Analysis
-
max time kernel
4s -
max time network
3s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
28-08-2024 21:17
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://h
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
http://h
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
http://h
Malware Config
Signatures
-
Changes its process name 3 IoCs
description ioc pid Changes the process name, possibly in an attempt to hide itself pool-spawner 2969 Changes the process name, possibly in an attempt to hide itself gmain 2970 Changes the process name, possibly in an attempt to hide itself dconf worker 2971 -
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size snap-confine File opened for reading /sys/fs/cgroup/system.slice/anacron.service snap-confine File opened for reading /sys/fs/cgroup/system.slice/system-serial\x2dgetty.slice/[email protected] snap-confine File opened for reading /sys/kernel/security/apparmor/features/ipc firefox File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/app.slice/xdg-desktop-portal-gtk.service snap-confine File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/session.slice/org.gnome.SettingsDaemon.Keyboard.service snap-confine File opened for reading /sys/kernel/security/apparmor/features/namespaces firefox File opened for reading /sys/fs/cgroup/sys-kernel-tracing.mount snap-confine File opened for reading /sys/fs/cgroup/system.slice/ModemManager.service snap-confine File opened for reading /sys/fs/cgroup/system.slice/systemd-resolved.service snap-confine File opened for reading /sys/fs/cgroup/system.slice/upower.service snap-confine File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/app.slice/app-gnome-xdg\x2duser\x2ddirs-1316.scope snap-confine File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/app.slice/gpg-agent-ssh.socket snap-confine File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/session.slice snap-confine File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/session.slice/org.gnome.SettingsDaemon.Sound.service snap-confine File opened for reading /sys/devices/pci0000:00/0000:00:02.0/drm/card1/card1-Virtual-1/uevent snap-confine File opened for reading /sys/fs/cgroup/system.slice/snap-firefox-4259.mount snap-confine File opened for reading /sys/fs/cgroup/system.slice/system-modprobe.slice snap-confine File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/session.slice/org.gnome.SettingsDaemon.Smartcard.service snap-confine File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/app.slice/app-gnome\x2dsession\x2dmanager.slice/[email protected] snap-confine File opened for reading /sys/module/apparmor/parameters/enabled dbus-daemon File opened for reading /sys/kernel/security/apparmor/features/mount firefox File opened for reading /sys/fs/bpf snap-confine File opened for reading /sys/fs/cgroup/proc-sys-fs-binfmt_misc.mount snap-confine File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/session.slice/at-spi-dbus-bus.service snap-confine File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/session.slice/gvfs-mtp-volume-monitor.service snap-confine File opened for reading /sys/fs/cgroup/sys-kernel-config.mount snap-confine File opened for reading /sys/fs/cgroup/system.slice/snap-core22-1380.mount snap-confine File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/app.slice/dconf.service snap-confine File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/session.slice/gvfs-daemon.service snap-confine File opened for reading /sys/kernel/security/apparmor/features/domain firefox File opened for reading /sys/fs/cgroup/sys-fs-fuse-connections.mount snap-confine File opened for reading /sys/fs/cgroup/system.slice/systemd-networkd.service snap-confine File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size snap-seccomp File opened for reading /sys/devices/virtual/mem/full/uevent snap-confine File opened for reading /sys/fs/cgroup/system.slice/colord.service snap-confine File opened for reading /sys/fs/cgroup/system.slice/systemd-timedated.service snap-confine File opened for reading /sys/fs/cgroup/system.slice/systemd-udevd.service/udev snap-confine File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/app.slice/evolution-addressbook-factory.service snap-confine File opened for reading /sys/kernel/security/apparmor/features/caps firefox File opened for reading /sys/fs/cgroup/system.slice snap-confine File opened for reading /sys/fs/cgroup/system.slice/snap-thunderbird-470.mount snap-confine File opened for reading /sys/fs/cgroup/system.slice/systemd-logind.service snap-confine File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/session.slice/gvfs-metadata.service snap-confine File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/session.slice/org.gnome.SettingsDaemon.Datetime.service snap-confine File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size snapctl File opened for reading /sys/fs/cgroup/system.slice/systemd-oomd.service snap-confine File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/app.slice/gcr-ssh-agent.service snap-confine File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/session.slice/org.gnome.SettingsDaemon.XSettings.service snap-confine File opened for reading /sys/fs/cgroup snap-confine File opened for reading /sys/fs/cgroup/system.slice/system-serial\x2dgetty.slice snap-confine File opened for reading /sys/fs/cgroup/system.slice/system-systemd\x2dfsck.slice snap-confine File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/init.scope snap-confine File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size snapctl File opened for reading /sys/kernel/security/apparmor/features/signal firefox File opened for reading /sys/fs/cgroup/system.slice/snap-bare-5.mount snap-confine File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/session.slice/dbus.service snap-confine File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/session.slice/gvfs-gphoto2-volume-monitor.service snap-confine File opened for reading /sys/kernel/security/apparmor/features/network firefox File opened for reading /sys/kernel/security/apparmor/features/policy firefox File opened for reading /sys/module/apparmor/parameters/enabled snap-confine File opened for reading /sys/devices/virtual/dma_heap/system/uevent snap-confine File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/app.slice/app-gnome\x2dsession\x2dmanager.slice snap-confine File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/app.slice/gnome-session-monitor.service snap-confine -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/cmdline snap-exec File opened for reading /proc/self/fd dbus-send File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems gsettings File opened for reading /proc/cgroups firefox File opened for reading /proc/self/stat firefox File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/fd dbus-send File opened for reading /proc/filesystems gsettings File opened for reading /proc/filesystems gsettings File opened for reading /proc/2833/attr/apparmor/current dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/fd dbus-send File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/mounts snap-confine File opened for reading /proc/self/fd/12 snap-confine File opened for reading /proc/filesystems mkdir File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/2905/cgroup firefox File opened for reading /proc/self/fd/13 snap-confine File opened for reading /proc/cmdline snap-confine File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems sed File opened for reading /proc/2917/cmdline dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/ns/mnt snap-confine File opened for reading /proc/self/maps grep File opened for reading /proc/2905/attr/apparmor/current snap-confine File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/1/ns/mnt snap-confine File opened for reading /proc/self/fd dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/cmdline firefox File opened for reading /proc/self/fd dbus-launch File opened for reading /proc/2833/status dbus-daemon File opened for reading /proc/filesystems sed File opened for reading /proc/2849/cmdline dbus-daemon File opened for reading /proc/sys/kernel/seccomp/actions_avail firefox File opened for reading /proc/2992/cgroup snap-confine File opened for reading /proc/filesystems firefox File opened for reading /proc/self/maps grep File opened for reading /proc/self/cgroup snap-confine File opened for reading /proc/2828/cmdline dbus-daemon File opened for reading /proc/self/fd dbus-send File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep
Processes
-
/usr/bin/xdg-openxdg-open http://h1⤵PID:2826
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
- Reads runtime system information
PID:2828 -
/usr/bin/dbus-launchdbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr3⤵
- Reads runtime system information
PID:2829 -
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2831
-
-
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:2834
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵
- Reads runtime system information
PID:2835
-
-
/usr/bin/xpropxprop -root2⤵PID:2836
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
- Reads runtime system information
PID:2837
-
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
- Reads runtime system information
PID:2839
-
-
/usr/bin/unameuname2⤵PID:2840
-
-
/usr/bin/grepgrep -q "^file://"2⤵
- Reads runtime system information
PID:2842
-
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2844
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2844
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2844
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2844
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
- Reads runtime system information
PID:2844
-
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
PID:2847
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/http2⤵PID:2848
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
- Reads runtime system information
PID:2849 -
/usr/bin/dbus-launchdbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr4⤵PID:2850
-
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:2851
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
- Reads runtime system information
PID:2852
-
-
/usr/bin/xpropxprop -root3⤵PID:2853
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
- Reads runtime system information
PID:2854
-
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
- Reads runtime system information
PID:2856
-
-
/usr/bin/unameuname3⤵PID:2857
-
-
/usr/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
PID:2860
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2862
-
-
/usr/bin/headhead -n 13⤵PID:2863
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2864
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2865
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵PID:2867
-
-
/usr/bin/headhead -n 13⤵PID:2868
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2869
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2870
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2872
-
-
/usr/bin/headhead -n 13⤵PID:2873
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2874
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2875
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵PID:2877
-
-
/usr/bin/headhead -n 13⤵PID:2878
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2879
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2880
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵PID:2883
-
-
/usr/bin/headhead -n 13⤵PID:2884
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2885
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2886
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵PID:2890
-
-
/usr/bin/headhead -n 13⤵PID:2891
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2892
