Analysis
-
max time kernel
0s -
max time network
40s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
28-06-2024 08:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://2no.co/2e0XG5
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
https://2no.co/2e0XG5
Resource
ubuntu2004-amd64-20240611-en
Behavioral task
behavioral3
Sample
https://2no.co/2e0XG5
Resource
ubuntu2204-amd64-20240522.1-en
Behavioral task
behavioral4
Sample
https://2no.co/2e0XG5
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
https://2no.co/2e0XG5
Malware Config
Signatures
-
Changes its process name 6 IoCs
Processes:
description ioc pid Changes the process name, possibly in an attempt to hide itself pool-spawner 2599 Changes the process name, possibly in an attempt to hide itself gmain 2600 Changes the process name, possibly in an attempt to hide itself dconf worker 2601 Changes the process name, possibly in an attempt to hide itself pool-spawner 2698 Changes the process name, possibly in an attempt to hide itself gmain 2699 Changes the process name, possibly in an attempt to hide itself dconf worker 2700 -
Enumerates kernel/hardware configuration 1 TTPs 44 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
firefoxsnap-confinefirefoxsnap-seccompsnap-seccompdescription ioc process File opened for reading /sys/kernel/security/apparmor/features/query firefox File opened for reading /sys/module/apparmor/parameters/enabled snap-confine File opened for reading /sys/devices/virtual/dma_heap/system/uevent snap-confine File opened for reading /sys/fs/bpf snap-confine File opened for reading /sys/kernel/security/apparmor/features/namespaces firefox File opened for reading /sys/kernel/security/apparmor/features/ptrace firefox File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size firefox File opened for reading /sys/kernel/security/apparmor/features/file firefox File opened for reading /sys/kernel/security/apparmor/features/network firefox File opened for reading /sys/kernel/security/apparmor/features/ptrace firefox File opened for reading /sys/kernel/security/apparmor/features/query firefox File opened for reading /sys/kernel/security/apparmor/features/signal firefox File opened for reading /sys/kernel/security/apparmor/features/policy firefox File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/app.slice/snap.firefox.firefox-a433da8c-758b-4ed6-bc86-5ff8f93808aa.scope snap-confine File opened for reading /sys/kernel/security/apparmor/features/network_v8 firefox File opened for reading /sys/devices/pci0000:00/0000:00:02.0/drm/card1/uevent snap-confine File opened for reading /sys/kernel/security/apparmor/features/caps firefox File opened for reading /sys/kernel/security/apparmor/features/dbus firefox File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size firefox File opened for reading /sys/kernel/security/apparmor/features/caps firefox File opened for reading /sys/kernel/security/apparmor/features/io_uring firefox File opened for reading /sys/kernel/security/apparmor/features/signal firefox File opened for reading /sys/devices/pci0000:00/0000:00:02.0/drm/card1/card1-Virtual-1/uevent snap-confine File opened for reading /sys/kernel/security/apparmor/features/policy firefox File opened for reading /sys/kernel/security/apparmor/features/dbus firefox File opened for reading /sys/kernel/security/apparmor/features/domain firefox File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size snap-seccomp File opened for reading /sys/kernel/security/apparmor/features/mount firefox File opened for reading /sys/kernel/security/apparmor/features/ipc firefox File opened for reading /sys/kernel/security/apparmor/features/mount firefox File opened for reading /sys/kernel/security/apparmor/features firefox File opened for reading /sys/kernel/security/apparmor/features/io_uring firefox File opened for reading /sys/kernel/security/apparmor/features/network_v8 firefox File opened for reading /sys/kernel/security/apparmor/features/rlimit firefox File opened for reading /sys/kernel/security/apparmor/features/file firefox File opened for reading /sys/devices/virtual/mem/full/uevent snap-confine File opened for reading /sys/kernel/security/apparmor/features/rlimit firefox File opened for reading /sys/devices/pci0000:00/0000:00:02.0/drm/renderD128/uevent snap-confine File opened for reading /sys/kernel/security/apparmor/features/domain firefox File opened for reading /sys/kernel/security/apparmor/features/ipc firefox File opened for reading /sys/kernel/security/apparmor/features/namespaces firefox File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size snap-seccomp File opened for reading /sys/kernel/security/apparmor/features firefox File opened for reading /sys/kernel/security/apparmor/features/network firefox -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
grepgrepgrepgrepgrepfirefoxsnap-confinegrepgrepfirefoxsedgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgsettingsgrepgrepgrepgsettingsgrepgrepgrepgrepgrepgrepgrepsedgsettingsgrepgrepgrepsedgrepgrepgrepgrepsedgrepdescription ioc process File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/cmdline firefox File opened for reading /proc/mounts snap-confine File opened for reading /proc/self/mountinfo snap-confine File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/2628/cgroup firefox File opened for reading /proc/filesystems sed File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/mounts firefox File opened for reading /proc/self/mountinfo firefox File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/cgroups firefox File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems gsettings File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems gsettings File opened for reading /proc/sys/kernel/seccomp/actions_avail firefox File opened for reading /proc/self/fd/12 snap-confine File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/2526/attr/apparmor/current snap-confine File opened for reading /proc/self/maps grep File opened for reading /proc/cgroups firefox File opened for reading /proc/cmdline firefox File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems gsettings File opened for reading /proc/self/cgroup snap-confine File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/2526/cgroup firefox File opened for reading /proc/1/ns/mnt snap-confine File opened for reading /proc/self/fd/11 snap-confine File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/sys/kernel/seccomp/actions_avail firefox File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/sys/kernel/random/uuid firefox File opened for reading /proc/filesystems sed File opened for reading /proc/self/maps grep
Processes
-
/usr/bin/xdg-openxdg-open https://2no.co/2e0XG51⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵
- Reads runtime system information
-
/usr/bin/xpropxprop -root2⤵
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
- Reads runtime system information
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
- Reads runtime system information
-
/usr/bin/unameuname2⤵
-
/usr/bin/grepgrep -q "^file://"2⤵
- Reads runtime system information
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
- Reads runtime system information
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/https2⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
-
/usr/bin/xpropxprop -root3⤵
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
- Reads runtime system information
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
- Reads runtime system information
-
/usr/bin/unameuname3⤵
-
/usr/bin/sedsed "s/:/ /g"3⤵
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
-
/usr/bin/headhead -n 13⤵
-
/usr/bin/cutcut -d "=" -f 23⤵
-
/usr/bin/cutcut -d ";" -f 13⤵
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
-
/usr/bin/headhead -n 13⤵
-
/usr/bin/cutcut -d "=" -f 23⤵
-
/usr/bin/cutcut -d ";" -f 13⤵
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
-
/usr/bin/headhead -n 13⤵
-
/usr/bin/cutcut -d "=" -f 23⤵
-
/usr/bin/cutcut -d ";" -f 13⤵
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
-
/usr/bin/headhead -n 13⤵
-
/usr/bin/cutcut -d "=" -f 23⤵
-
/usr/bin/cutcut -d ";" -f 13⤵
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
-
/usr/bin/headhead -n 13⤵
-
/usr/bin/cutcut -d "=" -f 23⤵
-
/usr/bin/cutcut -d ";" -f 13⤵
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
-
/usr/bin/headhead -n 13⤵
-
/usr/bin/cutcut -d "=" -f 23⤵
-
/usr/bin/cutcut -d ";" -f 13⤵
-
/usr/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
