Analysis
-
max time kernel
27s -
max time network
30s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240418-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240418-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
27-04-2024 22:28
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://shop.pe/widget/main/init/params?siteid=605b561993f3c33a0f851b38&product=Honor%20Society&product_url=https%3A%2F%2Fmembership.honorsociety.org%2Fmember%2Fdues&image=&price=¤cy=undefined&rating=0&rating_count=0&review_count=0&stock_status=&description=&update_product=true&subcategory=&url=https%3A%2F%2Fmembership.honorsociety.org%2Fmember%2Fdues%3Fwelcome_back_mail%3Dlouise_arnaud%40mteen.net&callback=AddShoppersWidget.load_widget&no_cookie_callback=AddShoppersWidget.load_no_cookie&sos=false&rand=82306&cookie=&referer=
Resource
ubuntu2004-amd64-20240418-en
General
-
Target
https://shop.pe/widget/main/init/params?siteid=605b561993f3c33a0f851b38&product=Honor%20Society&product_url=https%3A%2F%2Fmembership.honorsociety.org%2Fmember%2Fdues&image=&price=¤cy=undefined&rating=0&rating_count=0&review_count=0&stock_status=&description=&update_product=true&subcategory=&url=https%3A%2F%2Fmembership.honorsociety.org%2Fmember%2Fdues%3Fwelcome_back_mail%3Dlouise_arnaud%40mteen.net&callback=AddShoppersWidget.load_widget&no_cookie_callback=AddShoppersWidget.load_no_cookie&sos=false&rand=82306&cookie=&referer=
Malware Config
Signatures
-
Changes its process name 64 IoCs
Processes:
firefoxdescription ioc pid Changes the process name, possibly in an attempt to hide itself gmain 1626 Changes the process name, possibly in an attempt to hide itself gdbus 1628 Changes the process name, possibly in an attempt to hide itself glean.dispatche 1629 Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1631 Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1631 Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1631 Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1637 Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1637 Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1636 Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1636 Changes the process name, possibly in an attempt to hide itself IPDL Background 1635 Changes the process name, possibly in an attempt to hide itself IPDL Background 1635 Changes the process name, possibly in an attempt to hide itself Socket Thread 1634 Changes the process name, possibly in an attempt to hide itself Socket Thread 1634 Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1633 Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1633 Changes the process name, possibly in an attempt to hide itself Timer 1632 Changes the process name, possibly in an attempt to hide itself Timer 1632 Changes the process name, possibly in an attempt to hide itself pool-firefox 1639 Changes the process name, possibly in an attempt to hide itself pool-firefox 1638 Changes the process name, possibly in an attempt to hide itself JS Watchdog 1641 Changes the process name, possibly in an attempt to hide itself JS Watchdog 1641 Changes the process name, possibly in an attempt to hide itself glxtest:disk$0 1643 Changes the process name, possibly in an attempt to hide itself BGReadURLs 1644 Changes the process name, possibly in an attempt to hide itself BGReadURLs 1644 Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1645 Changes the process name, possibly in an attempt to hide itself Cookie 1646 Changes the process name, possibly in an attempt to hide itself Cookie 1646 Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1647 Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1647 Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 1649 Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 1648 Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1650 Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1650 Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1651 Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1651 Changes the process name, possibly in an attempt to hide itself IndexedDB #1 1652 Changes the process name, possibly in an attempt to hide itself IndexedDB #1 1652 Changes the process name, possibly in an attempt to hide itself IPC Launch 1655 Changes the process name, possibly in an attempt to hide itself IPC Launch 1655 Changes the process name, possibly in an attempt to hide itself SandboxReporter 1654 Changes the process name, possibly in an attempt to hide itself SandboxReporter 1654 Changes the process name, possibly in an attempt to hide itself Breakpad Server 1653 Changes the process name, possibly in an attempt to hide itself DOM Worker 1657 Changes the process name, possibly in an attempt to hide itself Sandbox Forked 1656 Changes the process name, possibly in an attempt to hide itself DOM Worker 1657 Changes the process name, possibly in an attempt to hide itself Chroot Helper 1658 Changes the process name, possibly in an attempt to hide itself StreamTrans #3 1661 Changes the process name, possibly in an attempt to hide itself StreamTrans #3 1661 Changes the process name, possibly