/bin/which
which /usr/bin/firefox
2⤵
PID:1483

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -new-tab "https://collegereaction.iad1.qualtrics.com/jfe/form/SV_eJcHY0KH1MQ9Xf0?Q_DL=flvRqjA1lFsyLtR_eJcHY0KH1MQ9Xf0_CGC_xAeoMSgITjc2138&Q_CHL=email"
1⤵
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1482

/usr/local/sbin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
2⤵
PID:1516

/usr/local/bin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
2⤵
PID:1516

/usr/sbin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
2⤵
PID:1516

/usr/bin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
2⤵
PID:1516

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
3⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1518

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
4⤵
- Reads runtime system information
PID:1624

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
4⤵
- Reads runtime system information
PID:1629

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
4⤵
- Reads runtime system information
PID:1635

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
4⤵
- Reads runtime system information
PID:1645

/usr/libexec/gvfsd
/usr/libexec/gvfsd
4⤵
- Reads runtime system information
PID:1652

/usr/libexec/gvfsd-trash
/usr/libexec/gvfsd-trash --spawner :1.6 /org/gtk/gvfs/exec_spaw/0
5⤵
- Reads runtime system information
PID:1731

/usr/libexec/dconf-service
/usr/libexec/dconf-service
4⤵
- Reads runtime system information
PID:1722

/usr/bin/nautilus
/usr/bin/nautilus --gapplication-service
4⤵
- Reads CPU attributes
- Reads runtime system information
PID:1727

/usr/lib/firefox/glxtest
/usr/lib/firefox/glxtest -f 13
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1523

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
2⤵
PID:1556

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -prefsLen 20252 -prefMapSize 231436 -appDir /usr/lib/firefox/browser "{37f74217-9b00-4a8a-be5a-6fe227ff1466}" 1482 true socket
2⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1570

/usr/local/sbin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
2⤵
PID:1613

/usr/local/bin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
2⤵
PID:1613

/usr/sbin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
2⤵
PID:1613

/usr/bin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
2⤵
PID:1613

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 22645 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{454499c5-4ac8-4bb9-8d7e-817494e2de70}" 1482 true tab
2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1797

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 22370 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{cda00ad0-b98c-4077-b994-b01cbb1f7eeb}" 1482 true tab
2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1933

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 22719 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{7c2b838e-babb-4995-ac2b-048f7ba9d9af}" 1482 true tab
2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1959

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 28719 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{fd0e8a11-8fdb-435d-96cd-c37939839408}" 1482 true tab
2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1977

/usr/libexec/gvfsd-fuse
/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f -o big_writes
1⤵
PID:1657

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user

Filesize
2B

MD5
c4103f122d27677c9db144cae1394a66

SHA1
1489f923c4dca729178b3e3233458550d8dddf29

SHA256
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

SHA512
5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54

Download Submit
/root/.cache/mozilla/firefox/f4dw348x.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F

Filesize
13KB

MD5
556c6b175c3da66031c0526dcb6d1138

SHA1
26aab6662e71c655c77f391bf0a82f85cccc71fa

SHA256
ed1ee7c16fa71203f9a07b90968c8fba7315bcc4d61f785cc33c73d7d857904e

SHA512
c708f15a6663321920c8a4b0bb1de0ff90c9a63e62265dcf4314062fe07a5250862242e58472482a4075b42524a40bda7ac95ef037a02385da616dbb7646e176

Download Submit
/root/.dbus/session-bus/4816dd152e8c48ff97e9117d197c13d8-0

Filesize
466B

MD5
881042c8522a0568ac760ddeb40ef982

SHA1
3bf92089376bb75c7324e66f740af858fda6a889

SHA256
ee843b91e597426f6c599aa6f7f55665a8301f74b8ecf5e1d97e34b6132aac57

SHA512
efe2fe1a6c5b571d12dee3054f1d5d436b788d1d6b96c05c585cefc1e51d16d41cfd073a784ecc1461521e17b82f07bbfb6251dfb1055609a33cd18f068e91ea

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20240108143603

Filesize
10B

MD5
31c2e7042250555348414a6dd795887b

SHA1
64f7855a24b924876e581de8d2187b5de7abe5d1

SHA256
3156c89e5aa46bea251200835038accd92f282cab97ad63c8eabf8ab23b8176b

SHA512
4f5759a6f8372b40b93e0c5006cdbadd978c33e773538be2272ebc5ac6c16f2bb08d864c2389d5a2280e09b30b22a07133be951dc6c50615729c3c95490455db

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/cert9.db

Filesize
224KB

MD5
072652f4a0154b01cbabe862a24b9efc

SHA1
37d7bc3868ce3ce60d0586d830f2a312d8074f13

SHA256
4e215fd430aa149b13b91c2e12f2f7fd1b9ed2ee180b8caf2b120d369df57144

SHA512
68e3c03387a3d58373f86ee68441629da14c5fb68dac8ba14c775734e6c4c8f8306afb7a52fe2700f7c9b98a21ae19fd40024860064a6111cf365af0aab25bf2

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/cert9.db

Filesize
224KB

MD5
ce1546012aa76b72e31755befcfc64b5

SHA1
b7c5c7dafa5af13e06d5599b5e074147574f0dff

SHA256
c6332128277d60fa5f8f7fbd4a07cd0d0e77bd9f632e54532978389b87d2c1f3

SHA512
66d7f66b8d11175a98b0a8028d28d7a73c90edd1099a90561aaca054d03aa6f575a8a62a22512c5a65f5d00888469fbc68e0139ea7029b0ea6532b16e407e2ac

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/cert9.db

Filesize
224KB

MD5
6489415d65f381aba2b75215f0c3c5c8

SHA1
6847cf76894ecb6afc5d8777547b39702fd221ea

SHA256
66cca66984c7f19da55fa2fb6afd9735788672f73a825b83cba86beff6424b91

SHA512
cc8dee9db58cfed018221be232091dae53df93ce4246043e52318a1bdce4b358c59bc1fd4abb0720f35f60fe75ae4e485fb700fe3244e015fa69d8a2c1a2de44

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/compatibility.ini

Filesize
163B

MD5
2d41a6f5736821b90ef44850dd3873fe

SHA1
a47c4bc1431234a5b58e460ede5b571acd38e562

SHA256
b4bf5c8334f6db20ae94105141ae7a721342ddccd94ec65289dc291e76a31814

SHA512
047a1455211e7aa29ef5f32f07c89d8a0c8d86d871bc664e4d8958a2a014dbe32f0613cd9eb66e7307c0e2439f74ca0b829652a52fa48e8c60d64b41f69914eb

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/content-prefs.sqlite

Filesize
32KB

MD5
1c7386dfc5a5d7f2aa06cdf1e2b280a9

SHA1
71fd6c476cca7d5aaaa79f1c535346b6de20a448

SHA256
f2793a25bb1c364f2589a7b541a5873f8e5e192ff39c1fcefd786e1c23f1c5c8

SHA512
378d36bf3054ffb7b664bcb4d0e38b546b684ce4436c247674ccf621ec2f9951cca73f55e4c1f496a37061ade6065fd315878aa65d2d38c09f8f6a0cb768d978

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/cookies.sqlite

Filesize
96KB

MD5
26ff39b359947b71a5fadd950fac34f0

SHA1
66e5830e4dca79225f41adc13a077d8e5dd8084b

SHA256
aecbaf3e1df1332d4f14a11480db712eb4aa91581eb4e942c580bf675f592a45

SHA512
7fae7b9ff4362e12f00acdc898f6f679718bdd28dc959684333086de7bacd162338dc266810f9f3f6dfa3dc228291efd6bb325e2e8573ca0e6a699059a145f11

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/cookies.sqlite

Filesize
96KB

MD5
102a8b6e82208a1b69224bdca8a5b10f

SHA1
8413dc3772127c4159e6d6b51372990a06b805ee

SHA256
5ebf89b32937916a76a8432832040cf0f6b99c2f006cc42f856712d403ec182c

SHA512
49c5c27c6749a7a73b4b944eea64ceb053a272619e6319bfd433ffbe126c8fbccc110961018165a4c7de781a86cf38d2bd9e52ec71b10bc73c9fd05fe841a46c

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/key4.db

Filesize
288KB

MD5
3a253d287dc05dc3126cf7a03da6fc35

SHA1
3ebe719ad64296d2fac50549729f6b19b445d03b

SHA256
515d69dd7958640fc662fafea4723723685cd81117c8f13ef93ca8107b7bd4cf

SHA512
c15a66412743f1334e6415e709d76496d3a03306c475f8ddddfb12223f441fd35f1675be671096e8cdc66fbbcabd78aa75c0b57f40e73b11d377f47ceb3b9e73

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/permissions.sqlite

Filesize
96KB

MD5
652770017ccd3217c70066cdb7213d35

SHA1
61bcaddfc3b435b399490896b7d6055269ab6653

SHA256
660ccd2cc3805ef44ddd244134e82179df1708a253571afb5062d1b38939bd9a

SHA512
db4b111d760e1a67d63248a677e8487a2ecc31e89362641bcde5ef1d8bbf893b57ad70922fcebbc961d686520361f5bf0c6b7c217ac1b9164e3d275be2dc9db1

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/prefs-1.js

Filesize
2KB

MD5
b334ff13cd55d52728a0a15209982352

SHA1
672ecc4a9f8b094a724de23a55120391117c5e4a

SHA256
fd4e8e8cbc1ac2ffd82c8dc83e28817e8dd6e60da4755284faa4995d661bb123

SHA512
6e5909ae07a3acc319622d918439bb87755a52be9701ae07b2fa6f752dacaf56de662479a8fa6dac76f8a178b8178e69fb718c01f082ba5acf4422efdaad797f

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/prefs-1.js

Filesize
2KB

MD5
3c94f0d322a20b2405c66092a0c62385

SHA1
4582fa8bcc68435d1602947aead0f91d01439846

SHA256
eb8f949b72ae429d525e8b4e262176c108ea6d11ae95edd6baf3ceb306e30a83

SHA512
64ce33016241898ad60150c13426694e6d5d17aed9cffe9c15451e1cec20ccd3934ac299f40160c4a839cabb7d41d12975ace3ae072f2320c99e87e075ae99e2

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/prefs-1.js

Filesize
2KB

MD5
37d982f7040db69ad4287d5c98e16113

SHA1
71bc42bf1e1a78edef647bcea21b7adea04ad375

SHA256
bcf984e8125d3199c0af1823036942db271ea83d825b3863fb43eee6350008de

SHA512
e2bd6d85abe3cc519a942fcd559512314c53e0aadca21020c034d9d02f8f0171c83b500fcbdcd78d94628574f0d9116bc06937104aa13a236a90349178576e4d

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/prefs-1.js

Filesize
3KB

MD5
595064c31b11ae7139881f2088b1e6cc

SHA1
977ac716daf268cac16824b2ca0e7d5db5e1d02a

SHA256
c1e4911c53ca2205b7bbf7ab5726a9a82ab8c7329fa0b4e85ae1832d117ac72c

SHA512
97f1b56164b07aa0dcc4cd7adbf37df7c1d0a61beceee0b7e867d474141b9422f9ddcf47e176826c90910f15a6ad782c20611e39f77207bab5dc8770d899214d

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/prefs-1.js

Filesize
4KB

MD5
2d79b1e9d2fb10969799122b11562135

SHA1
6d1c0c4cf309c7fdfd585c42847aa18caf69e3bb

SHA256
d6c30fba28881564835f7388d86ae677b464800f39def140e70e34da4bb12d6b

SHA512
82dc88923049f5d18f71515f9c76301af593cff9ddb4581c8515546504faf773e580343521e9923329cb45871d92650830bd425cc5020d078932ec12db6a144f

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/prefs.js

Filesize
1KB

MD5
352b9429041f0ac1c30a441d80f92a4e

SHA1
3874a6efb2575aaa6a9cf45afeb67f0bef4a4c1d

SHA256
bde42b983392610096112aeec0e79d58c8ba6a8113e4ab1999faf2a18a555801

SHA512
927921292fd57060f2cb4f2c05c53dfd80480d4af21cb5d16660fe08775ebd736d63ac7a7048e75f25f8988275c172fe5bf66b1f60b2d4fbc97f9d22319c307a

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/storage/ls-archive.sqlite

Filesize
96KB

MD5
e1121e3dd3c8a9c384f879bdddcff219

SHA1
625f25a1a5ff8527ab3105636fa7aecb9affd234

SHA256
766b9f50254b4e5526b0cde2911512956262596d8937f8630805d3c70802a066

SHA512
03e1cee2e75b2b609b8344a40995de09de837e940d2012f2fea65d9c70eecbcd3345b66b852f32211b38b06a4370f06f02ca7521e29e7113e2e12a6a7752be31