-
/usr/bin/grepgrep -l "x-scheme-handler/https;" "/.local/share/applications/*.desktop"3⤵
-
/usr/bin/grepgrep -l "x-scheme-handler/https;" "/usr/local/share//applications/*.desktop"3⤵
- Reads runtime system information
-
/usr/bin/grepgrep -l "x-scheme-handler/https;" /usr/share//applications/apport-gtk.desktop /usr/share//applications/bluetooth-sendto.desktop /usr/share//applications/display-im6.q16.desktop /usr/share//applications/gcr-prompter.desktop /usr/share//applications/gcr-viewer.desktop /usr/share//applications/geoclue-demo-agent.desktop /usr/share//applications/gkbd-keyboard-display.desktop /usr/share//applications/gnome-about-panel.desktop /usr/share//applications/gnome-applications-panel.desktop /usr/share//applications/gnome-background-panel.desktop /usr/share//applications/gnome-bluetooth-panel.desktop /usr/share//applications/gnome-color-panel.desktop /usr/share//applications/gnome-datetime-panel.desktop /usr/share//applications/gnome-disk-image-mounter.desktop /usr/share//applications/gnome-disk-image-writer.desktop /usr/share//applications/gnome-display-panel.desktop /usr/share//applications/gnome-initial-setup.desktop /usr/share//applications/gnome-keyboard-panel.desktop /usr/share//applications/gnome-language-selector.desktop /usr/share//applications/gnome-mouse-panel.desktop /usr/share//applications/gnome-multitasking-panel.desktop /usr/share//applications/gnome-network-panel.desktop /usr/share//applications/gnome-notifications-panel.desktop /usr/share//applications/gnome-online-accounts-panel.desktop /usr/share//applications/gnome-power-panel.desktop /usr/share//applications/gnome-printers-panel.desktop /usr/share//applications/gnome-privacy-panel.desktop /usr/share//applications/gnome-region-panel.desktop /usr/share//applications/gnome-search-panel.desktop /usr/share//applications/gnome-session-properties.desktop /usr/share//applications/gnome-sharing-panel.desktop /usr/share//applications/gnome-sound-panel.desktop /usr/share//applications/gnome-system-monitor-kde.desktop /usr/share//applications/gnome-system-panel.desktop /usr/share//applications/gnome-ubuntu-panel.desktop /usr/share//applications/gnome-universal-access-panel.desktop /usr/share//applications/gnome-users-panel.desktop /usr/share//applications/gnome-wacom-panel.desktop /usr/share//applications/gnome-wifi-panel.desktop /usr/share//applications/gnome-wwan-panel.desktop /usr/share//applications/hplj1020.desktop /usr/share//applications/ibus-setup-table.desktop /usr/share//applications/im-config.desktop /usr/share//applications/io.snapcraft.SessionAgent.desktop /usr/share//applications/libreoffice-calc.desktop /usr/share//applications/libreoffice-draw.desktop /usr/share//applications/libreoffice-impress.desktop /usr/share//applications/libreoffice-math.desktop /usr/share//applications/libreoffice-startcenter.desktop /usr/share//applications/libreoffice-writer.desktop /usr/share//applications/libreoffice-xsltfilter.desktop /usr/share//applications/nautilus-autorun-software.desktop /usr/share//applications/nm-applet.desktop /usr/share//applications/nm-connection-editor.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Emojier.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Extension.Gtk3.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Wayland.Gtk3.desktop /usr/share//applications/org.freedesktop.IBus.Setup.desktop /usr/share//applications/org.freedesktop.Xwayland.desktop /usr/share//applications/org.gnome.Calculator.desktop /usr/share//applications/org.gnome.Calendar.desktop /usr/share//applications/org.gnome.Characters.desktop /usr/share//applications/org.gnome.DejaDup.desktop /usr/share//applications/org.gnome.DiskUtility.desktop /usr/share//applications/org.gnome.Evince-previewer.desktop /usr/share//applications/org.gnome.Evince.desktop /usr/share//applications/org.gnome.Evolution-alarm-notify.desktop /usr/share//applications/org.gnome.FileRoller.desktop /usr/share//applications/org.gnome.Logs.desktop /usr/share//applications/org.gnome.Nautilus.desktop /usr/share//applications/org.gnome.OnlineAccounts.OAuth2.desktop /usr/share//applications/org.gnome.PowerStats.desktop /usr/share//applications/org.gnome.RemoteDesktop.Handover.desktop /usr/share//applications/org.gnome.Rhythmbox3.desktop /usr/share//applications/org.gnome.Rhythmbox3.device.desktop /usr/share//applications/org.gnome.Settings.desktop /usr/share//applications/org.gnome.Shell.Extensions.desktop /usr/share//applications/org.gnome.Shell.PortalHelper.desktop /usr/share//applications/org.gnome.Shell.desktop /usr/share//applications/org.gnome.Shotwell-Viewer.desktop /usr/share//applications/org.gnome.Shotwell.Auth.desktop /usr/share//applications/org.gnome.Shotwell.desktop /usr/share//applications/org.gnome.Snapshot.desktop /usr/share//applications/org.gnome.SystemMonitor.desktop /usr/share//applications/org.gnome.Tecla.desktop /usr/share//applications/org.gnome.Terminal.Preferences.desktop /usr/share//applications/org.gnome.Terminal.desktop /usr/share//applications/org.gnome.TextEditor.desktop /usr/share//applications/org.gnome.Totem.desktop /usr/share//applications/org.gnome.Zenity.desktop /usr/share//applications/org.gnome.baobab.desktop /usr/share//applications/org.gnome.clocks.desktop /usr/share//applications/org.gnome.eog.desktop /usr/share//applications/org.gnome.evolution-data-server.OAuth2-handler.desktop /usr/share//applications/org.gnome.font-viewer.desktop /usr/share//applications/org.gnome.seahorse.Application.desktop /usr/share//applications/org.remmina.Remmina-file.desktop /usr/share//applications/org.remmina.Remmina.desktop /usr/share//applications/python3.12.desktop /usr/share//applications/remmina-gnome.desktop /usr/share//applications/rygel.desktop /usr/share//applications/simple-scan.desktop /usr/share//applications/snap-handle-link.desktop /usr/share//applications/software-properties-drivers.desktop /usr/share//applications/software-properties-gtk.desktop /usr/share//applications/software-properties-livepatch.desktop /usr/share//applications/thunderbird.desktop /usr/share//applications/transmission-gtk.desktop /usr/share//applications/update-manager.desktop /usr/share//applications/usb-creator-gtk.desktop /usr/share//applications/xdg-desktop-portal-gnome.desktop /usr/share//applications/xdg-desktop-portal-gtk.desktop /usr/share//applications/yelp.desktop3⤵
- Reads runtime system information
-
/usr/bin/grepgrep -q "%s"2⤵
-
/usr/bin/x-www-browserx-www-browser https://2no.co/2e0XG52⤵
-
/usr/bin/xdg-settingsxdg-settings get default-web-browser3⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager4⤵
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE4⤵
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"4⤵
-
/usr/bin/xpropxprop -root4⤵
-
/usr/bin/grepgrep -i "^xfce_desktop_window"4⤵
- Reads runtime system information
-
/usr/bin/grepgrep -q "^Enlightenment"4⤵
- Reads runtime system information
-
/usr/bin/unameuname4⤵
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/http4⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager5⤵
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE5⤵
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"5⤵
- Reads runtime system information
-
/usr/bin/xpropxprop -root5⤵
-
/usr/bin/grepgrep -i "^xfce_desktop_window"5⤵
- Reads runtime system information
-
/usr/bin/grepgrep -q "^Enlightenment"5⤵
- Reads runtime system information
-
/usr/bin/unameuname5⤵
-
/usr/bin/sedsed "s/:/ /g"5⤵
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache5⤵
-
/usr/bin/headhead -n 15⤵
-
/usr/bin/cutcut -d "=" -f 25⤵
-
/usr/bin/cutcut -d ";" -f 15⤵
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache5⤵
- Reads runtime system information
-
/usr/bin/headhead -n 15⤵
-
/usr/bin/cutcut -d "=" -f 25⤵
-
/usr/bin/cutcut -d ";" -f 15⤵
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache5⤵
- Reads runtime system information
-
/usr/bin/headhead -n 15⤵
-
/usr/bin/cutcut -d "=" -f 25⤵
-
/usr/bin/cutcut -d ";" -f 15⤵
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache5⤵
-
/usr/bin/headhead -n 15⤵
-
/usr/bin/cutcut -d "=" -f 25⤵
-
/usr/bin/cutcut -d ";" -f 15⤵
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache5⤵
- Reads runtime system information
-
/usr/bin/headhead -n 15⤵
-
/usr/bin/cutcut -d "=" -f 25⤵
-
/usr/bin/cutcut -d ";" -f 15⤵
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache5⤵
- Reads runtime system information
-
/usr/bin/headhead -n 15⤵
-
/usr/bin/cutcut -d "=" -f 25⤵
-
/usr/bin/cutcut -d ";" -f 15⤵
-
/usr/bin/sedsed "s/:/ /g"5⤵
- Reads runtime system information
-
/usr/bin/grepgrep -l "x-scheme-handler/http;" "/.local/share/applications/*.desktop"5⤵
- Reads runtime system information
-
/usr/bin/grepgrep -l "x-scheme-handler/http;" "/usr/local/share//applications/*.desktop"5⤵
- Reads runtime system information
-
/usr/bin/grepgrep -l "x-scheme-handler/http;" /usr/share//applications/apport-gtk.desktop /usr/share//applications/bluetooth-sendto.desktop /usr/share//applications/display-im6.q16.desktop /usr/share//applications/gcr-prompter.desktop /usr/share//applications/gcr-viewer.desktop /usr/share//applications/geoclue-demo-agent.desktop /usr/share//applications/gkbd-keyboard-display.desktop /usr/share//applications/gnome-about-panel.desktop /usr/share//applications/gnome-applications-panel.desktop /usr/share//applications/gnome-background-panel.desktop /usr/share//applications/gnome-bluetooth-panel.desktop /usr/share//applications/gnome-color-panel.desktop /usr/share//applications/gnome-datetime-panel.desktop /usr/share//applications/gnome-disk-image-mounter.desktop /usr/share//applications/gnome-disk-image-writer.desktop /usr/share//applications/gnome-display-panel.desktop /usr/share//applications/gnome-initial-setup.desktop /usr/share//applications/gnome-keyboard-panel.desktop /usr/share//applications/gnome-language-selector.desktop /usr/share//applications/gnome-mouse-panel.desktop /usr/share//applications/gnome-multitasking-panel.desktop /usr/share//applications/gnome-network-panel.desktop /usr/share//applications/gnome-notifications-panel.desktop /usr/share//applications/gnome-online-accounts-panel.desktop /usr/share//applications/gnome-power-panel.desktop /usr/share//applications/gnome-printers-panel.desktop /usr/share//applications/gnome-privacy-panel.desktop /usr/share//applications/gnome-region-panel.desktop /usr/share//applications/gnome-search-panel.desktop /usr/share//applications/gnome-session-properties.desktop /usr/share//applications/gnome-sharing-panel.desktop /usr/share//applications/gnome-sound-panel.desktop /usr/share//applications/gnome-system-monitor-kde.desktop /usr/share//applications/gnome-system-panel.desktop /usr/share//applications/gnome-ubuntu-panel.desktop /usr/share//applications/gnome-universal-access-panel.desktop /usr/share//applications/gnome-users-panel.desktop /usr/share//applications/gnome-wacom-panel.desktop /usr/share//applications/gnome-wifi-panel.desktop /usr/share//applications/gnome-wwan-panel.desktop /usr/share//applications/hplj1020.desktop /usr/share//applications/ibus-setup-table.desktop /usr/share//applications/im-config.desktop /usr/share//applications/io.snapcraft.SessionAgent.desktop /usr/share//applications/libreoffice-calc.desktop /usr/share//applications/libreoffice-draw.desktop /usr/share//applications/libreoffice-impress.desktop /usr/share//applications/libreoffice-math.desktop /usr/share//applications/libreoffice-startcenter.desktop /usr/share//applications/libreoffice-writer.desktop /usr/share//applications/libreoffice-xsltfilter.desktop /usr/share//applications/nautilus-autorun-software.desktop /usr/share//applications/nm-applet.desktop /usr/share//applications/nm-connection-editor.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Emojier.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Extension.Gtk3.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Wayland.Gtk3.desktop /usr/share//applications/org.freedesktop.IBus.Setup.desktop /usr/share//applications/org.freedesktop.Xwayland.desktop /usr/share//applications/org.gnome.Calculator.desktop /usr/share//applications/org.gnome.Calendar.desktop /usr/share//applications/org.gnome.Characters.desktop /usr/share//applications/org.gnome.DejaDup.desktop /usr/share//applications/org.gnome.DiskUtility.desktop /usr/share//applications/org.gnome.Evince-previewer.desktop /usr/share//applications/org.gnome.Evince.desktop /usr/share//applications/org.gnome.Evolution-alarm-notify.desktop /usr/share//applications/org.gnome.FileRoller.desktop /usr/share//applications/org.gnome.Logs.desktop /usr/share//applications/org.gnome.Nautilus.desktop /usr/share//applications/org.gnome.OnlineAccounts.OAuth2.desktop /usr/share//applications/org.gnome.PowerStats.desktop /usr/share//applications/org.gnome.RemoteDesktop.Handover.desktop /usr/share//applications/org.gnome.Rhythmbox3.desktop /usr/share//applications/org.gnome.Rhythmbox3.device.desktop /usr/share//applications/org.gnome.Settings.desktop /usr/share//applications/org.gnome.Shell.Extensions.desktop /usr/share//applications/org.gnome.Shell.PortalHelper.desktop /usr/share//applications/org.gnome.Shell.desktop /usr/share//applications/org.gnome.Shotwell-Viewer.desktop /usr/share//applications/org.gnome.Shotwell.Auth.desktop /usr/share//applications/org.gnome.Shotwell.desktop /usr/share//applications/org.gnome.Snapshot.desktop /usr/share//applications/org.gnome.SystemMonitor.desktop /usr/share//applications/org.gnome.Tecla.desktop /usr/share//applications/org.gnome.Terminal.Preferences.desktop /usr/share//applications/org.gnome.Terminal.desktop /usr/share//applications/org.gnome.TextEditor.desktop /usr/share//applications/org.gnome.Totem.desktop /usr/share//applications/org.gnome.Zenity.desktop /usr/share//applications/org.gnome.baobab.desktop /usr/share//applications/org.gnome.clocks.desktop /usr/share//applications/org.gnome.eog.desktop /usr/share//applications/org.gnome.evolution-data-server.OAuth2-handler.desktop /usr/share//applications/org.gnome.font-viewer.desktop /usr/share//applications/org.gnome.seahorse.Application.desktop /usr/share//applications/org.remmina.Remmina-file.desktop /usr/share//applications/org.remmina.Remmina.desktop /usr/share//applications/python3.12.desktop /usr/share//applications/remmina-gnome.desktop /usr/share//applications/rygel.desktop /usr/share//applications/simple-scan.desktop /usr/share//applications/snap-handle-link.desktop /usr/share//applications/software-properties-drivers.desktop /usr/share//applications/software-properties-gtk.desktop /usr/share//applications/software-properties-livepatch.desktop /usr/share//applications/thunderbird.desktop /usr/share//applications/transmission-gtk.desktop /usr/share//applications/update-manager.desktop /usr/share//applications/usb-creator-gtk.desktop /usr/share//applications/xdg-desktop-portal-gnome.desktop /usr/share//applications/xdg-desktop-portal-gtk.desktop /usr/share//applications/yelp.desktop5⤵
-
/usr/bin/gsettingsgsettings get org.gnome.shell favorite-apps3⤵
- Reads runtime system information
-
/usr/bin/grepgrep -q "'firefox.desktop'"3⤵
- Reads runtime system information
-
/usr/bin/gsettingsgsettings get com.canonical.Unity.Launcher favorites3⤵
-
/usr/bin/grepgrep -q "'application://firefox.desktop'"3⤵
- Reads runtime system information
-
/usr/bin/gsettingsgsettings get org.mate.panel object-id-list3⤵
- Reads runtime system information
-
/usr/bin/whichwhich qdbus3⤵
-
/snap/bin/firefox/snap/bin/firefox https://2no.co/2e0XG52⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/lib/snapd/snap-seccomp/usr/lib/snapd/snap-seccomp version-info3⤵
- Enumerates kernel/hardware configuration
-
/usr/lib/snapd/snap-confine/usr/lib/snapd/snap-confine --base core22 snap.firefox.firefox /usr/lib/snapd/snap-exec firefox https://2no.co/2e0XG52⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/grepgrep -q "%s"2⤵
- Reads runtime system information
-
/usr/bin/firefoxfirefox https://2no.co/2e0XG52⤵
-
/usr/bin/xdg-settingsxdg-settings get default-web-browser3⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager4⤵
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE4⤵
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"4⤵
- Reads runtime system information
-
/usr/bin/xpropxprop -root4⤵
-
/usr/bin/grepgrep -i "^xfce_desktop_window"4⤵
- Reads runtime system information
-
/usr/bin/grepgrep -q "^Enlightenment"4⤵
-
/usr/bin/unameuname4⤵
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/http4⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager5⤵
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE5⤵
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"5⤵
- Reads runtime system information
-
/usr/bin/xpropxprop -root5⤵
-
/usr/bin/grepgrep -i "^xfce_desktop_window"5⤵
-
/usr/bin/grepgrep -q "^Enlightenment"5⤵
- Reads runtime system information
-
/usr/bin/unameuname5⤵
-
/usr/bin/sedsed "s/:/ /g"5⤵
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache5⤵
- Reads runtime system information
-
/usr/bin/headhead -n 15⤵
-
/usr/bin/cutcut -d "=" -f 25⤵
-
/usr/bin/cutcut -d ";" -f 15⤵