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2893
-
-
/usr/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
PID:2896
-
-
/usr/bin/grepgrep -l "x-scheme-handler/http;" "/.local/share/applications/*.desktop"3⤵PID:2898
-
-
/usr/bin/grepgrep -l "x-scheme-handler/http;" "/usr/local/share//applications/*.desktop"3⤵
- Reads runtime system information
PID:2900
-
-
/usr/bin/grepgrep -l "x-scheme-handler/http;" /usr/share//applications/apport-gtk.desktop /usr/share//applications/bluetooth-sendto.desktop /usr/share//applications/display-im6.q16.desktop /usr/share//applications/gcr-prompter.desktop /usr/share//applications/gcr-viewer.desktop /usr/share//applications/geoclue-demo-agent.desktop /usr/share//applications/gkbd-keyboard-display.desktop /usr/share//applications/gnome-about-panel.desktop /usr/share//applications/gnome-applications-panel.desktop /usr/share//applications/gnome-background-panel.desktop /usr/share//applications/gnome-bluetooth-panel.desktop /usr/share//applications/gnome-color-panel.desktop /usr/share//applications/gnome-datetime-panel.desktop /usr/share//applications/gnome-disk-image-mounter.desktop /usr/share//applications/gnome-disk-image-writer.desktop /usr/share//applications/gnome-display-panel.desktop /usr/share//applications/gnome-initial-setup.desktop /usr/share//applications/gnome-keyboard-panel.desktop /usr/share//applications/gnome-language-selector.desktop /usr/share//applications/gnome-mouse-panel.desktop /usr/share//applications/gnome-multitasking-panel.desktop /usr/share//applications/gnome-network-panel.desktop /usr/share//applications/gnome-notifications-panel.desktop /usr/share//applications/gnome-online-accounts-panel.desktop /usr/share//applications/gnome-power-panel.desktop /usr/share//applications/gnome-printers-panel.desktop /usr/share//applications/gnome-privacy-panel.desktop /usr/share//applications/gnome-region-panel.desktop /usr/share//applications/gnome-search-panel.desktop /usr/share//applications/gnome-session-properties.desktop /usr/share//applications/gnome-sharing-panel.desktop /usr/share//applications/gnome-sound-panel.desktop /usr/share//applications/gnome-system-monitor-kde.desktop /usr/share//applications/gnome-system-panel.desktop /usr/share//applications/gnome-ubuntu-panel.desktop /usr/share//applications/gnome-universal-access-panel.desktop /usr/share//applications/gnome-users-panel.desktop /usr/share//applications/gnome-wacom-panel.desktop /usr/share//applications/gnome-wifi-panel.desktop /usr/share//applications/gnome-wwan-panel.desktop /usr/share//applications/hplj1020.desktop /usr/share//applications/ibus-setup-table.desktop /usr/share//applications/im-config.desktop /usr/share//applications/io.snapcraft.SessionAgent.desktop /usr/share//applications/libreoffice-calc.desktop /usr/share//applications/libreoffice-draw.desktop /usr/share//applications/libreoffice-impress.desktop /usr/share//applications/libreoffice-math.desktop /usr/share//applications/libreoffice-startcenter.desktop /usr/share//applications/libreoffice-writer.desktop /usr/share//applications/libreoffice-xsltfilter.desktop /usr/share//applications/nautilus-autorun-software.desktop /usr/share//applications/nm-applet.desktop /usr/share//applications/nm-connection-editor.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Emojier.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Extension.Gtk3.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Wayland.Gtk3.desktop /usr/share//applications/org.freedesktop.IBus.Setup.desktop /usr/share//applications/org.freedesktop.Xwayland.desktop /usr/share//applications/org.gnome.Calculator.desktop /usr/share//applications/org.gnome.Calendar.desktop /usr/share//applications/org.gnome.Characters.desktop /usr/share//applications/org.gnome.DejaDup.desktop /usr/share//applications/org.gnome.DiskUtility.desktop /usr/share//applications/org.gnome.Evince-previewer.desktop /usr/share//applications/org.gnome.Evince.desktop /usr/share//applications/org.gnome.Evolution-alarm-notify.desktop /usr/share//applications/org.gnome.FileRoller.desktop /usr/share//applications/org.gnome.Logs.desktop /usr/share//applications/org.gnome.Nautilus.desktop /usr/share//applications/org.gnome.OnlineAccounts.OAuth2.desktop /usr/share//applications/org.gnome.PowerStats.desktop /usr/share//applications/org.gnome.RemoteDesktop.Handover.desktop /usr/share//applications/org.gnome.Rhythmbox3.desktop /usr/share//applications/org.gnome.Rhythmbox3.device.desktop /usr/share//applications/org.gnome.Settings.desktop /usr/share//applications/org.gnome.Shell.Extensions.desktop /usr/share//applications/org.gnome.Shell.PortalHelper.desktop /usr/share//applications/org.gnome.Shell.desktop /usr/share//applications/org.gnome.Shotwell-Viewer.desktop /usr/share//applications/org.gnome.Shotwell.Auth.desktop /usr/share//applications/org.gnome.Shotwell.desktop /usr/share//applications/org.gnome.Snapshot.desktop /usr/share//applications/org.gnome.SystemMonitor.desktop /usr/share//applications/org.gnome.Tecla.desktop /usr/share//applications/org.gnome.Terminal.Preferences.desktop /usr/share//applications/org.gnome.Terminal.desktop /usr/share//applications/org.gnome.TextEditor.desktop /usr/share//applications/org.gnome.Totem.desktop /usr/share//applications/org.gnome.Zenity.desktop /usr/share//applications/org.gnome.baobab.desktop /usr/share//applications/org.gnome.clocks.desktop /usr/share//applications/org.gnome.eog.desktop /usr/share//applications/org.gnome.evolution-data-server.OAuth2-handler.desktop /usr/share//applications/org.gnome.font-viewer.desktop /usr/share//applications/org.gnome.seahorse.Application.desktop /usr/share//applications/org.remmina.Remmina-file.desktop /usr/share//applications/org.remmina.Remmina.desktop /usr/share//applications/python3.12.desktop /usr/share//applications/remmina-gnome.desktop /usr/share//applications/rygel.desktop /usr/share//applications/simple-scan.desktop /usr/share//applications/snap-handle-link.desktop /usr/share//applications/software-properties-drivers.desktop /usr/share//applications/software-properties-gtk.desktop /usr/share//applications/software-properties-livepatch.desktop /usr/share//applications/thunderbird.desktop /usr/share//applications/transmission-gtk.desktop /usr/share//applications/update-manager.desktop /usr/share//applications/usb-creator-gtk.desktop /usr/share//applications/xdg-desktop-portal-gnome.desktop /usr/share//applications/xdg-desktop-portal-gtk.desktop /usr/share//applications/yelp.desktop3⤵PID:2902
-
-
-
/usr/bin/grepgrep -q "%s"2⤵PID:2904
-
-
/usr/bin/x-www-browserx-www-browser http://h2⤵PID:2905
-
/usr/bin/xdg-settingsxdg-settings get default-web-browser3⤵PID:2906
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager4⤵
- Reads runtime system information
PID:2907 -
/usr/bin/dbus-launchdbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr5⤵PID:2908
-
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE4⤵PID:2909
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"4⤵PID:2910
-
-
/usr/bin/xpropxprop -root4⤵PID:2911
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"4⤵
- Reads runtime system information
PID:2912
-
-
/usr/bin/grepgrep -q "^Enlightenment"4⤵PID:2914
-
-
/usr/bin/unameuname4⤵PID:2915
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/http4⤵PID:2916
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager5⤵
- Reads runtime system information
PID:2917 -
/usr/bin/dbus-launchdbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr6⤵PID:2918
-
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE5⤵PID:2919
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"5⤵
- Reads runtime system information
PID:2920
-
-
/usr/bin/xpropxprop -root5⤵PID:2921
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"5⤵
- Reads runtime system information
PID:2922
-
-
/usr/bin/grepgrep -q "^Enlightenment"5⤵
- Reads runtime system information
PID:2924
-
-
/usr/bin/unameuname5⤵PID:2925
-
-
/usr/bin/sedsed "s/:/ /g"5⤵PID:2928
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache5⤵
- Reads runtime system information
PID:2930
-
-
/usr/bin/headhead -n 15⤵PID:2931
-
-
/usr/bin/cutcut -d "=" -f 25⤵PID:2932
-
-
/usr/bin/cutcut -d ";" -f 15⤵PID:2933
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache5⤵
- Reads runtime system information
PID:2935
-
-
/usr/bin/headhead -n 15⤵PID:2936
-
-
/usr/bin/cutcut -d "=" -f 25⤵PID:2937
-
-
/usr/bin/cutcut -d ";" -f 15⤵PID:2938
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache5⤵
- Reads runtime system information
PID:2940
-
-
/usr/bin/headhead -n 15⤵PID:2941
-
-
/usr/bin/cutcut -d "=" -f 25⤵PID:2942
-
-
/usr/bin/cutcut -d ";" -f 15⤵PID:2943
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache5⤵
- Reads runtime system information
PID:2945
-
-
/usr/bin/headhead -n 15⤵PID:2946
-
-
/usr/bin/cutcut -d "=" -f 25⤵PID:2947
-
-
/usr/bin/cutcut -d ";" -f 15⤵PID:2948
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache5⤵
- Reads runtime system information
PID:2950
-
-
/usr/bin/headhead -n 15⤵PID:2951
-
-
/usr/bin/cutcut -d "=" -f 25⤵PID:2952
-
-
/usr/bin/cutcut -d ";" -f 15⤵PID:2953
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache5⤵
- Reads runtime system information
PID:2955
-
-
/usr/bin/headhead -n 15⤵PID:2956
-
-
/usr/bin/cutcut -d ";" -f 15⤵PID:2958
-
-
/usr/bin/cutcut -d "=" -f 25⤵PID:2957
-
-
/usr/bin/sedsed "s/:/ /g"5⤵
- Reads runtime system information
PID:2961
-
-
/usr/bin/grepgrep -l "x-scheme-handler/http;" "/.local/share/applications/*.desktop"5⤵
- Reads runtime system information
PID:2963
-
-
/usr/bin/grepgrep -l "x-scheme-handler/http;" "/usr/local/share//applications/*.desktop"5⤵
- Reads runtime system information
PID:2965
-
-
/usr/bin/grepgrep -l "x-scheme-handler/http;" /usr/share//applications/apport-gtk.desktop /usr/share//applications/bluetooth-sendto.desktop /usr/share//applications/display-im6.q16.desktop /usr/share//applications/gcr-prompter.desktop /usr/share//applications/gcr-viewer.desktop /usr/share//applications/geoclue-demo-agent.desktop /usr/share//applications/gkbd-keyboard-display.desktop /usr/share//applications/gnome-about-panel.desktop /usr/share//applications/gnome-applications-panel.desktop /usr/share//applications/gnome-background-panel.desktop /usr/share//applications/gnome-bluetooth-panel.desktop /usr/share//applications/gnome-color-panel.desktop /usr/share//applications/gnome-datetime-panel.desktop /usr/share//applications/gnome-disk-image-mounter.desktop /usr/share//applications/gnome-disk-image-writer.desktop /usr/share//applications/gnome-display-panel.desktop /usr/share//applications/gnome-initial-setup.desktop /usr/share//applications/gnome-keyboard-panel.desktop /usr/share//applications/gnome-language-selector.desktop /usr/share//applications/gnome-mouse-panel.desktop /usr/share//applications/gnome-multitasking-panel.desktop /usr/share//applications/gnome-network-panel.desktop /usr/share//applications/gnome-notifications-panel.desktop /usr/share//applications/gnome-online-accounts-panel.desktop /usr/share//applications/gnome-power-panel.desktop /usr/share//applications/gnome-printers-panel.desktop /usr/share//applications/gnome-privacy-panel.desktop /usr/share//applications/gnome-region-panel.desktop /usr/share//applications/gnome-search-panel.desktop /usr/share//applications/gnome-session-properties.desktop /usr/share//applications/gnome-sharing-panel.desktop /usr/share//applications/gnome-sound-panel.desktop /usr/share//applications/gnome-system-monitor-kde.desktop /usr/share//applications/gnome-system-panel.desktop /usr/share//applications/gnome-ubuntu-panel.desktop /usr/share//applications/gnome-universal-access-panel.desktop /usr/share//applications/gnome-users-panel.desktop /usr/share//applications/gnome-wacom-panel.desktop /usr/share//applications/gnome-wifi-panel.desktop /usr/share//applications/gnome-wwan-panel.desktop /usr/share//applications/hplj1020.desktop /usr/share//applications/ibus-setup-table.desktop /usr/share//applications/im-config.desktop /usr/share//applications/io.snapcraft.SessionAgent.desktop /usr/share//applications/libreoffice-calc.desktop /usr/share//applications/libreoffice-draw.desktop /usr/share//applications/libreoffice-impress.desktop /usr/share//applications/libreoffice-math.desktop /usr/share//applications/libreoffice-startcenter.desktop /usr/share//applications/libreoffice-writer.desktop /usr/share//applications/libreoffice-xsltfilter.desktop /usr/share//applications/nautilus-autorun-software.desktop /usr/share//applications/nm-applet.desktop /usr/share//applications/nm-connection-editor.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Emojier.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Extension.Gtk3.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Wayland.Gtk3.desktop /usr/share//applications/org.freedesktop.IBus.Setup.desktop /usr/share//applications/org.freedesktop.Xwayland.desktop /usr/share//applications/org.gnome.Calculator.desktop /usr/share//applications/org.gnome.Calendar.desktop /usr/share//applications/org.gnome.Characters.desktop /usr/share//applications/org.gnome.DejaDup.desktop /usr/share//applications/org.gnome.DiskUtility.desktop /usr/share//applications/org.gnome.Evince-previewer.desktop /usr/share//applications/org.gnome.Evince.desktop /usr/share//applications/org.gnome.Evolution-alarm-notify.desktop /usr/share//applications/org.gnome.FileRoller.desktop /usr/share//applications/org.gnome.Logs.desktop /usr/share//applications/org.gnome.Nautilus.desktop /usr/share//applications/org.gnome.OnlineAccounts.OAuth2.desktop /usr/share//applications/org.gnome.PowerStats.desktop /usr/share//applications/org.gnome.RemoteDesktop.Handover.desktop /usr/share//applications/org.gnome.Rhythmbox3.desktop /usr/share//applications/org.gnome.Rhythmbox3.device.desktop /usr/share//applications/org.gnome.Settings.desktop /usr/share//applications/org.gnome.Shell.Extensions.desktop /usr/share//applications/org.gnome.Shell.PortalHelper.desktop /usr/share//applications/org.gnome.Shell.desktop /usr/share//applications/org.gnome.Shotwell-Viewer.desktop /usr/share//applications/org.gnome.Shotwell.Auth.desktop /usr/share//applications/org.gnome.Shotwell.desktop /usr/share//applications/org.gnome.Snapshot.desktop /usr/share//applications/org.gnome.SystemMonitor.desktop /usr/share//applications/org.gnome.Tecla.desktop /usr/share//applications/org.gnome.Terminal.Preferences.desktop /usr/share//applications/org.gnome.Terminal.desktop /usr/share//applications/org.gnome.TextEditor.desktop /usr/share//applications/org.gnome.Totem.desktop /usr/share//applications/org.gnome.Zenity.desktop /usr/share//applications/org.gnome.baobab.desktop /usr/share//applications/org.gnome.clocks.desktop /usr/share//applications/org.gnome.eog.desktop /usr/share//applications/org.gnome.evolution-data-server.OAuth2-handler.desktop /usr/share//applications/org.gnome.font-viewer.desktop /usr/share//applications/org.gnome.seahorse.Application.desktop /usr/share//applications/org.remmina.Remmina-file.desktop /usr/share//applications/org.remmina.Remmina.desktop /usr/share//applications/python3.12.desktop /usr/share//applications/remmina-gnome.desktop /usr/share//applications/rygel.desktop /usr/share//applications/simple-scan.desktop /usr/share//applications/snap-handle-link.desktop /usr/share//applications/software-properties-drivers.desktop /usr/share//applications/software-properties-gtk.desktop /usr/share//applications/software-properties-livepatch.desktop /usr/share//applications/thunderbird.desktop /usr/share//applications/transmission-gtk.desktop /usr/share//applications/update-manager.desktop /usr/share//applications/usb-creator-gtk.desktop /usr/share//applications/xdg-desktop-portal-gnome.desktop /usr/share//applications/xdg-desktop-portal-gtk.desktop /usr/share//applications/yelp.desktop5⤵
- Reads runtime system information
PID:2967
-
-
-
-
/usr/bin/gsettingsgsettings get org.gnome.shell favorite-apps3⤵
- Reads runtime system information
PID:2968
-
-
/usr/bin/grepgrep -q "'firefox.desktop'"3⤵
- Reads runtime system information
PID:2973
-
-
/usr/bin/gsettingsgsettings get com.canonical.Unity.Launcher favorites3⤵
- Reads runtime system information
PID:2974
-
-
/usr/bin/grepgrep -q "'application://firefox.desktop'"3⤵
- Reads runtime system information
PID:2976
-
-
/usr/bin/gsettingsgsettings get org.mate.panel object-id-list3⤵
- Reads runtime system information
PID:2977
-
-
/usr/bin/whichwhich qdbus3⤵PID:2978
-
-
-
/snap/bin/firefox/snap/bin/firefox http://h2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2905 -
/usr/lib/snapd/snap-seccomp/usr/lib/snapd/snap-seccomp version-info3⤵
- Enumerates kernel/hardware configuration
PID:2983
-
-
-
/usr/lib/snapd/snap-confine/usr/lib/snapd/snap-confine --base core22 snap.firefox.firefox /usr/lib/snapd/snap-exec firefox http://h2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2905
-
-
/usr/lib/snapd/snap-exec/usr/lib/snapd/snap-exec firefox http://h2⤵
- Reads runtime system information
PID:2905
-
-
/snap/firefox/4259/snap/command-chain/desktop-launch/snap/firefox/4259/snap/command-chain/desktop-launch /snap/firefox/4259/firefox.launcher http://h2⤵PID:2905
-
/usr/bin/datedate "+%s.%N"3⤵PID:2998
-
-
/usr/bin/chmodchmod 700 /root/snap/firefox/4259/.config3⤵PID:2999
-
-
/usr/bin/md5summd5sum3⤵PID:3001
-
-
/usr/bin/catcat /root/snap/firefox/4259/.config/user-dirs.dirs.md5sum3⤵PID:3002
-
-
/usr/bin/md5summd5sum3⤵PID:3004
-
-
/usr/bin/catcat /root/snap/firefox/4259/.config/user-dirs.locale.md5sum3⤵PID:3005
-
-
/usr/bin/grepgrep -qs "^\\s*confinement:\\s*classic\\s*" /snap/firefox/4259/meta/snap.yaml3⤵
- Reads runtime system information
PID:3006
-
-
/usr/bin/snapctlsnapctl is-connected gnome-42-22043⤵
- Enumerates kernel/hardware configuration
PID:3007
-
-
/usr/bin/snapctlsnapctl is-connected gsettings3⤵
- Enumerates kernel/hardware configuration
PID:3010
-
-
/usr/bin/mkdirmkdir -p /run/user/0/snap.firefox -m 7003⤵
- Reads runtime system information
PID:3014
-
-
/usr/bin/realpathrealpath /root/snap/firefox/4259/.config3⤵PID:3015
-
-
/usr/bin/realpathrealpath /root/snap/firefox/common3⤵PID:3016
-
-
/usr/bin/mkdirmkdir -p /run/user/0/snap.firefox/dconf3⤵
- Reads runtime system information
PID:3017
-
-
/usr/bin/lnln -sf ../../dconf/user /run/user/0/snap.firefox/dconf/user3⤵PID:3018
-
-
/usr/bin/rmrm -rf /root/snap/firefox/4259/.config/ibus/bus3⤵PID:3019
-
-
/usr/bin/lnln -sfn /root/.config/ibus/bus /root/snap/firefox/4259/.config/ibus3⤵PID:3020
-
-
-
/snap/firefox/4259/firefox.launcher/snap/firefox/4259/firefox.launcher http://h2⤵PID:2905
-
-
/snap/firefox/4259/usr/lib/firefox/firefox/snap/firefox/4259/usr/lib/firefox/firefox http://h2⤵
- Reads runtime system information
PID:2905 -
/usr/bin/snapctl/usr/bin/snapctl is-connected3⤵PID:3023
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40B
MD565408163d77c5bbcc5b17dc2e313c93e
SHA1b8891c89ce55f6c1bbe476fd4912a7af296ce79a
SHA256d86e32b299b19c1c03a025d8d5ed026cdf923fc9a1015439cde134b3d13d1fff
SHA512394e2394e44e38210817f5f02779f7b8253c3ff1b4aa816bce7a0b95e40f47094d01cb43ec5e7ec593404f5ddf6fc49bb4175eece231a3cee7c5295e0d9349a7
-
Filesize
53KB
MD5d3b8a4bef831c1af5a8e73baf4e17321
SHA19003cd9615181c5206884a70b15007f445bb787f
SHA256c1420ba137b0818c9b9441c16ee8117a0496da9a14fab1196f3af52cfd84c189
SHA512774811259cfa34e21c3dc3453359d26909868dff52997d39017a3e1d6b1c941504ee1a78fbbb0797b5de05f7a0472e3188e61f19a67c8b7dd5be34943d2b27ed
-
Filesize
22B
MD5c8a656e0f7f0ab827ac5660e607ebf5c
SHA16e9e07995163d959573ce09500bd81ba768e16a5
SHA25633bef3e80216bc82b2a8c8cd5c4b3f1f8aba46829cd0b9870b224b4b30e5dc47
SHA512817d7a1eca70645a70328fe8eaa1c2dc48c82bb996e343e4359747ddf04a8fc19ef698057e9fd3af9e333cfb8b724f8a664b1777a55929b1ebf2dc6ccda60556