hxxps://www[.]virtualbox[.]org/wiki/Downloads

Analysis

max time kernel
1122s
max time network
1083s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240508-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
26-05-2024 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.virtualbox.org/wiki/Downloads

Score

6^/10

antivm

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

326 drive.google.com
327 drive.google.com
330 drive.google.com

flow	ioc
326	drive.google.com
327	drive.google.com
330	drive.google.com

Changes its process name 64 IoCs

Processes:

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	gmain	1551
Changes the process name, possibly in an attempt to hide itself	gdbus	1553
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1554
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1556
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1556
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1556
Changes the process name, possibly in an attempt to hide itself	Timer	1557
Changes the process name, possibly in an attempt to hide itself	Timer	1557
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1559
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1559
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1561
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1560
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1560
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1561
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1558
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1558
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1562
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1562
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1564
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1563
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1566
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1566
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1568
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1568
Changes the process name, possibly in an attempt to hide itself	glxtest:disk$0	1569
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1570
Changes the process name, possibly in an attempt to hide itself	Cookie	1571
Changes the process name, possibly in an attempt to hide itself	Cookie	1571
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1572
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1572
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1574
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1573
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	1575
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	1575
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1576
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1576
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	1578
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	1578
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	1578
Changes the process name, possibly in an attempt to hide itself	CanvasRenderer	1583
Changes the process name, possibly in an attempt to hide itself	CanvasRenderer	1583
Changes the process name, possibly in an attempt to hide itself	Compositor	1582
Changes the process name, possibly in an attempt to hide itself	Compositor	1582
Changes the process name, possibly in an attempt to hide itself	WRWorkerLP#0	1581
Changes the process name, possibly in an attempt to hide itself	WRWorkerLP#0	1581
Changes the process name, possibly in an attempt to hide itself	WRWorker#0	1580
Changes the process name, possibly in an attempt to hide itself	WRWorker#0	1580
Changes the process name, possibly in an attempt to hide itself	Renderer	1579
Changes the process name, possibly in an attempt to hide itself	Renderer	1579
Changes the process name, possibly in an attempt to hide itself	ImageIO	1584
Changes the process name, possibly in an attempt to hide itself	ImageIO	1584
Changes the process name, possibly in an attempt to hide itself	Permission	1585
Changes the process name, possibly in an attempt to hide itself	Permission	1585
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1588
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1588
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1587
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1587
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1586
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1589
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1590
Changes the process name, possibly in an attempt to hide itself	gmain	1593
Changes the process name, possibly in an attempt to hide itself	gdbus	1594
Changes the process name, possibly in an attempt to hide itself	pool-/usr/libex	1595
Changes the process name, possibly in an attempt to hide itself	gmain	1599

Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

firefox

description ioc process

File opened for reading /proc/cpuinfo firefox

description	ioc	process
File opened for reading	/proc/cpuinfo	firefox

Reads CPU attributes 1 TTPs 27 IoCs

System Information Discovery

T1082

Processes:

firefoxnautilusfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxnautilusfirefox

description	ioc	process
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	nautilus
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	nautilus
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

glxtestfirefoxfirefoxgvfs-gphoto2-volume-monitorfirefoxfirefoxfirefoxgvfs-mtp-volume-monitorfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefox

description	ioc	process
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:05.0/usb1/uevent	gvfs-gphoto2-volume-monitor
File opened for reading	/sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/uevent	gvfs-gphoto2-volume-monitor
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/usb/devices	gvfs-mtp-volume-monitor
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	glxtest
File opened for reading	/sys/bus	gvfs-mtp-volume-monitor
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:05.0/usb1/uevent	gvfs-mtp-volume-monitor
File opened for reading	/sys/class	gvfs-gphoto2-volume-monitor
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/uevent	gvfs-mtp-volume-monitor
File opened for reading	/sys/class	gvfs-mtp-volume-monitor
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices	glxtest

