URL: | http://www.sj-software.de/mepla/mepla-50/install/sj_mepla_install.exe |
Full analysis: | https://app.any.run/tasks/3183b1ca-e4bb-4770-8d16-8e52df780349 |
Verdict: | Malicious activity |
Analysis date: | June 27, 2022, 09:09:29 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 26594F98C3D4166476498B151C2918EB |
SHA1: | 9BEF600700D83444C0489407400027F504FBE986 |
SHA256: | 2C44F0746AAD7C9E1B8F5E36A8C74F3D81DE70FD5914D09BD7D9CE58E111D50E |
SSDEEP: | 3:N1KJS45pwJCpEHIQNqFN:Cc45prEoQkn |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1332 | "C:\Program Files\Internet Explorer\iexplore.exe" "http://www.sj-software.de/mepla/mepla-50/install/sj_mepla_install.exe" | C:\Program Files\Internet Explorer\iexplore.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
964 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1332 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
2336 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
2632 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 83.0 Modules
| |||||||||||||||
3516 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.0.1985957965\96403683" -parentBuildID 20201112153044 -prefsHandle 924 -prefMapHandle 940 -prefsLen 1 -prefMapSize 238726 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 1208 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 83.0 Modules
| |||||||||||||||
2228 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.6.1500924236\1993883111" -childID 1 -isForBrowser -prefsHandle 3296 -prefMapHandle 3292 -prefsLen 181 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 3308 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 83.0 Modules
| |||||||||||||||
3220 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.13.2043142017\241541115" -childID 2 -isForBrowser -prefsHandle 2764 -prefMapHandle 2760 -prefsLen 6644 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 2632 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 83.0 Modules
| |||||||||||||||
2476 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.20.1799874040\961335090" -childID 3 -isForBrowser -prefsHandle 3176 -prefMapHandle 3616 -prefsLen 7470 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 3624 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 83.0 Modules
| |||||||||||||||
2024 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.21.44212653\1841987604" -childID 4 -isForBrowser -prefsHandle 3640 -prefMapHandle 3628 -prefsLen 7470 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 3716 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 Modules
|
(PID) Process: | (1332) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 1 | |||
(PID) Process: | (1332) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPLastLaunchLowDateTime |
Value: | |||
(PID) Process: | (1332) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 30968325 | |||
(PID) Process: | (1332) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateLowDateTime |
Value: | |||
(PID) Process: | (1332) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 30968325 | |||
(PID) Process: | (1332) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (1332) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (1332) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (1332) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
(PID) Process: | (1332) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2632 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin | — | |
MD5:— | SHA256:— | |||
1332 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{DBB981EB-F5F8-11EC-8C9F-1203334A04AF}.dat | binary | |
MD5:83DF7A1E551644ECC1B0F38618F3AEDA | SHA256:7C4BC6A97EC6D11FFDB73DBB1DCD6B3407C303DFE9337A04C6F2E637B1AFE51C | |||
1332 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF112288A56B2184EA.TMP | gmc | |
MD5:6965FB141BEE6911D91C122634BA9621 | SHA256:82F23F5DB49B9FC649BE6493E1435DE6CC9C69453F8B353CA80F2654659066E9 | |||
1332 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{42C873D0-1D90-11EB-BA2C-12A9866C77DE}.dat | binary | |
MD5:9B6CD1F60ECD4B85529ABFAB7689F160 | SHA256:CE242A79B28C5727BD724325D565BDFAA4A474751D113F0775719B91B43704A8 | |||
1332 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFF5D5A57A35004792.TMP | gmc | |
MD5:9083F0492C6E8A7FA8748935A2A5300E | SHA256:5302D3B5403F17B7709D8C956DF964F9CEAA475B41B07FB1BABBE6B2D57FBCAD | |||
1332 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF5F247BA64ED0BDBB.TMP | gmc | |
MD5:A99D5D6198342E641441EBEA1D5434A0 | SHA256:1D00C89D54063E99195FB5EB528CE053886BB615C3C6425DF9FB5ABFE7A09556 | |||
1332 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF2C8F93E5328AD373.TMP | gmc | |
MD5:96EA94CE3A5F537D568ECA7BE16999A7 | SHA256:3D76DDEAEC66886B97A1D337FBE2CFC87AB94EF374D0C8BE6CFCB06B7C4EAB50 | |||
1332 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{DBB981EC-F5F8-11EC-8C9F-1203334A04AF}.dat | binary | |
MD5:C236C45F58128C024C62512FA16A39E5 | SHA256:803BB2CA86C3D6AAFCFFE362A2CA53F52D395FE3EDDF858F9B367B949503F02D | |||
2632 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite | — | |
MD5:— | SHA256:— | |||
1332 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{DBB981E9-F5F8-11EC-8C9F-1203334A04AF}.dat | binary | |
MD5:306FD873EEA7737F0CD2E353C45AD8A5 | SHA256:A8D7B8151AA4EE16188B35B04DE167D297CE0CF19E5F2859BD8DB8F2F2017768 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2632 | firefox.exe | POST | 200 | 142.250.185.131:80 | http://ocsp.pki.goog/gts1c3 | US | der | 472 b | whitelisted |
2632 | firefox.exe | GET | 401 | 217.160.0.77:80 | http://www.sj-software.de/mepla/mepla-50/install/sj_mepla_install.exe | DE | html | 681 b | malicious |
2632 | firefox.exe | GET | 401 | 217.160.0.77:80 | http://www.sj-software.de/mepla/mepla-50/install/sj_mepla_install.exe | DE | html | 681 b | malicious |
2632 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2632 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2632 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2632 | firefox.exe | POST | 200 | 142.250.185.131:80 | http://ocsp.pki.goog/gts1c3 | US | der | 471 b | whitelisted |
2632 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2632 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | US | text | 8 b | whitelisted |
2632 | firefox.exe | POST | 200 | 142.250.185.131:80 | http://ocsp.pki.goog/gts1c3 | US | der | 471 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2632 | firefox.exe | 172.217.168.234:443 | safebrowsing.googleapis.com | Google Inc. | US | whitelisted |
2632 | firefox.exe | 18.66.248.43:443 | firefox.settings.services.mozilla.com | Massachusetts Institute of Technology | US | suspicious |
2632 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | — | US | whitelisted |
2632 | firefox.exe | 52.40.216.187:443 | push.services.mozilla.com | Amazon.com, Inc. | US | unknown |
964 | iexplore.exe | 217.160.0.77:80 | www.sj-software.de | 1&1 Internet SE | DE | malicious |
2632 | firefox.exe | 54.189.127.149:443 | location.services.mozilla.com | Amazon.com, Inc. | US | unknown |
2632 | firefox.exe | 142.250.185.131:80 | ocsp.pki.goog | Google Inc. | US | whitelisted |
2632 | firefox.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2632 | firefox.exe | 108.157.4.36:443 | snippets.cdn.mozilla.net | — | US | unknown |
2632 | firefox.exe | 217.160.0.77:80 | www.sj-software.de | 1&1 Internet SE | DE | malicious |
Domain | IP | Reputation |
---|---|---|
www.sj-software.de |
| malicious |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
firefox.settings.services.mozilla.com |
| whitelisted |
location.services.mozilla.com |
| whitelisted |
locprod2-elb-us-west-2.prod.mozaws.net |
| whitelisted |
safebrowsing.googleapis.com |
| whitelisted |
push.services.mozilla.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
2632 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |
2632 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |
2632 | firefox.exe | Potential Corporate Privacy Violation | ET POLICY Outgoing Basic Auth Base64 HTTP Password detected unencrypted |
2632 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |
2632 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |