URL: | http://marketingnawebonline9.com/blogs?E4O38AK65I5M38AL62C3M27DRYDWI/PDF_NF-e257478 |
Full analysis: | https://app.any.run/tasks/09cc8586-8690-42eb-9c3c-cd2e157a97e6 |
Verdict: | Malicious activity |
Threats: | Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email. |
Analysis date: | April 23, 2019, 15:17:47 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MD5: | 57FB83CE99A1D2B548E5C4A2C0894117 |
SHA1: | 5B9F4EC18508FC42DDF100F2D24D4A9B0C3B113A |
SHA256: | 48F6A1E6DD91587FB93DE47A16352E7677CE1B08EB09412A53014FF2C53C6B6C |
SSDEEP: | 3:N1KTxAwCLEHcMRGKIKLWdd9xCqh8ksKK4AXQb:C1yucMRGKIiWddbC88lq |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2512 | "C:\Program Files\Mozilla Firefox\firefox.exe" http://marketingnawebonline9.com/blogs?E4O38AK65I5M38AL62C3M27DRYDWI/PDF_NF-e257478 | C:\Program Files\Mozilla Firefox\firefox.exe | explorer.exe | |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 65.0.2 | ||||
3452 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2512.0.1773809081\22279402" -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - "C:\Users\admin\AppData\LocalLow\Mozilla\Temp-{ce348e4c-7d33-445e-89f9-60108c51bcaf}" 2512 "\\.\pipe\gecko-crash-server-pipe.2512" 1084 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 65.0.2 | ||||
3276 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2512.6.618469142\1727288943" -childID 1 -isForBrowser -prefsHandle 1272 -prefMapHandle 1264 -prefsLen 1 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2512 "\\.\pipe\gecko-crash-server-pipe.2512" 1700 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 65.0.2 | ||||
788 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2512.13.1488248039\490315826" -childID 2 -isForBrowser -prefsHandle 1928 -prefMapHandle 2560 -prefsLen 216 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2512 "\\.\pipe\gecko-crash-server-pipe.2512" 2592 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 65.0.2 | ||||
1304 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2512.20.805371995\1555858596" -childID 3 -isForBrowser -prefsHandle 3356 -prefMapHandle 3360 -prefsLen 5824 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2512 "\\.\pipe\gecko-crash-server-pipe.2512" 3372 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 65.0.2 | ||||
2508 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Downloads\schemasDOCX.msi" | C:\Windows\System32\msiexec.exe | — | firefox.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
2292 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
768 | C:\Windows\system32\MsiExec.exe -Embedding 0E31DF54865115A432A86EF3DBA58EFC | C:\Windows\system32\MsiExec.exe | — | msiexec.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
3648 | "C:\Windows\Installer\MSIC870.tmp" | C:\Windows\Installer\MSIC870.tmp | msiexec.exe | |
User: admin Integrity Level: MEDIUM Description: AMGZ2 Version: 1.0.0.0 | ||||
3600 | "C:\Users\admin\AppData\Roaming\Microsoft\50BF93C898B1474FA96C3E354C514452\E1X2m0e9e6.cmd" | C:\Users\admin\AppData\Roaming\Microsoft\50BF93C898B1474FA96C3E354C514452\E1X2m0e9e6.cmd | MSIC870.tmp | |
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Version: 8.0.1910.12 |
(PID) Process: | (2512) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
(PID) Process: | (2512) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
Operation: | write | Name: | SavedLegacySettings |
Value: 4600000071000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000 | |||
(PID) Process: | (2512) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (2512) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (2512) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.msi\OpenWithProgids |
Operation: | write | Name: | Msi.Package |
Value: | |||
(PID) Process: | (2512) firefox.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2512) firefox.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | @C:\Windows\System32\msimsg.dll,-36 |
Value: &Install | |||
(PID) Process: | (2512) firefox.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | @C:\Windows\System32\msimsg.dll,-37 |
Value: Re&pair | |||
(PID) Process: | (2512) firefox.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | @C:\Windows\System32\msimsg.dll,-38 |
Value: &Uninstall | |||
(PID) Process: | (2512) firefox.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | @C:\Windows\System32\msimsg.dll,-34 |
Value: Windows Installer Package |
PID | Process | Filename | Type | |
---|---|---|---|---|
2512 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin | — | |
MD5:— | SHA256:— | |||
2512 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\trash1567 | — | |
MD5:— | SHA256:— | |||
2512 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js | — | |
MD5:— | SHA256:— | |||
2512 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp | — | |
MD5:— | SHA256:— | |||
2512 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm | — | |
MD5:— | SHA256:— | |||
2512 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\block-flash-digest256.pset | — | |
MD5:— | SHA256:— | |||
2512 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\block-flash-digest256.sbstore | — | |
MD5:— | SHA256:— | |||
2512 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\block-flashsubdoc-digest256.pset | — | |
MD5:— | SHA256:— | |||
2512 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\block-flashsubdoc-digest256.sbstore | — | |
MD5:— | SHA256:— | |||
2512 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\except-flash-digest256.pset | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2512 | firefox.exe | GET | 301 | 145.239.28.18:80 | http://marketingnawebonline9.com/blogs?E4O38AK65I5M38AL62C3M27DRYDWI/PDF_NF-e257478 | PL | html | 292 b | unknown |
3648 | MSIC870.tmp | POST | 200 | 137.135.111.89:80 | http://livekernelreports.duckdns.org/ups/ | US | — | — | malicious |
2512 | firefox.exe | POST | 200 | 172.217.23.163:80 | http://ocsp.pki.goog/GTSGIAG3 | US | der | 471 b | whitelisted |
2512 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2512 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2512 | firefox.exe | POST | 200 | 172.217.23.163:80 | http://ocsp.pki.goog/GTSGIAG3 | US | der | 471 b | whitelisted |
2512 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2512 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2512 | firefox.exe | POST | 200 | 172.217.23.163:80 | http://ocsp.pki.goog/GTSGIAG3 | US | der | 471 b | whitelisted |
2512 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2512 | firefox.exe | 52.27.229.90:443 | search.services.mozilla.com | Amazon.com, Inc. | US | unknown |
2512 | firefox.exe | 173.223.11.150:80 | detectportal.firefox.com | Akamai International B.V. | NL | whitelisted |
2512 | firefox.exe | 54.192.202.54:443 | snippets.cdn.mozilla.net | Amazon.com, Inc. | US | unknown |
2512 | firefox.exe | 145.239.28.18:80 | marketingnawebonline9.com | OVH SAS | PL | unknown |
2512 | firefox.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2512 | firefox.exe | 52.35.250.5:443 | tiles.services.mozilla.com | Amazon.com, Inc. | US | unknown |
2512 | firefox.exe | 162.125.66.1:443 | www.dropbox.com | Dropbox, Inc. | DE | shared |
2512 | firefox.exe | 172.217.22.74:443 | safebrowsing.googleapis.com | Google Inc. | US | whitelisted |
2512 | firefox.exe | 172.217.23.163:80 | ocsp.pki.goog | Google Inc. | US | whitelisted |
2512 | firefox.exe | 172.217.23.174:443 | sb-ssl.google.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
detectportal.firefox.com |
| whitelisted |
marketingnawebonline9.com |
| unknown |
a1089.dscd.akamai.net |
| whitelisted |
search.services.mozilla.com |
| whitelisted |
search.r53-2.services.mozilla.com |
| whitelisted |
tiles.services.mozilla.com |
| whitelisted |
tiles.r53-2.services.mozilla.com |
| whitelisted |
snippets.cdn.mozilla.net |
| whitelisted |
drcwo519tnci7.cloudfront.net |
| shared |
ocsp.digicert.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
— | — | Potentially Bad Traffic | ET INFO DNS Query for Suspicious .ml Domain |
3648 | MSIC870.tmp | A Network Trojan was detected | ET TROJAN [eSentire] Win32/Spy.Banker CnC Command (DOWNLOAD) |
3648 | MSIC870.tmp | A Network Trojan was detected | MALWARE [PTsecurity] Trojan-Spy.Win32.Delf(Banload) response |
3648 | MSIC870.tmp | A Network Trojan was detected | MALWARE [PTsecurity] Trojan-Spy.Win32.Delf(Banload) request |