Resubmissions
27-04-2024 22:27
240427-2dgbjshh85 827-04-2024 22:27
240427-2c6j2sac3w 827-04-2024 22:26
240427-2cpljaac2w 827-04-2024 22:25
240427-2byg2sab8v 827-04-2024 22:24
240427-2bfbgaab7v 8Analysis
-
max time kernel
0s -
max time network
12s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240418-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240418-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
27-04-2024 22:27
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://region1.analytics.google.com/g/collect?v=2&tid=G-NG3X7N18WW&_ng=1>m=45je44o0v882517426z871307953za200&_p=1714244910918&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=1553257986.1714244912&ul=en-us&sr=320x640&ir=1&pscdl=noapi&_eu=EA&_s=1&sid=1714244912&sct=1&seg=0&dl=https%3A%2F%2Fmembership.honorsociety.org%2Fmember%2Fdues%3Fwelcome_back_mail%3Dlouise_arnaud%40mteen.net&dt=Honor%20Society&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=4046
Resource
ubuntu1804-amd64-20240418-en
General
-
Target
https://region1.analytics.google.com/g/collect?v=2&tid=G-NG3X7N18WW&_ng=1>m=45je44o0v882517426z871307953za200&_p=1714244910918&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=1553257986.1714244912&ul=en-us&sr=320x640&ir=1&pscdl=noapi&_eu=EA&_s=1&sid=1714244912&sct=1&seg=0&dl=https%3A%2F%2Fmembership.honorsociety.org%2Fmember%2Fdues%3Fwelcome_back_mail%3Dlouise_arnaud%40mteen.net&dt=Honor%20Society&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=4046
Malware Config
Signatures
-
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
firefoxfirefoxfirefoxdescription ioc process File opened for reading /sys/bus/pci/devices/0000:00:04.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/device firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/device firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/device firefox File opened for reading /sys/bus/pci/devices firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/class firefox File opened for reading /sys/bus/pci/devices firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/class firefox File opened for reading /sys/bus/pci/devices firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/class firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/class firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/class firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/device firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor firefox -
Reads runtime system information 16 IoCs
Reads data from /proc virtual filesystem.
Processes:
sedfirefoxfirefoxfirefoxsedseddbus-senddbus-sendsedseddescription ioc process File opened for reading /proc/filesystems sed File opened for reading /proc/self/task/1646/stat firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/self/task/1659/stat firefox File opened for reading /proc/self/task/1672/stat firefox File opened for reading /proc/self/stat firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems sed File opened for reading /proc/self/stat firefox File opened for reading /proc/self/stat firefox File opened for reading /proc/self/fd dbus-send File opened for reading /proc/filesystems firefox File opened for reading /proc/self/fd dbus-send File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems sed
Processes
-
/usr/bin/xdg-openxdg-open "https://region1.analytics.google.com/g/collect?v=2&tid=G-NG3X7N18WW&_ng=1>m=45je44o0v882517426z871307953za200&_p=1714244910918&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=1553257986.1714244912&ul=en-us&sr=320x640&ir=1&pscdl=noapi&_eu=EA&_s=1&sid=1714244912&sct=1&seg=0&dl=https%3A%2F%2Fmembership.honorsociety.org%2Fmember%2Fdues%3Fwelcome_back_mail%3Dlouise_arnaud%40mteen.net&dt=Honor%20Society&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=4046"1⤵PID:1539
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
- Reads runtime system information
PID:1540 -
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr3⤵PID:1541
-
/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵PID:1545
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:1544
-
/bin/grepgrep -i "^xfce_desktop_window"2⤵PID:1550
-
/usr/bin/xpropxprop -root2⤵PID:1549
-
/bin/grepgrep -q "^Enlightenment"2⤵PID:1555
-
/bin/unameuname2⤵PID:1557
-
/bin/grepgrep -q "^file://"2⤵PID:1560
-
/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1563
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1563
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1563
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1563
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1563
-
/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1563
-
/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1563
-
/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
PID:1566 -
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/https2⤵PID:1567
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
- Reads runtime system information
PID:1568 -
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr4⤵PID:1569
-
/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵PID:1571
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:1570
-
/bin/grepgrep -i "^xfce_desktop_window"3⤵PID:1576
-
/usr/bin/xpropxprop -root3⤵PID:1575
-
/bin/grepgrep -q "^Enlightenment"3⤵PID:1581
-
/bin/unameuname3⤵PID:1585
-
/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
PID:1588 -
/usr/bin/cutcut -d ";" -f 13⤵PID:1593
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1592
