Analysis

  • max time kernel
    44s
  • max time network
    46s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240508-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    24-06-2024 22:26

Errors

Reason
Machine shutdown

General

  • Target

    http://Google.com

Score
4/10

Malware Config

Signatures

  • Changes its process name 64 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads CPU attributes 1 TTPs 13 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /usr/bin/firefox
    firefox -new-tab http://Google.com
    1⤵
      PID:1412
      • /usr/bin/which
        which /usr/bin/firefox
        2⤵
          PID:1414
      • /usr/lib/firefox/firefox
        /usr/lib/firefox/firefox -new-tab http://Google.com
        1⤵
        • Checks CPU configuration
        • Reads CPU attributes
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        • Writes file to tmp directory
        PID:1412
        • /usr/local/sbin/dbus-launch
          dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
          2⤵
            PID:1449
          • /usr/local/bin/dbus-launch
            dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
            2⤵
              PID:1449
            • /usr/sbin/dbus-launch
              dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
              2⤵
                PID:1449
              • /usr/bin/dbus-launch
                dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                2⤵
                  PID:1449
                  • /usr/bin/dbus-daemon
                    /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
                    3⤵
                    • Reads runtime system information
                    PID:1451
                    • /usr/libexec/xdg-desktop-portal
                      /usr/libexec/xdg-desktop-portal
                      4⤵
                      • Reads runtime system information
                      PID:1493
                    • /usr/libexec/xdg-document-portal
                      /usr/libexec/xdg-document-portal
                      4⤵
                      • Reads runtime system information
                      PID:1498
                    • /usr/libexec/xdg-permission-store
                      /usr/libexec/xdg-permission-store
                      4⤵
                        PID:1503
                      • /usr/libexec/xdg-desktop-portal-gtk
                        /usr/libexec/xdg-desktop-portal-gtk
                        4⤵
                          PID:1513
                        • /usr/libexec/gvfsd
                          /usr/libexec/gvfsd
                          4⤵
                          • Reads runtime system information
                          PID:1517
                          • /usr/libexec/gvfsd-trash
                            /usr/libexec/gvfsd-trash --spawner :1.6 /org/gtk/gvfs/exec_spaw/0
                            5⤵
                            • Reads runtime system information
                            PID:1549
                        • /usr/libexec/dconf-service
                          /usr/libexec/dconf-service
                          4⤵
                          • Reads runtime system information
                          PID:1540
                        • /usr/bin/nautilus
                          /usr/bin/nautilus --gapplication-service
                          4⤵
                          • Reads CPU attributes
                          PID:1545
                        • /usr/bin/gnome-keyring-daemon
                          /usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"
                          4⤵
                          • Reads runtime system information
                          PID:1751
                        • /usr/libexec/gvfs-udisks2-volume-monitor
                          /usr/libexec/gvfs-udisks2-volume-monitor
                          4⤵
                          • Reads runtime system information
                          PID:1762
                        • /usr/libexec/gvfs-afc-volume-monitor
                          /usr/libexec/gvfs-afc-volume-monitor
                          4⤵
                          • Reads runtime system information
                          PID:1768
                        • /usr/libexec/gvfs-mtp-volume-monitor
                          /usr/libexec/gvfs-mtp-volume-monitor
                          4⤵
                          • Enumerates kernel/hardware configuration
                          PID:1774
                        • /usr/libexec/gvfs-gphoto2-volume-monitor
                          /usr/libexec/gvfs-gphoto2-volume-monitor
                          4⤵
                          • Enumerates kernel/hardware configuration
                          PID:1779
                        • /usr/libexec/gvfs-goa-volume-monitor
                          /usr/libexec/gvfs-goa-volume-monitor
                          4⤵
                            PID:1786
                          • /usr/libexec/goa-daemon
                            /usr/libexec/goa-daemon
                            4⤵
                              PID:1790
                            • /usr/libexec/goa-identity-service
                              /usr/libexec/goa-identity-service
                              4⤵
                                PID:1798
                          • /usr/lib/firefox/glxtest
                            /usr/lib/firefox/glxtest -f 13
                            2⤵
                            • Enumerates kernel/hardware configuration
                            • Reads runtime system information
                            PID:1456
                          • /usr/bin/lsb_release
                            /usr/bin/lsb_release -idrc
                            2⤵
                              PID:1468
                            • /usr/local/sbin/dbus-launch
                              dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                              2⤵
                                PID:1478
                              • /usr/local/bin/dbus-launch
                                dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                                2⤵
                                  PID:1478
                                • /usr/sbin/dbus-launch
                                  dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                                  2⤵
                                    PID:1478
                                  • /usr/bin/dbus-launch
                                    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                                    2⤵
                                      PID:1478
                                    • /usr/lib/firefox/firefox
                                      /usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -prefsLen 20982 -prefMapSize 234904 -appDir /usr/lib/firefox/browser "{20f59722-d155-4e03-a45c-4c7eb13c2f3d}" 1412 true socket
                                      2⤵
                                      • Reads CPU attributes
                                      • Enumerates kernel/hardware configuration
                                      • Reads runtime system information
                                      PID:1490
                                    • /usr/lib/firefox/firefox
                                      /usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 20185 -prefMapSize 234904 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{85f4e3f0-1d56-4b7e-9a35-572e8d515b62}" 1412 true tab
                                      2⤵
                                      • Reads CPU attributes
                                      • Reads runtime system information
                                      PID:1574
                                    • /usr/lib/firefox/firefox
                                      /usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 28916 -prefMapSize 234904 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{cc25d472-a8cd-4050-9ae1-e3072e7cab4e}" 1412 true tab
                                      2⤵
                                      • Reads CPU attributes
                                      • Enumerates kernel/hardware configuration
                                      PID:1613
                                    • /usr/lib/firefox/firefox
                                      /usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 25371 -prefMapSize 234904 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{ee445b51-9778-4eb9-9f63-4e145fe6a5ce}" 1412 true tab
                                      2⤵
                                      • Reads CPU attributes
                                      • Enumerates kernel/hardware configuration
                                      • Reads runtime system information
                                      PID:1621
                                    • /usr/lib/firefox/firefox
                                      /usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -sandboxingKind 0 -prefsLen 29527 -prefMapSize 234904 -appDir /usr/lib/firefox/browser "{d65c7a99-22a0-4a6a-bb2e-5535b9845748}" 1412 true utility
                                      2⤵
                                      • Reads CPU attributes
                                      • Enumerates kernel/hardware configuration
                                      • Reads runtime system information
                                      PID:1669
                                    • /usr/lib/firefox/firefox
                                      /usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 25649 -prefMapSize 234904 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{15baa70f-8d26-4da8-a770-c6b3902a8243}" 1412 true tab
                                      2⤵
                                      • Reads CPU attributes
                                      • Enumerates kernel/hardware configuration
                                      • Reads runtime system information
                                      PID:1674
                                    • /usr/lib/firefox/firefox
                                      /usr/lib/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 25649 -prefMapSize 234904 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{ea65ef8f-8ece-41b5-987c-d285b68096b5}" 1412 true tab
                                      2⤵
                                      • Reads CPU attributes
                                      • Enumerates kernel/hardware configuration
                                      • Reads runtime system information
                                      PID:1677
                                    • /usr/lib/firefox/firefox
                                      /usr/lib/firefox/firefox -contentproc -childID 6 -isForBrowser -prefsLen 25649 -prefMapSize 234904 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{abf8e2dc-41da-40a2-a420-5b82752b69cb}" 1412 true tab
                                      2⤵
                                      • Reads CPU attributes
                                      • Reads runtime system information
                                      PID:1683
                                  • /usr/libexec/gvfsd-fuse
                                    /usr/libexec/gvfsd-fuse /root/.cache/gvfs -f -o big_writes
                                    1⤵
                                    • Reads runtime system information
                                    PID:1522

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads