Resubmissions
25/05/2024, 05:42
240525-geeh5agb8z 1Analysis
-
max time kernel
0s -
max time network
16s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
24/05/2024, 20:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.surveymonkey.com/tr/v1/te/akU_2BQc2vAhAsa_2B264x1g6_2FpF_2Fhy3EhxbpxJDHYpYZT3PErDK_2Bf6OjNYOPsqZdKwg_2FdGRiGnm_2F0m8noAHL9RnT4On9GjEh70mfx1B041j_2FcbW_2B_2F_2FhWaUfq0ezR30vLAtbbEkY_2FZMRC4kbUUIC3P1YclyQZlt6LFL5ND2dWsKZ2pgqCBnetx7KXCyMs0VCbO3sxxW_2Fqf1xZ3cg1O0scKpdBqR_2FkG5BBTQjSw_2FxRkhDPx12PeBd9UF_2BT_2Bpfc0KVWNeH
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
2 signatures
150 seconds
General
-
Target
https://www.surveymonkey.com/tr/v1/te/akU_2BQc2vAhAsa_2B264x1g6_2FpF_2Fhy3EhxbpxJDHYpYZT3PErDK_2Bf6OjNYOPsqZdKwg_2FdGRiGnm_2F0m8noAHL9RnT4On9GjEh70mfx1B041j_2FcbW_2B_2F_2FhWaUfq0ezR30vLAtbbEkY_2FZMRC4kbUUIC3P1YclyQZlt6LFL5ND2dWsKZ2pgqCBnetx7KXCyMs0VCbO3sxxW_2Fqf1xZ3cg1O0scKpdBqR_2FkG5BBTQjSw_2FxRkhDPx12PeBd9UF_2BT_2Bpfc0KVWNeH
Score
3/10
Malware Config
Signatures
-
Enumerates kernel/hardware configuration 1 TTPs 46 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/pci/devices/0000:00:04.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/class firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/class firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/device firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/device firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/class firefox File opened for reading /sys/bus/pci/devices firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/device firefox -
Reads runtime system information 3 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/self/stat firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/self/task/1500/stat firefox
Processes
-
/usr/bin/firefoxfirefox -new-tab https://www.surveymonkey.com/tr/v1/te/akU_2BQc2vAhAsa_2B264x1g6_2FpF_2Fhy3EhxbpxJDHYpYZT3PErDK_2Bf6OjNYOPsqZdKwg_2FdGRiGnm_2F0m8noAHL9RnT4On9GjEh70mfx1B041j_2FcbW_2B_2F_2FhWaUfq0ezR30vLAtbbEkY_2FZMRC4kbUUIC3P1YclyQZlt6LFL5ND2dWsKZ2pgqCBnetx7KXCyMs0VCbO3sxxW_2Fqf1xZ3cg1O0scKpdBqR_2FkG5BBTQjSw_2FxRkhDPx12PeBd9UF_2BT_2Bpfc0KVWNeH1⤵PID:1498
-
/usr/bin/whichwhich /usr/bin/firefox2⤵PID:1499
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -new-tab https://www.surveymonkey.com/tr/v1/te/akU_2BQc2vAhAsa_2B264x1g6_2FpF_2Fhy3EhxbpxJDHYpYZT3PErDK_2Bf6OjNYOPsqZdKwg_2FdGRiGnm_2F0m8noAHL9RnT4On9GjEh70mfx1B041j_2FcbW_2B_2F_2FhWaUfq0ezR30vLAtbbEkY_2FZMRC4kbUUIC3P1YclyQZlt6LFL5ND2dWsKZ2pgqCBnetx7KXCyMs0VCbO3sxxW_2Fqf1xZ3cg1O0scKpdBqR_2FkG5BBTQjSw_2FxRkhDPx12PeBd9UF_2BT_2Bpfc0KVWNeH1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1498