hxxp://google[.]com

Analysis

max time kernel
4s
max time network
250s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
25-04-2024 13:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

4^/10

antivm

Malware Config

Signatures

Changes its process name 64 IoCs

Processes:

firefox

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	gmain	1619
Changes the process name, possibly in an attempt to hide itself	gdbus	1621
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1622
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1624
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1624
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1624
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1630
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1630
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1629
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1629
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1628
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1628
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1627
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1627
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1626
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1626
Changes the process name, possibly in an attempt to hide itself	Timer	1625
Changes the process name, possibly in an attempt to hide itself	Timer	1625
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1632
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1631
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1634
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1634
Changes the process name, possibly in an attempt to hide itself	glxtest:disk$0	1636
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1637
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1637
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1638
Changes the process name, possibly in an attempt to hide itself	Cookie	1639
Changes the process name, possibly in an attempt to hide itself	Cookie	1639
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1640
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1640
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1642
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1641
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1643
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1643
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1644
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1644
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1645
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1645
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1648
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1648
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1647
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1647
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1646
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1650
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1650
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1649
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1651
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1655
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1655
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1654
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1654
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1653
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1653
Changes the process name, possibly in an attempt to hide itself	MainThread	1649	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1656
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1656
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1656
Changes the process name, possibly in an attempt to hide itself	Socket Process	1649	firefox
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1658
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1658
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1657
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1657
Changes the process name, possibly in an attempt to hide itself	Timer	1660
Changes the process name, possibly in an attempt to hide itself	Timer	1660

Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

firefox

description ioc process

File opened for reading /proc/cpuinfo firefox

description	ioc	process
File opened for reading	/proc/cpuinfo	firefox

Reads CPU attributes 1 TTPs 8 IoCs

System Information Discovery

T1082

Processes:

firefoxfirefoxfirefoxnautilusfirefox

description	ioc	process
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	nautilus
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 60 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

glxtestfirefoxfirefoxfirefoxdbus-daemonfirefox

description	ioc	process
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	glxtest
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	glxtest
File opened for reading	/sys/devices/system/cpu	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	glxtest
File opened for reading	/sys/devices/system/cpu	firefox

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

firefoxxdg-desktop-portal-gtkfirefoxxdg-desktop-portaldbus-daemondconf-servicenautilusdbus-sendfirefoxsedgvfsdsedgvfsd-trashfirefoxsedglxtestsed

description	ioc	process
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/self/task/1586/stat	firefox
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/1720/cmdline	dbus-daemon
File opened for reading	/proc/1728/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	dconf-service
File opened for reading	/proc/filesystems	nautilus
File opened for reading	/proc/self/fd	dbus-send
File opened for reading	/proc/self/fd/75	firefox
File opened for reading	/proc/1744/cmdline	dbus-daemon
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1700/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/32	firefox
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/self/fd/85	firefox
File opened for reading	/proc/1763/statm	firefox
File opened for reading	/proc/1484/attr/current	dbus-daemon
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/37	firefox
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/self/fd/36	firefox
File opened for reading	/proc/sys/kernel/cap_last_cap	dbus-daemon
File opened for reading	/proc/1478/cmdline	dbus-daemon
File opened for reading	/proc/1580/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/35	firefox
File opened for reading	/proc/self/fd/30	firefox
File opened for reading	/proc/self/fd/38	firefox
File opened for reading	/proc/self/fd/41	firefox
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/cmdline	dconf-service
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/1763/smaps	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/1733/cmdline	dbus-daemon
File opened for reading	/proc/self/mountinfo	gvfsd-trash
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/1484/status	dbus-daemon
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/self/fd/52	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd	firefox
File opened for reading	/proc/filesystems	glxtest
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/1749/cmdline	dbus-daemon
File opened for reading	/proc/self/fd	gvfsd
File opened for reading	/proc/1752/cmdline	dbus-daemon
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/task/1796/stat	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/task/1652/stat	firefox
File opened for reading	/proc/self/task/1769/stat	firefox

Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

firefox

description ioc process

File opened for modification /tmp/firefox/.parentlock firefox

description	ioc	process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open http://google.com
1⤵
PID:1477

/usr/bin/dbus-send
dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
2⤵
- Reads runtime system information
PID:1478

/usr/bin/dbus-launch
dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr
3⤵
PID:1479

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1481

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
5⤵
- Reads runtime system information
PID:1700

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
5⤵
PID:1705

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
5⤵
PID:1711

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
5⤵
- Reads runtime system information
PID:1720

/usr/libexec/gvfsd
/usr/libexec/gvfsd
5⤵
- Reads runtime system information
PID:1728

/usr/libexec/gvfsd-trash
/usr/libexec/gvfsd-trash --spawner :1.8 /org/gtk/gvfs/exec_spaw/0
6⤵
- Reads runtime system information
PID:1752

/usr/libexec/dconf-service
/usr/libexec/dconf-service
5⤵
- Reads runtime system information
PID:1744

/usr/bin/nautilus
/usr/bin/nautilus --gapplication-service
5⤵
- Reads CPU attributes
- Reads runtime system information
PID:1749

/usr/bin/grep
grep " = \\\"xfce4\\\"\$"
2⤵
PID:1486

/usr/bin/xprop
xprop -root _DT_SAVE_MODE
2⤵
PID:1485

/usr/bin/xprop
xprop -root
2⤵
PID:1487

/usr/bin/grep
grep -i "^xfce_desktop_window"
2⤵
PID:1488

/usr/bin/grep
grep -q "^Enlightenment"
2⤵
PID:1493

/usr/bin/uname
uname
2⤵
PID:1494

/usr/bin/grep
grep -q "^file://"
2⤵
PID:1496

/usr/bin/egrep
egrep -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1498

/usr/local/sbin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1498

/usr/local/bin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1498

/usr/sbin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1498

/usr/bin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1498

/usr/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
2⤵
PID:1501

/usr/bin/xdg-mime
xdg-mime query default x-scheme-handler/http
2⤵
PID:1502

/usr/bin/dbus-send
dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
3⤵
PID:1503

/usr/bin/dbus-launch
dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr
4⤵
PID:1504

/usr/bin/grep
grep " = \\\"xfce4\\\"\$"
3⤵
PID:1506

/usr/bin/xprop
xprop -root _DT_SAVE_MODE
3⤵
PID:1505

/usr/bin/grep
grep -i "^xfce_desktop_window"
3⤵
PID:1508

/usr/bin/xprop
xprop -root
3⤵
PID:1507

/usr/bin/grep
grep -q "^Enlightenment"
3⤵
PID:1510

/usr/bin/uname
uname
3⤵
PID:1511

/usr/bin/sed
sed "s/:/ /g"
3⤵
- Reads runtime system information
PID:1514

/usr/bin/cut
cut -d ";" -f 1
3⤵
PID:1519

/usr/bin/cut
cut -d "=" -f 2
3⤵
PID:1518

/usr/bin/head
head -n 1
3⤵
PID:1517

/usr/bin/grep
grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
3⤵
PID:1516

/usr/bin/cut
cut -d ";" -f 1
3⤵
PID:1524

/usr/bin/cut
cut -d "=" -f 2
3⤵
PID:1523

/usr/bin/head
head -n 1
3⤵
PID:1522

/usr/bin/grep
grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
3⤵
PID:1521

/usr/bin/head
head -n 1
3⤵
PID:1527

/usr/bin/cut
cut -d "=" -f 2
3⤵
PID:1528

/usr/bin/cut
cut -d ";" -f 1
3⤵
PID:1529

/usr/bin/grep
grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
3⤵
PID:1526

/usr/bin/cut
cut -d ";" -f 1
3⤵
PID:1534

/usr/bin/cut
cut -d "=" -f 2
3⤵
PID:1533

/usr/bin/head
head -n 1
3⤵
PID:1532

/usr/bin/grep
grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
3⤵
PID:1531

/usr/bin/cut
cut -d ";" -f 1
3⤵
PID:1539

/usr/bin/cut
cut -d "=" -f 2
3⤵
PID:1538

/usr/bin/head
head -n 1
3⤵
PID:1537

/usr/bin/grep
grep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
3⤵
PID:1536

/usr/bin/sed
sed "s/:/ /g"
2⤵
- Reads runtime system information
PID:1542

/usr/bin/sed
sed -e "s|-|/|"
2⤵
- Reads runtime system information
PID:1545

/usr/bin/sed
sed -e "s|-|/|"
2⤵
- Reads runtime system information
PID:1548

/usr/bin/cut
cut "-d=" -f 2-
2⤵
PID:1555

/usr/bin/which
which firefox
2⤵
PID:1556

/usr/bin/cut
cut "-d=" -f 2-
2⤵
PID:1560

/usr/bin/cut
cut "-d=" -f 2-
2⤵
PID:1563

/usr/bin/cut
cut "-d=" -f 2-
2⤵
PID:1573

/usr/bin/firefox
/usr/bin/firefox http://google.com
2⤵
PID:1580

/usr/bin/which
which /usr/bin/firefox
3⤵
PID:1582

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox http://google.com
2⤵
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1580

/usr/local/sbin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
3⤵
PID:1620

/usr/local/bin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
3⤵
PID:1620

/usr/sbin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
3⤵
PID:1620

/usr/bin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
3⤵
PID:1620

/usr/lib/firefox/glxtest
/usr/lib/firefox/glxtest -f 13
3⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1623

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
3⤵
PID:1635

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -prefsLen 20252 -prefMapSize 231436 -appDir /usr/lib/firefox/browser "{0dcc051a-ebc3-4fff-aaf3-e7b66f9bbb0b}" 1580 true socket
3⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1649

/usr/local/sbin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
3⤵
PID:1661

/usr/local/bin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
3⤵
PID:1661

/usr/sbin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
3⤵
PID:1661

/usr/bin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
3⤵
PID:1661

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 22702 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{671b474f-3640-4e0b-9286-8b43aa2db379}" 1580 true tab
3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1763

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 22370 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{5938aa20-bae4-4d89-ba9c-610a1ce5403d}" 1580 true tab
3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1789

/usr/libexec/gvfsd-fuse
/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f -o big_writes
1⤵
PID:1733

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user
Filesize
2B

MD5
c4103f122d27677c9db144cae1394a66

SHA1
1489f923c4dca729178b3e3233458550d8dddf29

SHA256
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

SHA512
5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54

Download Submit
/root/.cache/dconf/user
Filesize
2B

MD5
c613640c4b9a5bb1ecd623c6e3cdc363

SHA1
55789cb19e3e24a1a315f3b2f6d66e56783837ac

SHA256
5e4cd10be9483fe8aa215c7ee1804f7f88c02e22fe5fb0336d297bec998471f8

SHA512
f7b645436187cc61a234c46f8c2dd8c1487357d37303f51654c4a2fda71860e513aa769c35eb60079e810fddd5279c2aa21f3fb87e5f83e97cc1ce26b0cf6abe

Download Submit
/root/.cache/mozilla/firefox/rddy1yks.default-release/cache2/entries/1611007487CDFCDB9FE43793C68D8984CF7DD7AA
Filesize
9KB

MD5
8f5350de27210eeaf9046651ce2e9cb3

SHA1
412e760019fa61e42841187c73c06c08ec32d702

SHA256
0fc852d47e3f34bdb0fa0a09ba0ffaf4aaac670b1e945c6701bc100b5f102809

SHA512
86c614a63fdfb77552ce0fb50de183e87bf72e47bf4d5f0e7ff621f457e14083b9067288fa506109549cfda01801ec7f8acdc39f9a0fbb4da01c7875f6480a8a

Download Submit
/root/.cache/mozilla/firefox/rddy1yks.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F
Filesize
13KB

MD5
e4269ae54e3dd3419a5c54bfd3b353b2

SHA1
cd438c36d7efe4fca595cac9233c5bec205e1c70

SHA256
69c1b0446a5d981398d7c859ce690da759bc4018652f591b9d85a4f2554d0af4

SHA512
73507771bb6f150ce1deee35c418c33b497bc74b39df4bf1ea7e760ba68a664727a8d9f497e7fa9d7c5395836396872a5f3e0c883dbc388890d44ce6e05c977d

Download Submit
/root/.cache/mozilla/firefox/rddy1yks.default-release/cache2/entries/90E321EE94230DCDBDCD2EC0B77C695A4FC21F78
Filesize
9KB

MD5
f7517401e4e9d07a2413a9b3fdc5fcb6

SHA1
969e981f3e609a864cf40edea7afa0dc908caa06

SHA256
85a30c179c5d924f39f6ca6f86231735b4b732bfe5b8e7fa71ef0156669adccc

SHA512
f5d97c1375aacb5ffc6c5a8937bb620936dae87fc9d1b540124e69c46c6da222b640ced0493fe4848ea2c2b0d1ad820249bbc639399642cc6f930195e94e1665

Download Submit
/root/.dbus/session-bus/4816dd152e8c48ff97e9117d197c13d8-0
Filesize
466B

MD5
d0e8c7b72f55b0e8e6c663628b1bf87d

SHA1
a0a525ca4a52e8daa5e0f9c7524ae7052c7438e9

SHA256
3f291891638931d0ef0574e476fae1cd9a757c2f45c18ff6de136f6cb1770ff7

SHA512
890255cc0cba3fc2dbc9c7ef7496939e94577cb8e98b9dd8e334d06192f8b46ad3bf0b9f160f814cb3fec3153319c9a957561d4cc3a56cf4d7edb86499fa9aa1

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20240108143603
Filesize
10B

MD5
a0ade21fd9734d218e408bdc77cec3d8

SHA1
7ef36163689d4b4062486df89555efda371ab825

SHA256
e3982ab8b2b8a1f45c38e6099ed9f7f5dfb2587f954325280d667aa94429ce4b

SHA512
d593bf644ae3061de521e9cb6e3eb0ef86c0b1ebc772b6672c0ce67a5cd5fc3a1b3f2af04f1b731abf1a2770f1173911d33342fcfaf0ddef16f4f3248c5e2178

Download Submit
/root/.mozilla/firefox/installs.ini
Filesize
62B

MD5
356c0cb8829ed2710bea1219b8faeb85

SHA1
7bf13f215bb8c50cb7b10a1977b125d0ae293f70

SHA256
fb7d5862f8d18d4185c3033e40d85a336e35c3cd0eb252c4d8078cc8aa723811

SHA512
8907207301f37871cb1fc04c55e23c9660e4059844038e995bc261521c465a2b07e5aa0412358c66b547032b8c5290ab41901420853248ca2cad3ee905d272db

Download Submit
/root/.mozilla/firefox/profiles.ini
Filesize
259B

MD5
66b6b40368cabedec227b2ff41dc6e24

SHA1
6c2ceef50d52d9cf85ddfe5ec335f649adb00a75

SHA256
b10020da6d785f5cfce98f0a076b1983876164c9aff4f0d28a390a72079cfd06

SHA512
8f443e9b9bec2cc67365ff10c331606ba169fe68bd6ca344ff742ffb3999d503b440f6c0075beb68d46f65d570bcf2535351654cbb6ff526886ceb9426c387df

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/cert9.db
Filesize
224KB

MD5
12e655d801571175af762297e40a42ff

SHA1
b5e6649769571a8ce903e81251503d99e0aecda3

SHA256
3a98646d84b0fd91ae6dffbfe9c1f22be44a6725b1051d3fa7041ab916f22c9d

SHA512
cb245e6c948b1c4cde063d72860b8aa0dd65a9790d2cc5f5d7576ab24362b8cf30fb2ffb2bfec848568bc0747eb3989aeb7e51db9bbc8f6f58be98c5e159d303