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

firefoxfirefoxgvfsd-trashfirefoxfirefoxxdg-desktop-portalfirefoxfirefoxfirefoxdbus-daemonfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxgvfsd-fusegvfs-udisks2-volume-monitorfirefoxsedgoa-identity-servicefirefoxfirefoxgvfs-gphoto2-volume-monitorfirefoxsedxdg-desktop-portal-gtkfirefox

description	ioc	process
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	gvfsd-trash
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/fd/123	firefox
File opened for reading	/proc/mounts	xdg-desktop-portal
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/119	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1843/cmdline	dbus-daemon
File opened for reading	/proc/1602/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/34	firefox
File opened for reading	/proc/self/fd/81	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/task/1747/stat	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/135	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1908/cmdline	dbus-daemon
File opened for reading	/proc/self/task/7146/stat	firefox
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/self/fd/12	firefox
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/68	firefox
File opened for reading	/proc/filesystems	gvfs-udisks2-volume-monitor
File opened for reading	/proc/self/task/7090/stat	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/137	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/sys/kernel/cap_last_cap	dbus-daemon
File opened for reading	/proc/self/mountinfo	gvfsd-trash
File opened for reading	/proc/filesystems	goa-identity-service
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/fd/32	firefox
File opened for reading	/proc/1617/cmdline	dbus-daemon
File opened for reading	/proc/self/task/1973/stat	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/task/1513/stat	firefox
File opened for reading	/proc/self/fd/69	firefox
File opened for reading	/proc/self/task/1739/stat	firefox
File opened for reading	/proc/filesystems	gvfs-gphoto2-volume-monitor
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/fd/129	firefox
File opened for reading	/proc/self/task/6997/stat	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/1641/cmdline	dbus-daemon
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/stat	firefox

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

Processes:

firefox

description	ioc	process
File opened for modification	/tmp/mozilla-temp-925534813	firefox
File opened for modification	/tmp/firefox/.parentlock	firefox
File opened for modification	/tmp/tmpaddon	firefox
File opened for modification	/tmp/LSHnbzHd.exe	firefox
File opened for modification	/tmp/GsBV0TKB.deb	firefox
File opened for modification	/tmp/1fqN97t-.iso	firefox
File opened for modification	/tmp/mozilla-temp-1643486519	firefox

/usr/bin/xdg-open
xdg-open https://www.virtualbox.org/wiki/Downloads
1⤵
PID:1415
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  PID:1416
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr
    3⤵
    PID:1423
  - - /usr/bin/dbus-daemon
      /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
      4⤵
      Reads runtime system information
      PID:1426
    - - /usr/libexec/xdg-desktop-portal
        
        /usr/libexec/xdg-desktop-portal
        5⤵
        Reads runtime system information
        
        PID:1592
    - - /usr/libexec/xdg-document-portal
        
        /usr/libexec/xdg-document-portal
        5⤵
        
        PID:1597
    - - /usr/libexec/xdg-permission-store
        
        /usr/libexec/xdg-permission-store
        5⤵
        
        PID:1602
    - - /usr/libexec/xdg-desktop-portal-gtk
        
        /usr/libexec/xdg-desktop-portal-gtk
        5⤵
        Reads runtime system information
        
        PID:1613
    - - /usr/libexec/gvfsd
        
        /usr/libexec/gvfsd
        5⤵
        
        PID:1617
      - /usr/libexec/gvfsd-trash
        
        /usr/libexec/gvfsd-trash --spawner :1.8 /org/gtk/gvfs/exec_spaw/0
        6⤵
        Reads runtime system information
        
        PID:1650
    - - /usr/libexec/dconf-service
        
        /usr/libexec/dconf-service
        5⤵
        
        PID:1641
    - - /usr/bin/nautilus
        
        /usr/bin/nautilus --gapplication-service
        5⤵
        Reads CPU attributes
        
        PID:1647
    - - /usr/bin/gnome-keyring-daemon
        
        /usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"
        5⤵
        
        PID:1812
    - - /usr/libexec/gvfs-udisks2-volume-monitor
        
        /usr/libexec/gvfs-udisks2-volume-monitor
        5⤵
        Reads runtime system information
        
        PID:1820
    - - /usr/libexec/gvfs-afc-volume-monitor
        
        /usr/libexec/gvfs-afc-volume-monitor
        5⤵
        
        PID:1826
    - - /usr/libexec/gvfs-mtp-volume-monitor
        
        /usr/libexec/gvfs-mtp-volume-monitor
        5⤵
        Enumerates kernel/hardware configuration
        
        PID:1832
    - - /usr/libexec/gvfs-gphoto2-volume-monitor
        
        /usr/libexec/gvfs-gphoto2-volume-monitor
        5⤵
        Enumerates kernel/hardware configuration
        Reads runtime system information
        
        PID:1837
    - - /usr/libexec/gvfs-goa-volume-monitor
        
        /usr/libexec/gvfs-goa-volume-monitor
        5⤵
        
        PID:1843
    - - /usr/libexec/goa-daemon
        
        /usr/libexec/goa-daemon
        5⤵
        
        PID:1848
    - - /usr/libexec/goa-identity-service
        
        /usr/libexec/goa-identity-service
        5⤵
        Reads runtime system information
        
        PID:1855
    - - /usr/bin/nautilus
        
        /usr/bin/nautilus --gapplication-service
        5⤵
        Reads CPU attributes
        
        PID:1908
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1433
- /usr/bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1434
- /usr/bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1436
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1435
- /usr/bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1438
- /usr/bin/uname
  uname
  2⤵
  PID:1439
- /usr/bin/grep
  grep -q "^file://"
  2⤵
  PID:1441
- /usr/bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1443
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1443
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1443
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1443
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1443
- /usr/bin/sed
  sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
  2⤵
  PID:1446
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/https
  2⤵
  PID:1447
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    PID:1448
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr
      4⤵
      PID:1449
- - /usr/bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1451
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1450
- - /usr/bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1453
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1452
- - /usr/bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1455
- - /usr/bin/uname
    uname
    3⤵
    PID:1456
- - /usr/bin/sed
    sed "s/:/ /g"
    3⤵
    - Reads runtime system information
    PID:1459
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1462
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1464
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1463
- - /usr/bin/grep
    grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    PID:1461
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1469
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1468
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1467
- - /usr/bin/grep
    grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    PID:1466
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1474
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1473
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1472
- - /usr/bin/grep
    grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    PID:1471
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1479
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1478
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1477
- - /usr/bin/grep
    grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    PID:1476
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1484
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1483
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1482
- - /usr/bin/grep
    grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
    3⤵
    PID:1481
- /usr/bin/sed
  sed "s/:/ /g"
  2⤵
  PID:1487
- /usr/bin/sed
  sed -e "s|-|/|"
  2⤵
  PID:1490
- /usr/bin/sed
  sed -e "s|-|/|"
  2⤵
  - Reads runtime system information
  PID:1493
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1498
- /usr/bin/which
  which firefox
  2⤵
  PID:1499
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1502
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1505
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1510
- /usr/bin/firefox
  /usr/bin/firefox https://www.virtualbox.org/wiki/Downloads
  2⤵
  PID:1511
- - /usr/bin/which
    which /usr/bin/firefox
    3⤵
    PID:1512
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox https://www.virtualbox.org/wiki/Downloads
  2⤵
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1511
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1552
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1552
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1552
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1552
- - /usr/lib/firefox/glxtest
    /usr/lib/firefox/glxtest -f 13
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1555
- - /usr/bin/lsb_release
    /usr/bin/lsb_release -idrc
    3⤵
    PID:1567
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1577
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1577
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1577
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1577
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -prefsLen 20597 -prefMapSize 234708 -appDir /usr/lib/firefox/browser "{b5247d12-70ae-4000-b948-a9c6ca466658}" 1511 true socket
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:1589
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 20271 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{faf5e8d5-bc8c-49f5-9333-0f887a5ce883}" 1511 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1664
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 28472 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{a75662a9-1f8d-4197-998a-db7a91a821a2}" 1511 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1712
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -sandboxingKind 0 -prefsLen 29238 -prefMapSize 234708 -appDir /usr/lib/firefox/browser "{a821ac1e-7ab1-4f45-9b8a-ac31b014cd5c}" 1511 true utility
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1738
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 25660 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{2897744d-5224-493c-b4a4-e383fccafa23}" 1511 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1740
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 25660 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{341ec014-9cdb-4d2e-a1f6-63f2963e91ee}" 1511 true tab
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1744
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 25660 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{14cf2d0a-3d87-4605-abb4-5748c1f56111}" 1511 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1771
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 6 -isForBrowser -prefsLen 33468 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{4448fa07-3843-4fbe-a3e0-d2494c3ee4de}" 1511 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1970
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 7 -isForBrowser -prefsLen 29228 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{d608b9bf-e68c-4b20-9163-566b5df6444e}" 1511 true tab
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:2006
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 8 -isForBrowser -prefsLen 29228 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{c34b8741-59ca-4a1e-b71a-fac503a30849}" 1511 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:6943
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 9 -isForBrowser -prefsLen 29228 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{2c06e4cf-b9c1-4326-990c-7d05943d0e36}" 1511 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:6964
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 10 -isForBrowser -prefsLen 29228 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{c3b6282d-cfdf-4083-9706-618c5a943f36}" 1511 true tab
    3⤵
    - Reads CPU attributes
    PID:6987
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 11 -isForBrowser -prefsLen 29228 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{43cf85d7-57af-4fff-9fb1-80f8d6a0f631}" 1511 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:6991
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 12 -isForBrowser -prefsLen 29228 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{8393c7dc-d102-4787-bf02-e77129d5ea29}" 1511 true tab
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:6993
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 13 -isForBrowser -prefsLen 29228 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{5aa40876-14ee-4c67-88b3-d2b8bd3bd623}" 1511 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:7039
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 14 -isForBrowser -prefsLen 29228 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{cd7a4df4-34cb-47c3-bf8f-c4f7bd42d995}" 1511 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:7088
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 15 -isForBrowser -prefsLen 29228 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{d61b35df-2ea5-4271-80d4-ef5df6270865}" 1511 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:7110
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 16 -isForBrowser -prefsLen 29228 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{e22b598e-ee36-405a-8a58-c316051b2746}" 1511 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:7114
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 17 -isForBrowser -prefsLen 29228 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{f033f68b-7218-480c-aef3-8c0ee618921f}" 1511 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:7144
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 18 -isForBrowser -prefsLen 29228 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{9fa2fedc-be82-4964-b10d-58e8c35c0352}" 1511 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:7153
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 19 -isForBrowser -prefsLen 29228 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{1fec9a55-0304-4067-b7cd-ebd9d7f90976}" 1511 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:7321

/usr/libexec/gvfsd-fuse
/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:1623

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user

Filesize
2B

MD5
c4103f122d27677c9db144cae1394a66

SHA1
1489f923c4dca729178b3e3233458550d8dddf29

SHA256
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

SHA512
5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54

Download Submit
/root/Downloads/1fqN97t-.iso.part

Filesize
324KB

MD5
410e220d734c0e07836b241dbad73960

SHA1
6649c441fb1476c157d9bccce10289b096d9a630

SHA256
edc191fea9bc39893f152f63bca3084656804e307e095fed891a26729f1c84c2

SHA512
f26ff22d5639314542b4cce917bd79acd476e85498ee25c2ed8a3b7363ff80f63a24530eaa3883d634e26f018ab513f9877af630812c1cbb520e3ac6c06b87b0

Download Submit
/root/Downloads/GsBV0TKB.deb.part

Filesize
65KB

MD5
3094dbfacf699ea3804485d27bf8b5c2

SHA1
08a34de6f3c481917f31b7f6952faad8112a19bf

SHA256
df82dabdd7e6520854c2f938ce68522d5b7b33d6d3cac571a59d358b7eec26e9

SHA512
e861cfabfc854717d2dd3fe7a0c643722d2e9fa29fa113f91519f58a953f480f024aee4d583230c4048c3a6edbf1c5c8d4f1f78775edd15dd0b42a47d889a481

Download Submit
/root/Downloads/LSHnbzHd.exe.part

Filesize
324KB

MD5
688cd1825be20901b38feb6eb5d97bd8

SHA1
b9ba2b086e8f268f8a58d5028dcdb280f86d68c3

SHA256
033e134fbeacfb35c99d20edce4c62ae4956d7b8ec1af0f7c9da149d1ce21e60

SHA512
01436011dca50108b6426a93eea83936db40fd1a90d9f4c533e652e83e027b9a0b8ce9407bfd20197d8d450e03c97fd08cb8506a38d5bf7ecb9f9ed4ae16ae32

Download Submit
/root/Downloads/VirtualBox-7.D7NrC_qV.0.18-162988-Win.exe.part

Filesize
11.2MB

MD5
52e4549073f56e941c841e1eb521d7ac

SHA1
e93b17a1e2abd29a7e0e33115ac72df7ca4af6cb

SHA256
bad687899d55e95f322af49453dd3a30de27d9a92f4ebe24b99fcc8d2e5bbee1

SHA512
aabc5611bb857471bdeb553a38d38d6f56eab9c529a93f46c0a53c2a65cb8208583b8d2e4c42d05c9d6768a3998de7a0fc6ddf35b60aafe84cfb0fbddc1b9e45

Download Submit
/root/Downloads/redstar_desktop3.0GGnxcAo.0_sign.iso.part

Filesize
2493.5MB

MD5
caa9d70777e3e0b357ac48a37a8c9b1f

SHA1
d93ece5a2e09c24216b2f46e88b58efaccd4bc0e

SHA256
7f1aa4b54e66b769b2cb7d8ab9604c26b95cc8ce7ec13b7f07458b4fadb34ac3

SHA512
c4cbbe03b26503425c8b885f5f9c51d716504abb02ae6b7f922028bad1bd90b8dc217fa83ffb6c416bb884f7b953bd49b256e35d885c277891baa62e50926c6f

Download Submit
/root/Downloads/virtualbox-7.Tj8TeADr.0_7.0.18-162988~Ubuntu~focal_amd64.deb.part

Filesize
88.2MB

MD5
ca82bc4d118565948e6a235399892a51

SHA1
15f2f00adb757dd4a788d6cc6026f6ec59ad5b25

SHA256
01b9d4a192fd69301618d0ffe6dd918db902350bf633d13c996bb3e0c57ae290

SHA512
230ff6546d108077612698c6c2345b1854a2eac584d18a09b2ca2993b6986c73adfe312da0fc7bd620d320cb095a0016ab233313e68af1c115d68e4d23270583

Download Submit
/tmp/mozilla-temp-1643486519

Filesize
5.8MB

MD5
6619814ce7d26f19b950b70596a3c4a2

SHA1
3e80c8b1a56c5616fabbd2cac32199db06a907ed

SHA256
7613a0d102ed53d9414a174c22f7846c70e082027b8160dec22f5a2260a3023f

SHA512
f420580c82fb4cd7b85c5bad26ee8f6438769c00dd5fce82f818b8ec2273c790aba8f14710429db9124439eba8b39c8d6edbc6a5501b18f0f0e14ab5581c9466

Download Submit
/tmp/mozilla-temp-925534813

Filesize
4.6MB

MD5
4da908f7ff1388740a4c35227f650935

SHA1
e279c1d088dd146518a9acd3dd0a9ebd0549b69e

SHA256
a9903b633d13d03db1d493aebef62f9817c12a44702d79c1552032c4144ec892

SHA512
3a649c10bcfef71bdecf53a1eb5092270fa9debf8604358fd1e81a8c34ca5d1d745fba93bdb849ea3f734dab36b4d3476e865534e145632c60c2dac3bb56c4e8

Download Submit
/tmp/tmpaddon

Filesize
569KB

MD5
30082ae40dc48af6343db2fd22cfc645

SHA1
3eb577555ee638e8beb01173e8f29e172747a728

SHA256
85d4b95f9b2075daee9b0e64bce8d9d7343d0dda10e6072d7f9485a68472ee76

SHA512
53a58bfb4c8124ad4f7655b99bfdea290033a085e0796b19245b33b91c0948fdac9f0c3e817130b352493a65d9a7a0fc8a7c1eedc618cdaa2b4580734a11cd9c

Download Submit