analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://aka.ms/o0ukef

Full analysis: https://app.any.run/tasks/c37abd13-4241-45f4-9537-4742f7baa0d6
Verdict: Malicious activity
Analysis date: January 17, 2019, 20:31:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

2B609225F2799A491773A9FB7E846B1B

SHA1:

EBB5354FF2A25278E2EBD68DB23B3F24DF1018B9

SHA256:

4DFC29D70091BA71C1988253EC42181D1D3374ECA496E6A3A0FE7DD5FA0DF9FD

SSDEEP:

3:N8O8WKKVK:2O8NT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Reads CPU info

      • firefox.exe (PID: 2400)
      • firefox.exe (PID: 2864)
      • firefox.exe (PID: 2156)
      • firefox.exe (PID: 1244)
    • Application launched itself

      • firefox.exe (PID: 2864)
    • Creates files in the user directory

      • firefox.exe (PID: 2864)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
4
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start firefox.exe firefox.exe firefox.exe firefox.exe

Process information

PID
CMD
Path
Indicators
Parent process
2864"C:\Program Files\Mozilla Firefox\firefox.exe" https://aka.ms/o0ukefC:\Program Files\Mozilla Firefox\firefox.exe
explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
61.0.2
2400"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2864.0.1907529621\1609618617" -childID 1 -isForBrowser -prefsHandle 1376 -prefsLen 8310 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 1460 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
61.0.2
1244"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2864.6.248971301\1058499419" -childID 2 -isForBrowser -prefsHandle 2544 -prefsLen 11442 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 2560 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
61.0.2
2156"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2864.12.1594092730\1014574154" -childID 3 -isForBrowser -prefsHandle 2924 -prefsLen 12017 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 2976 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
61.0.2
Total events
142
Read events
140
Write events
2
Delete events
0

Modification events

(PID) Process:(2864) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2864) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
Executable files
0
Suspicious files
45
Text files
24
Unknown types
43

Dropped files

PID
Process
Filename
Type
2864firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp
MD5:
SHA256:
2864firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js
MD5:
SHA256:
2864firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm
MD5:
SHA256:
2864firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db-journal
MD5:
SHA256:
2864firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm
MD5:
SHA256:
2864firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:707C12070C52E55C2A996AC15E219B95
SHA256:6C5410C655C8EFC48D123ABE708C8940A4218072C0DAF85E03AB45DA6D2CE6B9
2864firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\entries\1FE27D306FDA0D4222975AF6B07EA565DF5762CEder
MD5:FD445A620F57D948122953B94BEE4677
SHA256:39131306AABE1AFF0476DB6DC7F6AED32584D9A511C3BFA7367BE6BD7BA8D53D
2864firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\block-flashsubdoc-digest256.sbstorebinary
MD5:04824A1F92353F43EBB9E7F74B7476FD
SHA256:B48E58EBAB82E4C376F16150A3FFF850C1111FF1F5985D68819CFD6F0DB159D2
2864firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\entries\55F3A8141B0F01292545EBF09A1E053D6C64205Bbinary
MD5:E013BBDA98E00E2E46D8C680340381EC
SHA256:6073C3C1FFD070A41BD0DD032447F3A16FC68B228DB461E6C33A614D51D83139
2864firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\doomed\29665binary
MD5:2B47F318FDCFABF9B88818D1F266B6CA
SHA256:552E9205F11D8BED37E6D3C068CD7393893CACAE4F21D922E895FB26B3191A54
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
27
DNS requests
51
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2864
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2864
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2864
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2864
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2864
firefox.exe
POST
200
104.18.24.243:80
http://ocsp.msocsp.com/
US
der
1.79 Kb
whitelisted
2864
firefox.exe
GET
200
2.16.186.112:80
http://detectportal.firefox.com/success.txt
unknown
text
8 b
whitelisted
2864
firefox.exe
GET
200
2.16.186.112:80
http://detectportal.firefox.com/success.txt
unknown
text
8 b
whitelisted
2864
firefox.exe
POST
200
172.217.22.14:80
http://ocsp.pki.goog/GTSGIAG3
US
der
463 b
whitelisted
2864
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2864
firefox.exe
POST
200
104.18.24.243:80
http://ocsp.msocsp.com/
US
der
1.79 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2864
firefox.exe
172.217.18.10:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
2864
firefox.exe
2.16.186.112:80
detectportal.firefox.com
Akamai International B.V.
whitelisted
2864
firefox.exe
172.217.22.14:80
ocsp.pki.goog
Google Inc.
US
whitelisted
2864
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2864
firefox.exe
178.162.219.61:443
app.adjust.com
Leaseweb Deutschland GmbH
DE
unknown
2864
firefox.exe
34.214.85.136:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
2864
firefox.exe
152.199.19.161:443
ol.azureedge.net
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2864
firefox.exe
23.206.100.171:443
aka.ms
Akamai Technologies, Inc.
NL
whitelisted
2864
firefox.exe
34.216.89.123:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
2864
firefox.exe
52.43.79.30:443
aus5.mozilla.org
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 2.16.186.112
  • 2.16.186.50
  • 104.107.216.169
  • 104.107.216.187
whitelisted
aka.ms
  • 23.206.100.171
whitelisted
a1089.dscd.akamai.net
  • 2.16.186.50
  • 2.16.186.112
  • 104.107.216.187
  • 104.107.216.169
whitelisted
ocsp.msocsp.com
  • 104.18.24.243
  • 104.18.25.243
whitelisted
ocsp.globalsign.cloud
  • 104.18.25.243
  • 104.18.24.243
whitelisted
search.services.mozilla.com
  • 34.216.89.123
  • 52.27.184.151
  • 52.89.32.107
whitelisted
search.r53-2.services.mozilla.com
  • 52.89.32.107
  • 52.27.184.151
  • 34.216.89.123
whitelisted
tiles.services.mozilla.com
  • 34.214.85.136
  • 52.43.40.243
  • 54.218.239.186
  • 34.209.108.219
  • 34.216.156.21
  • 34.215.13.51
  • 54.187.46.234
  • 34.208.7.98
whitelisted
tiles.r53-2.services.mozilla.com
  • 34.208.7.98
  • 54.187.46.234
  • 34.215.13.51
  • 34.216.156.21
  • 34.209.108.219
  • 54.218.239.186
  • 52.43.40.243
  • 34.214.85.136
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

No threats detected
No debug info