in an attempt to hide itself StreamTrans #2 1660 Changes the process name, possibly in an attempt to hide itself StreamTrans #2 1660 Changes the process name, possibly in an attempt to hide itself MainThread 1656 firefox Changes the process name, possibly in an attempt to hide itself IPC I/O Child 1662 Changes the process name, possibly in an attempt to hide itself IPC I/O Child 1662 Changes the process name, possibly in an attempt to hide itself IPC I/O Child 1662 Changes the process name, possibly in an attempt to hide itself Socket Process 1656 firefox Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1663 Changes the process name, possibly in an attempt to hide itself Socket Thread 1664 Changes the process name, possibly in an attempt to hide itself Socket Thread 1664 Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1663 Changes the process name, possibly in an attempt to hide itself Timer 1665 Changes the process name, possibly in an attempt to hide itself Timer 1665 Changes the process name, possibly in an attempt to hide itself Worker Launcher 1666 Changes the process name, possibly in an attempt to hide itself Worker Launcher 1666 -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
Processes:
firefoxdescription ioc process File opened for reading /proc/cpuinfo firefox -
Reads CPU attributes 1 TTPs 14 IoCs
Processes:
firefoxfirefoxfirefoxfirefoxfirefoxfirefoxnautilusfirefoxfirefoxfirefoxfirefoxdescription ioc process File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/online nautilus File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size firefox File opened for reading /sys/devices/system/cpu/present firefox -
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
glxtestgvfs-mtp-volume-monitorgvfs-gphoto2-volume-monitordbus-daemonfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxdescription ioc process File opened for reading /sys/bus/pci/devices/0000:00:06.0/device glxtest File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/uevent gvfs-mtp-volume-monitor File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-0:1.0/uevent gvfs-gphoto2-volume-monitor File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:01.0/irq glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor glxtest File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/resource glxtest File opened for reading /sys/bus gvfs-gphoto2-volume-monitor File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/irq glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/class glxtest File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us firefox File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/resource glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/irq glxtest File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/uevent gvfs-mtp-volume-monitor File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/irq glxtest File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/uevent gvfs-gphoto2-volume-monitor File opened for reading /sys/bus/pci/devices glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/resource glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/irq glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/class glxtest File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/pci0000:00/0000:00:02.0/device glxtest File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-0:1.0/uevent gvfs-mtp-volume-monitor File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/uevent gvfs-gphoto2-volume-monitor File opened for reading /sys/bus/pci/devices/0000:00:01.3/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/resource glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/uevent glxtest File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/usb/devices gvfs-mtp-volume-monitor File opened for reading /sys/bus/usb/devices gvfs-gphoto2-volume-monitor File opened for reading /sys/bus/pci/devices/0000:00:04.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/irq glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/resource glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/resource glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor glxtest File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/class gvfs-mtp-volume-monitor File opened for reading /sys/class gvfs-gphoto2-volume-monitor File opened for reading /sys/bus/pci/devices/0000:00:01.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/resource glxtest File opened for reading /sys/devices/system/cpu glxtest File opened for reading /sys/bus gvfs-mtp-volume-monitor File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/uevent gvfs-gphoto2-volume-monitor File opened for reading /sys/bus/pci/devices/0000:00:02.0/class glxtest -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