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/cert9.db
Filesize
224KB

MD5
d93497b938e9bf5efc556614e58d2e4e

SHA1
66fbc164c2eb553a67c7e2d85abd7dc9540d9291

SHA256
1d7bc9eec81c260d903dfbfaaf9ea3815b917e1aa89ce343c7edcf421cd75101

SHA512
bf585773c97fbc3974d6a9f1d8903f7056d9903c43124888dff0b3dcafb2b3ded536e1cf968fb03bee55787231a472d19efaea06944d488a1450d9e2f58167b0

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/compatibility.ini
Filesize
163B

MD5
2d41a6f5736821b90ef44850dd3873fe

SHA1
a47c4bc1431234a5b58e460ede5b571acd38e562

SHA256
b4bf5c8334f6db20ae94105141ae7a721342ddccd94ec65289dc291e76a31814

SHA512
047a1455211e7aa29ef5f32f07c89d8a0c8d86d871bc664e4d8958a2a014dbe32f0613cd9eb66e7307c0e2439f74ca0b829652a52fa48e8c60d64b41f69914eb

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/cookies.sqlite
Filesize
96KB

MD5
26ff39b359947b71a5fadd950fac34f0

SHA1
66e5830e4dca79225f41adc13a077d8e5dd8084b

SHA256
aecbaf3e1df1332d4f14a11480db712eb4aa91581eb4e942c580bf675f592a45

SHA512
7fae7b9ff4362e12f00acdc898f6f679718bdd28dc959684333086de7bacd162338dc266810f9f3f6dfa3dc228291efd6bb325e2e8573ca0e6a699059a145f11

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/cookies.sqlite
Filesize
96KB

MD5
102a8b6e82208a1b69224bdca8a5b10f

SHA1
8413dc3772127c4159e6d6b51372990a06b805ee

SHA256
5ebf89b32937916a76a8432832040cf0f6b99c2f006cc42f856712d403ec182c

SHA512
49c5c27c6749a7a73b4b944eea64ceb053a272619e6319bfd433ffbe126c8fbccc110961018165a4c7de781a86cf38d2bd9e52ec71b10bc73c9fd05fe841a46c

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/key4.db
Filesize
288KB

MD5
b476d3210cdd5300b9956d137074f79e

SHA1
dc8e4fe7dcf46285f3c6a51f58c09f7d21e3ee93

SHA256
1e2560488c09363e1f4abb137170589c389188749947b168523c12b11d51075c

SHA512
5c45590af1632504ea3b76d80db4d3fc60c54a0dd3a45f034e374b52dca9da54c3dcef2e07dc8c268d82de5b543e2d42b68f0c28f52bc6aebd303a152800c135

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/permissions.sqlite
Filesize
96KB

MD5
652770017ccd3217c70066cdb7213d35

SHA1
61bcaddfc3b435b399490896b7d6055269ab6653

SHA256
660ccd2cc3805ef44ddd244134e82179df1708a253571afb5062d1b38939bd9a

SHA512
db4b111d760e1a67d63248a677e8487a2ecc31e89362641bcde5ef1d8bbf893b57ad70922fcebbc961d686520361f5bf0c6b7c217ac1b9164e3d275be2dc9db1

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/prefs-1.js
Filesize
2KB

MD5
326944b91bab2579d9f1df8d622aaeb3

SHA1
e4a1412b829e65c6ec08d3016e3e13b0eae773a2

SHA256
4a9751104b4819bed7fae992739e002baafa6d7694a1608b8d227b1af947f527

SHA512
d5cdae4286d81435b1f7e6f256f57d46b2487474f54640b832f022954f2456e0e0c1c2063099cf3eb49d8c4c60a46de203f50c3d9f068b1e7fccbeb20290bc22

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/prefs-1.js
Filesize
2KB

MD5
eaae7d97cb845898e4cac04d663ec123

SHA1
cb67242e91bdedf18b5a44e57780a3fe9be523e0

SHA256
2ac184dd50b1eb16c940b70e0d04cefd085ca8cac55dab5615b498e5a307595f

SHA512
072b501cdedb894371a275ccd1fb53ce12d174848f6d8bc4031f10bc3fd1927fe758190a826a4add8809dc4b97ff563cd1ab7988348d258d2bcfd5e327ea1b03

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/prefs-1.js
Filesize
2KB

MD5
2b72ed3d427d75dcf262d0e35ce96b4b

SHA1
0aceda828412cb26f845e7b565ea71bcbdbedfe4

SHA256
1b85c773c9abc27a80b660bd13c97c756eef596537a15619900eb551ad852eec

SHA512
c8aa2f370672ed05951a8c3a8e3f78053d0584eac29431d2e27bd4dca77b2663a687b74f9015676c514de9a8cdf90ebeca2274e89e52df0d50198002cd4bb97b

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/prefs-1.js
Filesize
3KB

MD5
6ac064f8332a0517e8f93781f62f41ea

SHA1
5d746511179389e8543e96bfa77da9bc0fd09d1d

SHA256
fafafc4408a0d8b6b567a671643ccae6f2eebbc5584c9d1d7bad928d82f1d100

SHA512
75c239eba338553e2736f125ccc9e0154d230d0666e07e2340defa298bcb980e8553b53f038433bc5156774b5ef8d544b01113a0ee7569ab9e1972637fc0db92

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/prefs.js
Filesize
1KB

MD5
e536f6b58c59f42cbefca66e8a6bb834

SHA1
7bf0dbedf6be89b080969bbd65189330baeb116a

SHA256
32a2de5207139d9e4d01a625d1ef442dbb12c88cd198608f021311a44d899bed

SHA512
df65edc883b94fe563e7f163c2125d8ae06735ab799bdb8427b61e4593f9c10fa0886cc30bd996e106963d2fcec243f1b18e3299163dd082ef6afa90b5c2e0d7

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/storage/ls-archive.sqlite
Filesize
96KB

MD5
e1121e3dd3c8a9c384f879bdddcff219

SHA1
625f25a1a5ff8527ab3105636fa7aecb9affd234

SHA256
766b9f50254b4e5526b0cde2911512956262596d8937f8630805d3c70802a066

SHA512
03e1cee2e75b2b609b8344a40995de09de837e940d2012f2fea65d9c70eecbcd3345b66b852f32211b38b06a4370f06f02ca7521e29e7113e2e12a6a7752be31

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/storage/ls-archive.sqlite
Filesize
128KB

MD5
0d2b18bbf091633c4fe1ebdd197dfa15

SHA1
c150dc37042d92d30efed6cbc1b536eb66ec1a3e

SHA256
fe63ee867e0f229a0bcc48b771afeec394c362ac6d0c2bd6907c7202097bd228

SHA512
59d202bfaf236bdcfc05a3e148a773d15a3bdff23be26fb2cbfd059fee6c4a516c7a59de0a3bc97df1419c34464e1346354979ddda1062101121522f22d8156d

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/storage/permanent/chrome/.metadata-v2-tmp
Filesize
36B

MD5
b7f431c68712839760a6cd9fb180dd76

SHA1
eb5547955d30ff70e6404f55c34fb236ad09bbbd

SHA256
510043ae2d44d845a14d413a50d6b63bee79f2cb2fb010115566017b3379dbe5

SHA512
0c87295c6dcf58f89ecac8fa7d752646c82a01e9ae131e75e35ac0773843f1fff9fd4f66f5c404701bd84bb6a3217d75d2368d9099f96e7464197d5e4e21a592

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
Filesize
44KB

MD5
1ea539584c41fd171d307fb9e740d499

SHA1
de3d1a3d6a0173bcd30c89f148cd732d0ae614eb

SHA256
aaa3461e12a1343eb5803894e1ef6894014b75b26ef264f29ece30b1cea3aa83

SHA512
22b145864127c0f223522016c6ba0a67e06a36aeba135e546f4d77000f436d5060064eb988b7aafdb451e39f70d0afd20313d15507dd531234ac25d60e9d935c

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
Filesize
12KB

MD5
5ea8e9b012ebfd92e3001a143ecc1fbf

SHA1
68d5e3d5431955a34db4e18ecb5fb0996e60ebff

SHA256
312e4c30ed952c8087986edd41dfb441f7cf040c454a732a559d4b36b29ef291

SHA512
7843ff2c181c1271ce055731fb26e601fffe3408058fb437d3488c22e4138f5c56f3e9c797b574b04c98c236a91455ced698f634d571ffad8814a64f58aee290

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
44KB

MD5
225fe36c4bb990de9670b27368d655a2

SHA1
1dc382bec9af9b4bd0308dea1908ab6933834828

SHA256
2185235a458ef8924a1370bb956dd1d65d1f7bbffda08289275e072b65d5d1db

SHA512
11eb31a930a336c13869b0d385df555d7fba32ecea26bf513398dca2a35439643b0896a94c4696ffb439eef18b7f85982155dd12beddef784fe4ed1e86d2d1c2

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
12KB

MD5
961e62602c468104b1d3a8ec77ae8591

SHA1
b7bae68082255c92916d3546b1ef0d23c0ca39c6

SHA256
649d5a8d756b22cb628b31a71eff32feec403b01ae6cbc49cabbc0248d0d23cf

SHA512
d7118d2fb6690d56ffa72ade6a8ff9107753e3931c692bc5cfcd5f56eb07e40e864ef540063a1be0ae5fdc0a89a2a4f2da831482ddf4c5b204572b35db9e129e

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
156KB

MD5
2cead19ba7d00fed49724f3fc3304889

SHA1
9ae4ac122d9ee8cd07ba23e0ed25fff9931689f2

SHA256
07017a013df18da16842067ec359928b8b1695f5e10a5e01f23c64ad538bdd8d

SHA512
5de9851c52b0e9a736e1dbc55739b8d94efb816adb46d37928c4cc85995e6120fa717af2e7f45366a3c1dffd3ff2b098ed7ead5c4a589bf3bd59c7a7e5f15efc

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
116KB

MD5
bbe9e4471c97fb1b270eb793922a00e8

SHA1
a1da47669a2b512be64ba97e8bbd587887d2c24f

SHA256
dedbbbca17668696789b6525ec93fadbb5731e96df326c7d84ce355fe0ca1bac

SHA512
1df28b24c05bd0931c3fab72bf6283d4a4df4253bd28060bf9abaf8fa0b9fd91e7790c28d7972287ac82a1bf04eecd3fab8acdaa26dfd394b3493280c7474f1d

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/times.json
Filesize
50B

MD5
62ff184d1ad82f1dbb87545862c3d453

SHA1
f405e25dae99ee4e552eccc500c13743cdc7d04b

SHA256
fbe96d91a3067b05275d170e6b7977e4274aca43415c1e5a5fad4cf3408490f7

SHA512
2775550f1c6af91d6de2709f24360668d46a03f369d395f18667827f144a02367e7a0a68dd4bedf92d74ef10dc221e89a959e711201559e270a401acdde32c42

Download Submit
/root/.mozilla/firefox/rddy1yks.default-release/times.json
Filesize
47B

MD5
895b600e3ff4fba3b4cc68f96a786ff5

SHA1
ba5d80d5a59b5af3adbbf4496e925ae9d992062e

SHA256
b9822df1ca24df263f2e36a8796de1b959d2616a49dd8efbd679c8e733d1c4de

SHA512
2c84e753055a284269c4d9b39e9103013c1134a32305268a5d372fb2f6314fa76f0efb1cefbdec277e336fba7c1433c1de2bff9b0e1952a5430618942b9a5509

Download Submit