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/storage/ls-archive.sqlite

Filesize
128KB

MD5
0d2b18bbf091633c4fe1ebdd197dfa15

SHA1
c150dc37042d92d30efed6cbc1b536eb66ec1a3e

SHA256
fe63ee867e0f229a0bcc48b771afeec394c362ac6d0c2bd6907c7202097bd228

SHA512
59d202bfaf236bdcfc05a3e148a773d15a3bdff23be26fb2cbfd059fee6c4a516c7a59de0a3bc97df1419c34464e1346354979ddda1062101121522f22d8156d

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/storage/permanent/chrome/.metadata-v2-tmp

Filesize
36B

MD5
4cc7cb3cf29fd95e512b5e3288c28397

SHA1
166922b7e6de45e548ef79526dd1e4b1f9706885

SHA256
3f63c058caa08f372938f282ef94d858b0ca8aeef7da910cb93c88529458179e

SHA512
158a8b8adccda3e91441114824e648addad06d878932f198bb95225da9b8c194b17b2380a307418d25a9aafa839c2d7f56a4f2316b79262deeb0ecda8703bc0f

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
44KB

MD5
488403dd59d861961dbf2e5317cc6e55

SHA1
bcb13cf819bdc370762237a075f14a9be0728a50

SHA256
8645149962df6c816291521b6cb45e9acf79da6bdc3a727ba00c71eb720de4ef

SHA512
4e60bc58fdc1ffe3662b83fc9af3e0ec5af90eeb25da8e60a70717e3588676e135f6cc5a8d57a37c2cd2ce3a3661e665e2688d00799dd834945d5f0964750805

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
12KB

MD5
fa50386f7c0e2edd77208a82dfb9c295

SHA1
aec89e0938660990869fb42753f810b2256d2e30

SHA256
960d82c64674b0eabea329c4091bbb3854ea3e7a798fd9c5f9ffcce055f3f61e

SHA512
8659cdb9d5ca99ba5787f4348cd65160a4996c32401b7f70a88fb77cb75239b00d9befe006865097deacad17e66a1b5fb81804b92feabd873ad385719e289205

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
44KB

MD5
f1cd629017b1fe58fc80953ebd4754b6

SHA1
01e02178484458797c2b682325b26b2633fe8466

SHA256
81bf3da297b9ee8270bea383d9479cd7951e35f552361230358e3a35e1f44567

SHA512
afb775074af046014236a312865a1811de3bfb97f8df057541401867140fcc236259ab237712a7d3bc012ff84cf90330e4e122374cd09c194c4c145f575fb95a

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
12KB

MD5
65d677ddb7116c49fb0f3a0831a90774

SHA1
98a9e4ad55f0fcb96f351ed5552474caf2252886

SHA256
02c7e01ff77ef1bad190ae76da71f02daf81cb0ff6b4e41d4ef597b3d052b18b

SHA512
ff1ab15846cba8aee948937f67a3ee2670941847ea741d757394d84c719de779f3f68e7068135e65fd2a4124412499b715018a0e7faf8075086c2492493fa73e

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
44KB

MD5
1ea539584c41fd171d307fb9e740d499

SHA1
de3d1a3d6a0173bcd30c89f148cd732d0ae614eb

SHA256
aaa3461e12a1343eb5803894e1ef6894014b75b26ef264f29ece30b1cea3aa83

SHA512
22b145864127c0f223522016c6ba0a67e06a36aeba135e546f4d77000f436d5060064eb988b7aafdb451e39f70d0afd20313d15507dd531234ac25d60e9d935c

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
12KB

MD5
9aa242520c02eb986c53f42d43e53d5e

SHA1
2958b8c83bd44e39c7dc8b7ba494a611fb9f0718

SHA256
deb587f6fea751636c2f90661def8098e7e6fdb42e91f5880a5457d96c561ca9

SHA512
1f61020e605b4a8a7d7d78e0501879b1cdd2e3802a9c91457956eb0785b222a83d4c9591bbfa712243dbe805232ecfd28a2cb00a2797c44118da1b91aa5fe1f9

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
16KB

MD5
5e8a2f885341fc9caaf26543a7f39b1b

SHA1
25bb2a9c90fc242f6215514534fdbd8ef99b71bb

SHA256
b3eac0f3b0dae016e723c42ea4f7ceeafa3b9f55705270b4d4239d7607ee016b

SHA512
cb06128efecddb0ee867295d22f2f40bbd52ac2efea5cd37abfbeb6c412442c1e73cc35cefb9a75537a407f397fa225e0878ce22a4b97c19f2e565fe590c6673