firefoxgvfs-afc-volume-monitorfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxxdg-desktop-portalsedfirefoxgvfs-gphoto2-volume-monitorsedsedfirefoxfirefoxdconf-servicedbus-daemongvfs-udisks2-volume-monitordbus-sendgvfsd-trashgnome-keyring-daemondescription ioc process File opened for reading /proc/self/fd/90 firefox File opened for reading /proc/1847/statm firefox File opened for reading /proc/filesystems gvfs-afc-volume-monitor File opened for reading /proc/self/maps firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/self/cgroup firefox File opened for reading /proc/self/cgroup firefox File opened for reading /proc/self/mountinfo firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/1851/smaps firefox File opened for reading /proc/self/cgroup firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/mounts xdg-desktop-portal File opened for reading /proc/self/fd/36 firefox File opened for reading /proc/filesystems xdg-desktop-portal File opened for reading /proc/self/fd/83 firefox File opened for reading /proc/1847/smaps firefox File opened for reading /proc/self/mountinfo firefox File opened for reading /proc/filesystems sed File opened for reading /proc/self/fd/102 firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/filesystems gvfs-gphoto2-volume-monitor File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems sed File opened for reading /proc/self/task/1773/stat firefox File opened for reading /proc/self/task/1857/stat firefox File opened for reading /proc/1622/root xdg-desktop-portal File opened for reading /proc/self/stat firefox File opened for reading /proc/self/fd/49 firefox File opened for reading /proc/filesystems dconf-service File opened for reading /proc/self/stat firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/self/stat firefox File opened for reading /proc/self/fd/32 firefox File opened for reading /proc/cmdline dconf-service File opened for reading /proc/filesystems firefox File opened for reading /proc/self/task/1793/stat firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/1961/cgroup gvfs-udisks2-volume-monitor File opened for reading /proc/self/fd/44 firefox File opened for reading /proc/1677/cmdline dbus-daemon File opened for reading /proc/1683/cmdline dbus-daemon File opened for reading /proc/1726/cmdline dbus-daemon File opened for reading /proc/filesystems firefox File opened for reading /proc/self/fd/101 firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/self/fd/35 firefox File opened for reading /proc/filesystems gvfs-udisks2-volume-monitor File opened for reading /proc/self/stat firefox File opened for reading /proc/self/fd/50 firefox File opened for reading /proc/self/fd/53 firefox File opened for reading /proc/1710/cmdline dbus-daemon File opened for reading /proc/filesystems firefox File opened for reading /proc/1766/statm firefox File opened for reading /proc/1961/cmdline dbus-daemon File opened for reading /proc/self/fd dbus-send File opened for reading /proc/1688/cmdline dbus-daemon File opened for reading /proc/filesystems gvfsd-trash File opened for reading /proc/self/fd/52 firefox File opened for reading /proc/sys/kernel/cap_last_cap gnome-keyring-daemon File opened for reading /proc/1/cgroup gvfs-udisks2-volume-monitor File opened for reading /proc/self/stat firefox -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes:
firefoxdescription ioc process File opened for modification /tmp/firefox/.parentlock firefox
Processes
-
/usr/bin/xdg-openxdg-open "https://shop.pe/widget/main/init/params?siteid=605b561993f3c33a0f851b38&product=Honor%20Society&product_url=https%3A%2F%2Fmembership.honorsociety.org%2Fmember%2Fdues&image=&price=¤cy=undefined&rating=0&rating_count=0&review_count=0&stock_status=&description=&update_product=true&subcategory=&url=https%3A%2F%2Fmembership.honorsociety.org%2Fmember%2Fdues%3Fwelcome_back_mail%3Dlouise_arnaud%40mteen.net&callback=AddShoppersWidget.load_widget&no_cookie_callback=AddShoppersWidget.load_no_cookie&sos=false&rand=82306&cookie=&referer="1⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
-
/usr/bin/dbus-launchdbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr3⤵
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Reads runtime system information
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵
-
/usr/libexec/gvfsd/usr/libexec/gvfsd5⤵
-
/usr/libexec/gvfsd-trash/usr/libexec/gvfsd-trash --spawner :1.8 /org/gtk/gvfs/exec_spaw/06⤵
- Reads runtime system information
-
/usr/libexec/dconf-service/usr/libexec/dconf-service5⤵
- Reads runtime system information
-
/usr/bin/nautilus/usr/bin/nautilus --gapplication-service5⤵
- Reads CPU attributes
-
/usr/bin/gnome-keyring-daemon/usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"5⤵
- Reads runtime system information
-
/usr/libexec/gvfs-udisks2-volume-monitor/usr/libexec/gvfs-udisks2-volume-monitor5⤵
- Reads runtime system information
-
/usr/libexec/gvfs-afc-volume-monitor/usr/libexec/gvfs-afc-volume-monitor5⤵
- Reads runtime system information
-
/usr/libexec/gvfs-mtp-volume-monitor/usr/libexec/gvfs-mtp-volume-monitor5⤵
- Enumerates kernel/hardware configuration
-
/usr/libexec/gvfs-gphoto2-volume-monitor/usr/libexec/gvfs-gphoto2-volume-monitor5⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
-
/usr/bin/xpropxprop -root2⤵
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
-
/usr/bin/unameuname2⤵
-
/usr/bin/grepgrep -q "^file://"2⤵
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/https2⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
- Reads runtime system information
-
/usr/bin/dbus-launchdbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr4⤵
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
-
/usr/bin/xpropxprop -root3⤵
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
-
/usr/bin/unameuname3⤵
-
/usr/bin/sedsed "s/:/ /g"3⤵
-
/usr/bin/cutcut -d ";" -f 13⤵
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
-
/usr/bin/cutcut -d "=" -f 23⤵
-
/usr/bin/headhead -n 13⤵
-
/usr/bin/cutcut -d ";" -f 13⤵
-
/usr/bin/cutcut -d "=" -f 23⤵
-
/usr/bin/headhead -n 13⤵
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
-
/usr/bin/cutcut -d ";" -f 13⤵
-
/usr/bin/cutcut -d "=" -f 23⤵
-
/usr/bin/headhead -n 13⤵
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
-
/usr/bin/cutcut -d ";" -f 13⤵
-
/usr/bin/cutcut -d "=" -f 23⤵
-
/usr/bin/headhead -n 13⤵
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
-
/usr/bin/cutcut -d ";" -f 13⤵
-
/usr/bin/cutcut -d "=" -f 23⤵
-
/usr/bin/headhead -n 13⤵
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
-
/usr/bin/sedsed "s/:/ /g"2⤵
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
/usr/bin/whichwhich firefox2⤵
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
/usr/bin/firefox/usr/bin/firefox "https://shop.pe/widget/main/init/params?siteid=605b561993f3c33a0f851b38&product=Honor%20Society&product_url=https%3A%2F%2Fmembership.honorsociety.org%2Fmember%2Fdues&image=&price=¤cy=undefined&rating=0&rating_count=0&review_count=0&stock_status=&description=&update_product=true&subcategory=&url=https%3A%2F%2Fmembership.honorsociety.org%2Fmember%2Fdues%3Fwelcome_back_mail%3Dlouise_arnaud%40mteen.net&callback=AddShoppersWidget.load_widget&no_cookie_callback=AddShoppersWidget.load_no_cookie&sos=false&rand=82306&cookie=&referer="2⤵
-
/usr/bin/whichwhich /usr/bin/firefox3⤵
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox "https://shop.pe/widget/main/init/params?siteid=605b561993f3c33a0f851b38&product=Honor%20Society&product_url=https%3A%2F%2Fmembership.honorsociety.org%2Fmember%2Fdues&image=&price=¤cy=undefined&rating=0&rating_count=0&review_count=0&stock_status=&description=&update_product=true&subcategory=&url=https%3A%2F%2Fmembership.honorsociety.org%2Fmember%2Fdues%3Fwelcome_back_mail%3Dlouise_arnaud%40mteen.net&callback=AddShoppersWidget.load_widget&no_cookie_callback=AddShoppersWidget.load_no_cookie&sos=false&rand=82306&cookie=&referer="2⤵
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 133⤵
- Enumerates kernel/hardware configuration
-
/usr/bin/lsb_release/usr/bin/lsb_release -idrc3⤵
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -prefsLen 20252 -prefMapSize 231436 -appDir /usr/lib/firefox/browser "{854a106d-2095-4361-9556-784dd49feea3}" 1622 true socket3⤵
- Changes its process name
- Reads CPU attributes
- Reads runtime system information
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 22645 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{b32bccce-14c1-4b02-a545-119e78020746}" 1622 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 22313 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{ab0ec1fb-f7a6-46e1-bd1d-c227d7d5e328}" 1622 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 22662 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{e036cedb-7c50-4155-8081-2ad92286bd1f}" 1622 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 28662 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{6396fedb-b28f-48e4-99c0-119f93b9cde7}" 1622 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -sandboxingKind 0 -prefsLen 29796 -prefMapSize 231436 -appDir /usr/lib/firefox/browser "{8cc02baa-45be-48a5-87b1-627ec7bdddf1}" 1622 true utility3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 27904 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{898548d0-9f4a-4747-9266-4788916ade72}" 1622 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 6 -isForBrowser -prefsLen 27904 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{202451a6-13e2-435d-99c2-65c9a2d9e2aa}" 1622 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 7 -isForBrowser -prefsLen 27904 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{a6f2c7d9-953c-4ffb-969d-3f4427e724cb}" 1622 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/libexec/gvfsd-fuse/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f -o big_writes1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
/root/.cache/dconf/userFilesize
2B
MD5c4103f122d27677c9db144cae1394a66
SHA11489f923c4dca729178b3e3233458550d8dddf29
SHA25696a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
SHA5125ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54
-
/root/.dbus/session-bus/4816dd152e8c48ff97e9117d197c13d8-0Filesize
466B
MD521e4d3a41d814d9a22066aa212ac01da
SHA18a589ce14bd6817d96dda40cd758baedf05fda26
SHA2560e45a7605aa988c66a6bae540fe127feb2634e0c193cbfdd2a7948063661c515
SHA512ec7d9ea9239ffa606049e8b0f0c5207935593c7bcbe2866f60b785b49333992195d693ad66f3457c858edce5dac682c268042156b797b2e1b3cf36d077af22b5