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache5⤵
-
/usr/bin/headhead -n 15⤵
-
/usr/bin/cutcut -d "=" -f 25⤵
-
/usr/bin/cutcut -d ";" -f 15⤵
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache5⤵
- Reads runtime system information
-
/usr/bin/headhead -n 15⤵
-
/usr/bin/cutcut -d "=" -f 25⤵
-
/usr/bin/cutcut -d ";" -f 15⤵
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache5⤵
- Reads runtime system information
-
/usr/bin/headhead -n 15⤵
-
/usr/bin/cutcut -d "=" -f 25⤵
-
/usr/bin/cutcut -d ";" -f 15⤵
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache5⤵
-
/usr/bin/headhead -n 15⤵
-
/usr/bin/cutcut -d "=" -f 25⤵
-
/usr/bin/cutcut -d ";" -f 15⤵
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache5⤵
- Reads runtime system information
-
/usr/bin/headhead -n 15⤵
-
/usr/bin/cutcut -d ";" -f 15⤵
-
/usr/bin/cutcut -d "=" -f 25⤵
-
/usr/bin/sedsed "s/:/ /g"5⤵
- Reads runtime system information
-
/usr/bin/grepgrep -l "x-scheme-handler/http;" "/.local/share/applications/*.desktop"5⤵
-
/usr/bin/grepgrep -l "x-scheme-handler/http;" "/usr/local/share//applications/*.desktop"5⤵
- Reads runtime system information
-
/usr/bin/grepgrep -l "x-scheme-handler/http;" /usr/share//applications/apport-gtk.desktop /usr/share//applications/bluetooth-sendto.desktop /usr/share//applications/display-im6.q16.desktop /usr/share//applications/gcr-prompter.desktop /usr/share//applications/gcr-viewer.desktop /usr/share//applications/geoclue-demo-agent.desktop /usr/share//applications/gkbd-keyboard-display.desktop /usr/share//applications/gnome-about-panel.desktop /usr/share//applications/gnome-applications-panel.desktop /usr/share//applications/gnome-background-panel.desktop /usr/share//applications/gnome-bluetooth-panel.desktop /usr/share//applications/gnome-color-panel.desktop /usr/share//applications/gnome-datetime-panel.desktop /usr/share//applications/gnome-disk-image-mounter.desktop /usr/share//applications/gnome-disk-image-writer.desktop /usr/share//applications/gnome-display-panel.desktop /usr/share//applications/gnome-initial-setup.desktop /usr/share//applications/gnome-keyboard-panel.desktop /usr/share//applications/gnome-language-selector.desktop /usr/share//applications/gnome-mouse-panel.desktop /usr/share//applications/gnome-multitasking-panel.desktop /usr/share//applications/gnome-network-panel.desktop /usr/share//applications/gnome-notifications-panel.desktop /usr/share//applications/gnome-online-accounts-panel.desktop /usr/share//applications/gnome-power-panel.desktop /usr/share//applications/gnome-printers-panel.desktop /usr/share//applications/gnome-privacy-panel.desktop /usr/share//applications/gnome-region-panel.desktop /usr/share//applications/gnome-search-panel.desktop /usr/share//applications/gnome-session-properties.desktop /usr/share//applications/gnome-sharing-panel.desktop /usr/share//applications/gnome-sound-panel.desktop /usr/share//applications/gnome-system-monitor-kde.desktop /usr/share//applications/gnome-system-panel.desktop /usr/share//applications/gnome-ubuntu-panel.desktop /usr/share//applications/gnome-universal-access-panel.desktop /usr/share//applications/gnome-users-panel.desktop /usr/share//applications/gnome-wacom-panel.desktop /usr/share//applications/gnome-wifi-panel.desktop /usr/share//applications/gnome-wwan-panel.desktop /usr/share//applications/hplj1020.desktop /usr/share//applications/ibus-setup-table.desktop /usr/share//applications/im-config.desktop /usr/share//applications/io.snapcraft.SessionAgent.desktop /usr/share//applications/libreoffice-calc.desktop /usr/share//applications/libreoffice-draw.desktop /usr/share//applications/libreoffice-impress.desktop /usr/share//applications/libreoffice-math.desktop /usr/share//applications/libreoffice-startcenter.desktop /usr/share//applications/libreoffice-writer.desktop /usr/share//applications/libreoffice-xsltfilter.desktop /usr/share//applications/nautilus-autorun-software.desktop /usr/share//applications/nm-applet.desktop /usr/share//applications/nm-connection-editor.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Emojier.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Extension.Gtk3.