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
44KB

MD5
225fe36c4bb990de9670b27368d655a2

SHA1
1dc382bec9af9b4bd0308dea1908ab6933834828

SHA256
2185235a458ef8924a1370bb956dd1d65d1f7bbffda08289275e072b65d5d1db

SHA512
11eb31a930a336c13869b0d385df555d7fba32ecea26bf513398dca2a35439643b0896a94c4696ffb439eef18b7f85982155dd12beddef784fe4ed1e86d2d1c2

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
12KB

MD5
0f86f134250d142239966edf6e172d6a

SHA1
42d598c6ec6c9f8a04f574fdfd5f2b02507564b1

SHA256
0087d76fa8083e37ffa9c09912fafa07544f86e553ad36e8228f9fd6092c6879

SHA512
2863fa19fa79356d61ee8d32ed409b300d0f56948332edc7a878f55c209e54d57583cd439fd59c8d20faf5aa88623482d792796b80033b0ab1d18c3e5b90104c

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
156KB

MD5
cc380d07e9ba061cd0429cb7b93f9bce

SHA1
6cb39029905733edefc50e263a8c1cd6fdfb4743

SHA256
9f1d101b02f4cb8a35f38722c85d2398291eb83866d847e6cfafef126bf72320

SHA512
3d736f6ff7eded21565d089e4600f2282e3c5a4e9138cb243c5239c8be9d1213a3b98ca57075b4277ee9fe8b6d706f7a583ea97cdf60f26aece8824462df291d

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
116KB

MD5
bbe9e4471c97fb1b270eb793922a00e8

SHA1
a1da47669a2b512be64ba97e8bbd587887d2c24f

SHA256
dedbbbca17668696789b6525ec93fadbb5731e96df326c7d84ce355fe0ca1bac

SHA512
1df28b24c05bd0931c3fab72bf6283d4a4df4253bd28060bf9abaf8fa0b9fd91e7790c28d7972287ac82a1bf04eecd3fab8acdaa26dfd394b3493280c7474f1d

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/times.json

Filesize
50B

MD5
63fcbcfbe2893723f5f49e726caae568

SHA1
9804980103c23c07c9717c9352ffd6e2a35182c4

SHA256
526da5a3f560dbb76f397a9a723b0971db546903510e53b52249b7f7c236b178

SHA512
2c48db336b7fdcfccf4baa9841fdbfdfb009a67ff16c43a47216de8d0a8e6890ccba83839955fbced10b8e72b7da0fb52c2739f4919400ed5677103228248337

Download Submit
/root/.mozilla/firefox/f4dw348x.default-release/times.json

Filesize
47B

MD5
2c849390354e3793880c28a91af91c56

SHA1
d43b2ec4a6adf27641e048522410596ea853f546

SHA256
849fd8e7b941ce6cd613b74a2c67a27e973cee8e2f75f50bf230817e457d8c93

SHA512
9c4fc4055ee3c7c0897f3521b5b62528abecca16845233bb766e6836b779d3f49ccccc761560961a35a565c225ea59714bd30738c1295646e5bf59a930e407c3

Download Submit
/root/.mozilla/firefox/installs.ini

Filesize
62B

MD5
df74c30e71e817cb02577145463b9672

SHA1
1b5ae2ad3aa7d84268c4af68e0848fa7f66b5e8d

SHA256
f09e32be4a154654a87c6e80c56beb052b9aa25c66cb0ff42fab4f57f29628e4

SHA512
1022cc62fb2e0e35dca219b0b32ad9ba0781053d39690aa9435ca0d6f32f5d2063b49ec84dfda973e76f0cda712bd8ca16076224781b2e2e1075e0698914aeaa

Download Submit
/root/.mozilla/firefox/profiles.ini

Filesize
259B

MD5
453c96ed66941845ac52950471595046

SHA1
3eceadc55ca4ed6a16d2a7d5752cfc403ee8b7c4

SHA256
0cf325b4bc967ebae46b9b03d9b504e6e01b748624520783af569a4e3c506407

SHA512
d9a9e1fccc2f94c10dbf38cd038033d98379b7db9475441affd2dc0cb9cc0c4318a6c5f9783c8943b7ce959e8bcae81c906d4f25047538b3d2c025d8dd24d7a1

Download Submit