-
/usr/bin/headhead -n 13⤵PID:1591
-
/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵PID:1590
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1599
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1598
-
/usr/bin/headhead -n 13⤵PID:1597
-
/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵PID:1596
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1604
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1603
-
/usr/bin/headhead -n 13⤵PID:1602
-
/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵PID:1601
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1608
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1609
-
/usr/bin/headhead -n 13⤵PID:1607
-
/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵PID:1606
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1614
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1613
-
/usr/bin/headhead -n 13⤵PID:1612
-
/bin/grepgrep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵PID:1611
-
/bin/sedsed "s/:/ /g"2⤵
- Reads runtime system information
PID:1617 -
/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:1620 -
/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:1623 -
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1628
-
/usr/bin/whichwhich firefox2⤵PID:1629
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1632
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1635
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1643
-
/usr/bin/firefox/usr/bin/firefox "https://region1.analytics.google.com/g/collect?v=2&tid=G-NG3X7N18WW&_ng=1>m=45je44o0v882517426z871307953za200&_p=1714244910918&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=1553257986.1714244912&ul=en-us&sr=320x640&ir=1&pscdl=noapi&_eu=EA&_s=1&sid=1714244912&sct=1&seg=0&dl=https%3A%2F%2Fmembership.honorsociety.org%2Fmember%2Fdues%3Fwelcome_back_mail%3Dlouise_arnaud%40mteen.net&dt=Honor%20Society&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=4046"2⤵PID:1644
-
/usr/bin/whichwhich /usr/bin/firefox3⤵PID:1645
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox "https://region1.analytics.google.com/g/collect?v=2&tid=G-NG3X7N18WW&_ng=1>m=45je44o0v882517426z871307953za200&_p=1714244910918&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=1553257986.1714244912&ul=en-us&sr=320x640&ir=1&pscdl=noapi&_eu=EA&_s=1&sid=1714244912&sct=1&seg=0&dl=https%3A%2F%2Fmembership.honorsociety.org%2Fmember%2Fdues%3Fwelcome_back_mail%3Dlouise_arnaud%40mteen.net&dt=Honor%20Society&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=4046"2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1644 -
/bin/grepgrep -q "%s"2⤵PID:1653
-
/usr/bin/x-www-browserx-www-browser "https://region1.analytics.google.com/g/collect?v=2&tid=G-NG3X7N18WW&_ng=1>m=45je44o0v882517426z871307953za200&_p=1714244910918&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=1553257986.1714244912&ul=en-us&sr=320x640&ir=1&pscdl=noapi&_eu=EA&_s=1&sid=1714244912&sct=1&seg=0&dl=https%3A%2F%2Fmembership.honorsociety.org%2Fmember%2Fdues%3Fwelcome_back_mail%3Dlouise_arnaud%40mteen.net&dt=Honor%20Society&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=4046"2⤵PID:1654
-
/usr/bin/whichwhich /usr/bin/x-www-browser3⤵PID:1655
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox "https://region1.analytics.google.com/g/collect?v=2&tid=G-NG3X7N18WW&_ng=1>m=45je44o0v882517426z871307953za200&_p=1714244910918&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=1553257986.1714244912&ul=en-us&sr=320x640&ir=1&pscdl=noapi&_eu=EA&_s=1&sid=1714244912&sct=1&seg=0&dl=https%3A%2F%2Fmembership.honorsociety.org%2Fmember%2Fdues%3Fwelcome_back_mail%3Dlouise_arnaud%40mteen.net&dt=Honor%20Society&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=4046"2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1654 -
/bin/grepgrep -q "%s"2⤵PID:1666
-
/usr/bin/firefoxfirefox "https://region1.analytics.google.com/g/collect?v=2&tid=G-NG3X7N18WW&_ng=1>m=45je44o0v882517426z871307953za200&_p=1714244910918&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=1553257986.1714244912&ul=en-us&sr=320x640&ir=1&pscdl=noapi&_eu=EA&_s=1&sid=1714244912&sct=1&seg=0&dl=https%3A%2F%2Fmembership.honorsociety.org%2Fmember%2Fdues%3Fwelcome_back_mail%3Dlouise_arnaud%40mteen.net&dt=Honor%20Society&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=4046"2⤵PID:1667
-
/usr/bin/whichwhich /usr/bin/firefox3⤵PID:1668
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox "https://region1.analytics.google.com/g/collect?v=2&tid=G-NG3X7N18WW&_ng=1>m=45je44o0v882517426z871307953za200&_p=1714244910918&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=1553257986.1714244912&ul=en-us&sr=320x640&ir=1&pscdl=noapi&_eu=EA&_s=1&sid=1714244912&sct=1&seg=0&dl=https%3A%2F%2Fmembership.honorsociety.org%2Fmember%2Fdues%3Fwelcome_back_mail%3Dlouise_arnaud%40mteen.net&dt=Honor%20Society&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=4046"2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1667 -
/bin/grepgrep -q "%s"2⤵PID:1679
-
/bin/grepgrep -q "%s"2⤵PID:1684
-
/bin/grepgrep -q "%s"2⤵PID:1686
-
/bin/grepgrep -q "%s"2⤵PID:1688
-
/bin/grepgrep -q "%s"2⤵PID:1690
-
/bin/grepgrep -q "%s"2⤵PID:1692
-
/bin/grepgrep -q "%s"2⤵PID:1694
-
/bin/grepgrep -q "%s"2⤵PID:1696
-
/bin/grepgrep -q "%s"2⤵PID:1698
-
/bin/grepgrep -q "%s"2⤵PID:1700
-
/bin/grepgrep -q "%s"2⤵PID:1702
-
/bin/grepgrep -q "%s"2⤵PID:1704
-
/bin/grepgrep -q "%s"2⤵PID:1706
-
/bin/grepgrep -q "%s"2⤵PID:1708