Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
896s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240729-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
04/01/2025, 08:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://blx.gg
Resource
win10v2004-20241007-en
12 signatures
900 seconds
Behavioral task
behavioral2
Sample
http://blx.gg
Resource
ubuntu2404-amd64-20240729-en
4 signatures
900 seconds
General
-
Target
http://blx.gg
Score
6/10
Malware Config
Signatures
-
Reads AppArmor ptrace settings 1 TTPs 1 IoCs
Discovery of allowed ptrace capabilities by AppArmor.
description ioc Process File opened for reading /sys/kernel/security/apparmor/features/ptrace snap -
Changes its process name 3 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself pool-spawner 3609 gsettings Changes the process name, possibly in an attempt to hide itself gmain 3610 gsettings Changes the process name, possibly in an attempt to hide itself dconf worker 3611 gsettings -
Enumerates kernel/hardware configuration 1 TTPs 20 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/security/apparmor/features/query snap File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size snap-seccomp File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/kernel/security/apparmor/features/dbus snap File opened for reading /sys/kernel/security/apparmor/features/ipc snap File opened for reading /sys/kernel/security/apparmor/features/signal snap File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size firefox File opened for reading /sys/kernel/security/apparmor/features/file snap File opened for reading /sys/kernel/security/apparmor/features/network snap File opened for reading /sys/kernel/security/apparmor/features/network_v8 snap File opened for reading /sys/kernel/security/apparmor/features/policy snap File opened for reading /sys/kernel/security/apparmor/features/rlimit snap File opened for reading /sys/kernel/security/apparmor/features/caps snap File opened for reading /sys/kernel/security/apparmor/features/namespaces snap File opened for reading /sys/kernel/security/apparmor/features snap File opened for reading /sys/kernel/security/apparmor/features/domain snap File opened for reading /sys/kernel/security/apparmor/features/io_uring snap File opened for reading /sys/kernel/security/apparmor/features/mount snap File opened for reading /sys/module/apparmor/parameters/enabled dbus-daemon File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size snap -
description ioc Process File opened for reading /proc/filesystems sed File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/mounts firefox File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems gsettings File opened for reading /proc/cmdline firefox File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/filesystems gsettings File opened for reading /proc/cgroups snap File opened for reading /proc/cmdline snap File opened for reading /proc/self/maps grep File opened for reading /proc/self/fd dbus-send File opened for reading /proc/3554/cmdline dbus-daemon File opened for reading /proc/filesystems sed File opened for reading /proc/self/maps grep File opened for reading /proc/self/mounts snap File opened for reading /proc/self/mountinfo snap File opened for reading /proc/self/fd dbus-daemon File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/3545/status dbus-daemon File opened for reading /proc/cgroups firefox File opened for reading /proc/self/fd dbus-send File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/3540/cmdline dbus-daemon File opened for reading /proc/3545/attr/apparmor/current dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/3537/cgroup snap File opened for reading /proc/sys/kernel/cap_last_cap dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems gsettings File opened for reading /proc/sys/kernel/seccomp/actions_avail snap File opened for reading /proc/sys/kernel/random/uuid snap File opened for reading /proc/self/fd dbus-launch
Processes
-
/usr/bin/firefoxfirefox -new-tab http://blx.gg1⤵PID:3537
-
/usr/bin/xdg-settingsxdg-settings get default-web-browser2⤵PID:3539
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
- Reads runtime system information
PID:3540 -
/usr/bin/dbus-launchdbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr4⤵
- Reads runtime system information
PID:3541 -
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session5⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:3543
-
-
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:3546
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
- Reads runtime system information
PID:3547
-
-
/usr/bin/xpropxprop -root3⤵PID:3548
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
- Reads runtime system information
PID:3549
-
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
- Reads runtime system information
PID:3551
-
-
/usr/bin/unameuname3⤵PID:3552
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/http3⤵PID:3553
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager4⤵
- Reads runtime system information
PID:3554 -
/usr/bin/dbus-launchdbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr5⤵PID:3555
-
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE4⤵PID:3556
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"4⤵
- Reads runtime system information
PID:3557
-
-
/usr/bin/xpropxprop -root4⤵PID:3558
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"4⤵
- Reads runtime system information
PID:3559
-
-
/usr/bin/grepgrep -q "^Enlightenment"4⤵
- Reads runtime system information
PID:3561
-
-
/usr/bin/unameuname4⤵PID:3562
-
-
/usr/bin/sedsed "s/:/ /g"4⤵
- Reads runtime system information
PID:3565
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache4⤵
- Reads runtime system information
PID:3567
-
-
/usr/bin/headhead -n 14⤵PID:3568
-
-
/usr/bin/cutcut -d "=" -f 24⤵PID:3569
-
-
/usr/bin/cutcut -d ";" -f 14⤵PID:3570
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache4⤵
- Reads runtime system information
PID:3572
-
-
/usr/bin/headhead -n 14⤵PID:3573
-
-
/usr/bin/cutcut -d "=" -f 24⤵PID:3574
-
-
/usr/bin/cutcut -d ";" -f 14⤵PID:3575
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache4⤵
- Reads runtime system information
PID:3577
-
-
/usr/bin/headhead -n 14⤵PID:3578
-
-
/usr/bin/cutcut -d "=" -f 24⤵PID:3579
-
-
/usr/bin/cutcut -d ";" -f 14⤵PID:3580
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache4⤵
- Reads runtime system information
PID:3582
-
-
/usr/bin/headhead -n 14⤵PID:3583
-
-
/usr/bin/cutcut -d "=" -f 24⤵PID:3584
-
-
/usr/bin/cutcut -d ";" -f 14⤵PID:3585
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache4⤵
- Reads runtime system information
PID:3587
-
-
/usr/bin/headhead -n 14⤵PID:3588
-
-
/usr/bin/cutcut -d "=" -f 24⤵PID:3589
-
-
/usr/bin/cutcut -d ";" -f 14⤵PID:3590
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache4⤵
- Reads runtime system information
PID:3593
-
-
/usr/bin/headhead -n 14⤵PID:3594
-
-
/usr/bin/cutcut -d "=" -f 24⤵PID:3595
-
-
/usr/bin/cutcut -d ";" -f 14⤵PID:3596
-
-
/usr/bin/sedsed "s/:/ /g"4⤵
- Reads runtime system information
PID:3601
-
-
/usr/bin/grepgrep -l "x-scheme-handler/http;" "/.local/share/applications/*.desktop"4⤵
- Reads runtime system information
PID:3603
-
-
/usr/bin/grepgrep -l "x-scheme-handler/http;" "/usr/local/share//applications/*.desktop"4⤵
- Reads runtime system information
PID:3605
-
-
/usr/bin/grepgrep -l "x-scheme-handler/http;" /usr/share//applications/apport-gtk.desktop /usr/share//applications/bluetooth-sendto.desktop /usr/share//applications/display-im6.q16.desktop /usr/share//applications/gcr-prompter.desktop /usr/share//applications/gcr-viewer.desktop /usr/share//applications/geoclue-demo-agent.desktop /usr/share//applications/gkbd-keyboard-display.desktop /usr/share//applications/gnome-about-panel.desktop /usr/share//applications/gnome-applications-panel.desktop /usr/share//applications/gnome-background-panel.desktop /usr/share//applications/gnome-bluetooth-panel.desktop /usr/share//applications/gnome-color-panel.desktop /usr/share//applications/gnome-datetime-panel.desktop /usr/share//applications/gnome-disk-image-mounter.desktop /usr/share//applications/gnome-disk-image-writer.desktop /usr/share//applications/gnome-display-panel.desktop /usr/share//applications/gnome-initial-setup.desktop /usr/share//applications/gnome-keyboard-panel.desktop /usr/share//applications/gnome-language-selector.desktop /usr/share//applications/gnome-mouse-panel.desktop /usr/share//applications/gnome-multitasking-panel.desktop /usr/share//applications/gnome-network-panel.desktop /usr/share//applications/gnome-notifications-panel.desktop /usr/share//applications/gnome-online-accounts-panel.desktop /usr/share//applications/gnome-power-panel.desktop /usr/share//applications/gnome-printers-panel.desktop /usr/share//applications/gnome-privacy-panel.desktop /usr/share//applications/gnome-region-panel.desktop /usr/share//applications/gnome-search-panel.desktop /usr/share//applications/gnome-session-properties.desktop /usr/share//applications/gnome-sharing-panel.desktop /usr/share//applications/gnome-sound-panel.desktop /usr/share//applications/gnome-system-monitor-kde.desktop /usr/share//applications/gnome-system-panel.desktop /usr/share//applications/gnome-ubuntu-panel.desktop /usr/share//applications/gnome-universal-access-panel.desktop /usr/share//applications/gnome-users-panel.desktop /usr/share//applications/gnome-wacom-panel.desktop /usr/share//applications/gnome-wifi-panel.desktop /usr/share//applications/gnome-wwan-panel.desktop /usr/share//applications/hplj1020.desktop /usr/share//applications/ibus-setup-table.desktop /usr/share//applications/im-config.desktop /usr/share//applications/io.snapcraft.SessionAgent.desktop /usr/share//applications/libreoffice-calc.desktop /usr/share//applications/libreoffice-draw.desktop /usr/share//applications/libreoffice-impress.desktop /usr/share//applications/libreoffice-math.desktop /usr/share//applications/libreoffice-startcenter.desktop /usr/share//applications/libreoffice-writer.desktop /usr/share//applications/libreoffice-xsltfilter.desktop /usr/share//applications/nautilus-autorun-software.desktop /usr/share//applications/nm-applet.desktop /usr/share//applications/nm-connection-editor.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Emojier.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Extension.Gtk3.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Wayland.Gtk3.desktop /usr/share//applications/org.freedesktop.IBus.Setup.desktop /usr/share//applications/org.freedesktop.Xwayland.desktop /usr/share//applications/org.gnome.Calculator.desktop /usr/share//applications/org.gnome.Calendar.desktop /usr/share//applications/org.gnome.Characters.desktop /usr/share//applications/org.gnome.DejaDup.desktop /usr/share//applications/org.gnome.DiskUtility.desktop /usr/share//applications/org.gnome.Evince-previewer.desktop /usr/share//applications/org.gnome.Evince.desktop /usr/share//applications/org.gnome.Evolution-alarm-notify.desktop /usr/share//applications/org.gnome.FileRoller.desktop /usr/share//applications/org.gnome.Logs.desktop /usr/share//applications/org.gnome.Nautilus.desktop /usr/share//applications/org.gnome.OnlineAccounts.OAuth2.desktop /usr/share//applications/org.gnome.PowerStats.desktop /usr/share//applications/org.gnome.RemoteDesktop.Handover.desktop /usr/share//applications/org.gnome.Rhythmbox3.desktop /usr/share//applications/org.gnome.Rhythmbox3.device.desktop /usr/share//applications/org.gnome.Settings.desktop /usr/share//applications/org.gnome.Shell.Extensions.desktop /usr/share//applications/org.gnome.Shell.PortalHelper.desktop /usr/share//applications/org.gnome.Shell.desktop /usr/share//applications/org.gnome.Shotwell-Viewer.desktop /usr/share//applications/org.gnome.Shotwell.Auth.desktop /usr/share//applications/org.gnome.Shotwell.desktop /usr/share//applications/org.gnome.Snapshot.desktop /usr/share//applications/org.gnome.SystemMonitor.desktop /usr/share//applications/org.gnome.Tecla.desktop /usr/share//applications/org.gnome.Terminal.Preferences.desktop /usr/share//applications/org.gnome.Terminal.desktop /usr/share//applications/org.gnome.TextEditor.desktop /usr/share//applications/org.gnome.Totem.desktop /usr/share//applications/org.gnome.Zenity.desktop /usr/share//applications/org.gnome.baobab.desktop /usr/share//applications/org.gnome.clocks.desktop /usr/share//applications/org.gnome.eog.desktop /usr/share//applications/org.gnome.evolution-data-server.OAuth2-handler.desktop /usr/share//applications/org.gnome.font-viewer.desktop /usr/share//applications/org.gnome.seahorse.Application.desktop /usr/share//applications/org.remmina.Remmina-file.desktop /usr/share//applications/org.remmina.Remmina.desktop /usr/share//applications/python3.12.desktop /usr/share//applications/remmina-gnome.desktop /usr/share//applications/rygel.desktop /usr/share//applications/simple-scan.desktop /usr/share//applications/snap-handle-link.desktop /usr/share//applications/software-properties-drivers.desktop /usr/share//applications/software-properties-gtk.desktop /usr/share//applications/software-properties-livepatch.desktop /usr/share//applications/thunderbird.desktop /usr/share//applications/transmission-gtk.desktop /usr/share//applications/update-manager.desktop /usr/share//applications/usb-creator-gtk.desktop /usr/share//applications/xdg-desktop-portal-gnome.desktop /usr/share//applications/xdg-desktop-portal-gtk.desktop /usr/share//applications/yelp.desktop4⤵
- Reads runtime system information
PID:3607
-
-
-
-
/usr/bin/gsettingsgsettings get org.gnome.shell favorite-apps2⤵
- Changes its process name
- Reads runtime system information
PID:3608 -
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:3612
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:3612
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:3612
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:3612
-
-
-
/usr/bin/grepgrep -q "'firefox.desktop'"2⤵
- Reads runtime system information
PID:3614
-
-
/usr/bin/gsettingsgsettings get com.canonical.Unity.Launcher favorites2⤵
- Reads runtime system information
PID:3615
-
-
/usr/bin/grepgrep -q "'application://firefox.desktop'"2⤵
- Reads runtime system information
PID:3617
-
-
/usr/bin/gsettingsgsettings get org.mate.panel object-id-list2⤵
- Reads runtime system information
PID:3618
-
-
/usr/bin/whichwhich qdbus2⤵PID:3619
-
-
/snap/bin/firefox/snap/bin/firefox -new-tab http://blx.gg1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:3537
-
/snap/snapd/current/usr/bin/snap/snap/bin/firefox -new-tab http://blx.gg1⤵
- Reads AppArmor ptrace settings
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:3537 -
/snap/snapd/21759/usr/lib/snapd/snap-seccomp/snap/snapd/21759/usr/lib/snapd/snap-seccomp version-info2⤵
- Enumerates kernel/hardware configuration
PID:3627
-
-
/snap/snapd/21759/usr/lib/snapd/snap-confine/snap/snapd/21759/usr/lib/snapd/snap-confine --base core22 snap.firefox.firefox /usr/lib/snapd/snap-exec firefox -new-tab http://blx.gg1⤵PID:3626