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Wayland.Gtk3.desktop /usr/share//applications/org.freedesktop.IBus.Setup.desktop /usr/share//applications/org.freedesktop.Xwayland.desktop /usr/share//applications/org.gnome.Calculator.desktop /usr/share//applications/org.gnome.Calendar.desktop /usr/share//applications/org.gnome.Characters.desktop /usr/share//applications/org.gnome.DejaDup.desktop /usr/share//applications/org.gnome.DiskUtility.desktop /usr/share//applications/org.gnome.Evince-previewer.desktop /usr/share//applications/org.gnome.Evince.desktop /usr/share//applications/org.gnome.Evolution-alarm-notify.desktop /usr/share//applications/org.gnome.FileRoller.desktop /usr/share//applications/org.gnome.Logs.desktop /usr/share//applications/org.gnome.Nautilus.desktop /usr/share//applications/org.gnome.OnlineAccounts.OAuth2.desktop /usr/share//applications/org.gnome.PowerStats.desktop /usr/share//applications/org.gnome.RemoteDesktop.Handover.desktop /usr/share//applications/org.gnome.Rhythmbox3.desktop /usr/share//applications/org.gnome.Rhythmbox3.device.desktop /usr/share//applications/org.gnome.Settings.desktop /usr/share//applications/org.gnome.Shell.Extensions.desktop /usr/share//applications/org.gnome.Shell.PortalHelper.desktop /usr/share//applications/org.gnome.Shell.desktop /usr/share//applications/org.gnome.Shotwell-Viewer.desktop /usr/share//applications/org.gnome.Shotwell.Auth.desktop /usr/share//applications/org.gnome.Shotwell.desktop /usr/share//applications/org.gnome.Snapshot.desktop /usr/share//applications/org.gnome.SystemMonitor.desktop /usr/share//applications/org.gnome.Tecla.desktop /usr/share//applications/org.gnome.Terminal.Preferences.desktop /usr/share//applications/org.gnome.Terminal.desktop /usr/share//applications/org.gnome.TextEditor.desktop /usr/share//applications/org.gnome.Totem.desktop /usr/share//applications/org.gnome.Zenity.desktop /usr/share//applications/org.gnome.baobab.desktop /usr/share//applications/org.gnome.clocks.desktop /usr/share//applications/org.gnome.eog.desktop /usr/share//applications/org.gnome.evolution-data-server.OAuth2-handler.desktop /usr/share//applications/org.gnome.font-viewer.desktop /usr/share//applications/org.gnome.seahorse.Application.desktop /usr/share//applications/org.remmina.Remmina-file.desktop /usr/share//applications/org.remmina.Remmina.desktop /usr/share//applications/python3.12.desktop /usr/share//applications/remmina-gnome.desktop /usr/share//applications/rygel.desktop /usr/share//applications/simple-scan.desktop /usr/share//applications/snap-handle-link.desktop /usr/share//applications/software-properties-drivers.desktop /usr/share//applications/software-properties-gtk.desktop /usr/share//applications/software-properties-livepatch.desktop /usr/share//applications/thunderbird.desktop /usr/share//applications/transmission-gtk.desktop /usr/share//applications/update-manager.desktop /usr/share//applications/usb-creator-gtk.desktop /usr/share//applications/xdg-desktop-portal-gnome.desktop /usr/share//applications/xdg-desktop-portal-gtk.desktop /usr/share//applications/yelp.desktop5⤵
- Reads runtime system information
-
/usr/bin/gsettingsgsettings get org.gnome.shell favorite-apps3⤵
-
/usr/bin/grepgrep -q "'firefox.desktop'"3⤵
- Reads runtime system information
-
/usr/bin/gsettingsgsettings get com.canonical.Unity.Launcher favorites3⤵
- Reads runtime system information
-
/usr/bin/grepgrep -q "'application://firefox.desktop'"3⤵
- Reads runtime system information
-
/usr/bin/gsettingsgsettings get org.mate.panel object-id-list3⤵
-
/usr/bin/whichwhich qdbus3⤵
-
/snap/bin/firefox/snap/bin/firefox https://2no.co/2e0XG52⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/lib/snapd/snap-seccomp/usr/lib/snapd/snap-seccomp version-info3⤵
- Enumerates kernel/hardware configuration
-
/usr/lib/snapd/snap-confine/usr/lib/snapd/snap-confine --base core22 snap.firefox.firefox /usr/lib/snapd/snap-exec firefox https://2no.co/2e0XG52⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
/run/snapd/ns/snap.firefox.fstabFilesize
40B
MD565408163d77c5bbcc5b17dc2e313c93e
SHA1b8891c89ce55f6c1bbe476fd4912a7af296ce79a
SHA256d86e32b299b19c1c03a025d8d5ed026cdf923fc9a1015439cde134b3d13d1fff
SHA512394e2394e44e38210817f5f02779f7b8253c3ff1b4aa816bce7a0b95e40f47094d01cb43ec5e7ec593404f5ddf6fc49bb4175eece231a3cee7c5295e0d9349a7