| URL: | http://sendspace.com/file/cd7458 |
| Full analysis: | https://app.any.run/tasks/18767748-1dfc-4a0f-9b9b-4f2d3b29be1c |
| Verdict: | Malicious activity |
| Analysis date: | April 01, 2024, 15:11:10 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | AE272E5839233DCE292E903ECC7ED984 |
| SHA1: | A5AEAF5790D347E7E186CB82623CF0BCBB843BFB |
| SHA256: | 366879D1C9955FA3FD43A20D9326741FF3D579798D0EC145F18DB6A19426BA82 |
| SSDEEP: | 3:N1KNALguGTYoE:CSUuK0 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1264 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4008.8.777839480\370873552" -childID 7 -isForBrowser -prefsHandle 4360 -prefMapHandle 4364 -prefsLen 29313 -prefMapSize 244195 -jsInitHandle 920 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {16f50434-f887-4334-a7bc-8a95cfd54f84} 4008 "\\.\pipe\gecko-crash-server-pipe.4008" 4296 18128b20 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1392 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4008.7.1184488991\1414610955" -childID 6 -isForBrowser -prefsHandle 4208 -prefMapHandle 4212 -prefsLen 29313 -prefMapSize 244195 -jsInitHandle 920 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1aae924-96d9-44b6-b131-a0b612292771} 4008 "\\.\pipe\gecko-crash-server-pipe.4008" 2176 17195280 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1496 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4008.1.118333821\1050336293" -parentBuildID 20230710165010 -prefsHandle 1412 -prefMapHandle 1408 -prefsLen 28600 -prefMapSize 244195 -appDir "C:\Program Files\Mozilla Firefox\browser" - {575f14e1-769d-4fef-b778-76f70ec71627} 4008 "\\.\pipe\gecko-crash-server-pipe.4008" 1424 d5276b0 socket | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 1768 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4008.2.985945537\1231252501" -childID 1 -isForBrowser -prefsHandle 2088 -prefMapHandle 2084 -prefsLen 24491 -prefMapSize 244195 -jsInitHandle 920 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f3a007e-f0a8-4a49-abc5-d4f87d864698} 4008 "\\.\pipe\gecko-crash-server-pipe.4008" 2100 126626d0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2124 | "C:\Program Files\Mozilla Firefox\firefox.exe" "http://sendspace.com/file/cd7458" | C:\Program Files\Mozilla Firefox\firefox.exe | — | explorer.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2248 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4008.3.2103818105\941041908" -childID 2 -isForBrowser -prefsHandle 2828 -prefMapHandle 2824 -prefsLen 34225 -prefMapSize 244195 -jsInitHandle 920 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c6ad038-98f5-425c-9398-624079aeeb42} 4008 "\\.\pipe\gecko-crash-server-pipe.4008" 2840 16528b20 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 2588 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4008.4.1877857127\634435708" -childID 3 -isForBrowser -prefsHandle 3684 -prefMapHandle 3644 -prefsLen 34225 -prefMapSize 244195 -jsInitHandle 920 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb8fc26b-d73d-41bf-a465-79db92563156} 4008 "\\.\pipe\gecko-crash-server-pipe.4008" 3640 16d403f0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 2592 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4008.13.500210254\1405523119" -childID 12 -isForBrowser -prefsHandle 3056 -prefMapHandle 2720 -prefsLen 31122 -prefMapSize 244195 -jsInitHandle 920 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f66be965-076c-48de-8af8-46cb57336d26} 4008 "\\.\pipe\gecko-crash-server-pipe.4008" 3148 1aa59e00 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2672 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4008.0.1422466585\1008246939" -parentBuildID 20230710165010 -prefsHandle 1112 -prefMapHandle 1104 -prefsLen 28523 -prefMapSize 244195 -appDir "C:\Program Files\Mozilla Firefox\browser" - {077e4c46-fbce-4a1c-ad1d-61c4ff9943d9} 4008 "\\.\pipe\gecko-crash-server-pipe.4008" 1184 d5a91b0 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 2920 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4008.32.1970514346\1371418804" -childID 31 -isForBrowser -prefsHandle 4488 -prefMapHandle 1640 -prefsLen 31874 -prefMapSize 244195 -jsInitHandle 920 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8f5327e-ff11-4002-9b56-242d37328ee0} 4008 "\\.\pipe\gecko-crash-server-pipe.4008" 7936 1d409b20 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| (PID) Process: | (2124) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Launcher |
Value: 4C10C95101000000 | |||
| (PID) Process: | (4008) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Browser |
Value: 3A70CB5101000000 | |||
| (PID) Process: | (4008) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Installer\308046B0AF4A39CB |
| Operation: | delete value | Name: | installer.taskbarpin.win10.enabled |
Value: | |||
| (PID) Process: | (4008) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry |
Value: 0 | |||
| (PID) Process: | (4008) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
| (PID) Process: | (4008) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Theme |
Value: 1 | |||
| (PID) Process: | (4008) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Enabled |
Value: 1 | |||
| (PID) Process: | (4008) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableTelemetry |
Value: 1 | |||
| (PID) Process: | (4008) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent |
Value: 0 | |||
| (PID) Process: | (4008) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|SetDefaultBrowserUserChoice |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4008 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.bin | binary | |
MD5:— | SHA256:— | |||
| 4008 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm | binary | |
MD5:— | SHA256:— | |||
| 4008 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp | binary | |
MD5:— | SHA256:— | |||
| 4008 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json | binary | |
MD5:— | SHA256:— | |||
| 4008 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm | binary | |
MD5:— | SHA256:— | |||
| 4008 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js | text | |
MD5:— | SHA256:— | |||
| 4008 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js | text | |
MD5:— | SHA256:— | |||
| 4008 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm | binary | |
MD5:— | SHA256:— | |||
| 4008 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm | binary | |
MD5:— | SHA256:— | |||
| 4008 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm | binary | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4008 | firefox.exe | GET | 301 | 172.64.198.14:80 | http://sendspace.com/file/cd7458 | unknown | — | — | unknown |
4008 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | unknown | — | — | unknown |
4008 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | — | — | unknown |
4008 | firefox.exe | POST | 200 | 95.101.54.130:80 | http://r3.o.lencr.org/ | unknown | — | — | unknown |
4008 | firefox.exe | POST | 200 | 142.250.185.195:80 | http://ocsp.pki.goog/gts1c3 | unknown | — | — | unknown |
4008 | firefox.exe | POST | 200 | 95.101.54.130:80 | http://r3.o.lencr.org/ | unknown | — | — | unknown |
4008 | firefox.exe | POST | 200 | 95.101.54.130:80 | http://r3.o.lencr.org/ | unknown | — | — | unknown |
4008 | firefox.exe | POST | 200 | 142.250.185.195:80 | http://ocsp.pki.goog/gts1c3 | unknown | — | — | unknown |
4008 | firefox.exe | POST | — | 95.101.54.130:80 | http://r3.o.lencr.org/ | unknown | — | — | unknown |
4008 | firefox.exe | POST | — | 95.101.54.130:80 | http://r3.o.lencr.org/ | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
4008 | firefox.exe | 142.250.184.234:443 | safebrowsing.googleapis.com | — | — | whitelisted |
4008 | firefox.exe | 172.64.198.14:80 | sendspace.com | CLOUDFLARENET | US | unknown |
4008 | firefox.exe | 142.250.185.195:80 | ocsp.pki.goog | GOOGLE | US | whitelisted |
4008 | firefox.exe | 172.64.198.14:443 | sendspace.com | — | — | unknown |
4008 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | GOOGLE | US | whitelisted |
4008 | firefox.exe | 34.107.243.93:443 | push.services.mozilla.com | GOOGLE | US | unknown |
Domain | IP | Reputation |
|---|---|---|
sendspace.com |
| unknown |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
contile.services.mozilla.com |
| whitelisted |
spocs.getpocket.com |
| shared |
example.org |
| whitelisted |
ipv4only.arpa |
| whitelisted |
prod.ads.prod.webservices.mozgcp.net |
| unknown |
r3.o.lencr.org |
| shared |
firefox.settings.services.mozilla.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
1080 | svchost.exe | Misc activity | ET INFO Commonly Abused File Sharing Site Domain Observed (sendspace .com in DNS Lookup) |
1080 | svchost.exe | Misc activity | ET INFO Commonly Abused File Sharing Site Domain Observed (sendspace .com in DNS Lookup) |
1080 | svchost.exe | Misc activity | ET INFO Commonly Abused File Sharing Site Domain Observed (sendspace .com in DNS Lookup) |
1080 | svchost.exe | Misc activity | ET INFO Commonly Abused File Sharing Site Domain Observed (sendspace .com in DNS Lookup) |
1080 | svchost.exe | Misc activity | ET INFO Commonly Abused File Sharing Site Domain Observed (sendspace .com in DNS Lookup) |
4008 | firefox.exe | Misc activity | ET INFO Commonly Abused File Sharing Site Domain Observed (sendspace .com in TLS SNI) |
4008 | firefox.exe | Not Suspicious Traffic | INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net) |