Analysis
-
max time kernel
299s -
max time network
291s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240611-en -
resource tags
-
submitted
31-10-2024 14:44
General
-
Target
https://ola2.performancematters.com/ola/ola.jsp?clientCode=flpasco
Score
4/10
Malware Config
Signatures
-
Changes its process name 64 IoCs
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads CPU attributes 1 TTPs 12 IoCs
-
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
System Information Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the system, such as OS, hostname, and hardware details.
-
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/usr/bin/xdg-openxdg-open "https://ola2.performancematters.com/ola/ola.jsp?clientCode=flpasco"1⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
-
/usr/bin/dbus-launchdbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr3⤵
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Changes its process name
- Reads runtime system information
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵
- Changes its process name
- Reads runtime system information
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵
- Reads runtime system information
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵
- Reads runtime system information
-
-
/usr/libexec/gvfsd/usr/libexec/gvfsd5⤵
- Reads runtime system information
-
/usr/libexec/gvfsd-trash/usr/libexec/gvfsd-trash --spawner :1.8 /org/gtk/gvfs/exec_spaw/06⤵
- Reads runtime system information
-
-
-
/usr/libexec/dconf-service/usr/libexec/dconf-service5⤵
- Reads runtime system information
-
-
/usr/bin/nautilus/usr/bin/nautilus --gapplication-service5⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/gnome-keyring-daemon/usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"5⤵
- Reads runtime system information
-
-
/usr/libexec/gvfs-udisks2-volume-monitor/usr/libexec/gvfs-udisks2-volume-monitor5⤵
- Reads runtime system information
-
-
/usr/libexec/gvfs-afc-volume-monitor/usr/libexec/gvfs-afc-volume-monitor5⤵
- Reads runtime system information
-
-
/usr/libexec/gvfs-mtp-volume-monitor/usr/libexec/gvfs-mtp-volume-monitor5⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/libexec/gvfs-gphoto2-volume-monitor/usr/libexec/gvfs-gphoto2-volume-monitor5⤵
- Enumerates kernel/hardware configuration
-
-
/usr/libexec/gvfs-goa-volume-monitor/usr/libexec/gvfs-goa-volume-monitor5⤵
- Reads runtime system information
-
-
/usr/libexec/goa-daemon/usr/libexec/goa-daemon5⤵
-
-
/usr/libexec/goa-identity-service/usr/libexec/goa-identity-service5⤵
-
-
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
-
-
/usr/bin/xpropxprop -root2⤵
-
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
-
-
/usr/bin/unameuname2⤵
-
-
/usr/bin/grepgrep -q "^file://"2⤵
-
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/https2⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
-
/usr/bin/dbus-launchdbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr4⤵
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
-
-
/usr/bin/xpropxprop -root3⤵
-
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
-
-
/usr/bin/unameuname3⤵
-
-
/usr/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
-
-
-
/usr/bin/sedsed "s/:/ /g"2⤵
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/whichwhich firefox2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/firefox/usr/bin/firefox "https://ola2.performancematters.com/ola/ola.jsp?clientCode=flpasco"2⤵
-
/usr/bin/whichwhich /usr/bin/firefox3⤵
-
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox "https://ola2.performancematters.com/ola/ola.jsp?clientCode=flpasco"2⤵
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 133⤵
- Changes its process name
- Enumerates kernel/hardware configuration
-
-
/usr/bin/lsb_release/usr/bin/lsb_release -idrc3⤵
- System Information Discovery
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -prefsLen 20597 -prefMapSize 234708 -appDir /usr/lib/firefox/browser "{04fc51ed-3c01-406f-9612-07ce577e7ddd}" 1472 true socket3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 20271 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{3036d1e8-14b9-4240-81e8-e9d3db6c1708}" 1472 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 26979 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{ff598e97-da72-4614-bb96-c0c255c14489}" 1472 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -sandboxingKind 0 -prefsLen 27670 -prefMapSize 234708 -appDir /usr/lib/firefox/browser "{a2c49d44-4535-49dc-8aa6-f0aa995fb46f}" 1472 true utility3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 25923 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{8c0975a4-4c46-4c00-8d23-33358f8ac623}" 1472 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 25923 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{f58bd007-9ba8-4d99-9c49-68535ac0ef7c}" 1472 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 25923 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{6fe02ce2-a80f-42cd-9398-d5f5dc25fe8e}" 1472 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
-
/usr/libexec/gvfsd-fuse/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f -o big_writes1⤵
- Reads runtime system information
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
569KB
MD530082ae40dc48af6343db2fd22cfc645
SHA13eb577555ee638e8beb01173e8f29e172747a728
SHA25685d4b95f9b2075daee9b0e64bce8d9d7343d0dda10e6072d7f9485a68472ee76
SHA51253a58bfb4c8124ad4f7655b99bfdea290033a085e0796b19245b33b91c0948fdac9f0c3e817130b352493a65d9a7a0fc8a7c1eedc618cdaa2b4580734a11cd9c