| URL: | http://segal-lawfirm.com |
| Full analysis: | https://app.any.run/tasks/c337468d-4116-4b79-aea4-eca26a7c58a7 |
| Verdict: | Malicious activity |
| Analysis date: | March 29, 2024, 19:38:52 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | 544F8704557A4F64B49010C1D9701CA6 |
| SHA1: | 5B939F30C0E1C6B380CE2DD7F44FB8ABB425B7D5 |
| SHA256: | 602B395893E1CF78137404BC17BDDFD8D981D6AFCF7C7AE59BFA07F53E4CF277 |
| SSDEEP: | 3:N1KNACNeXIZIn:CSCNeJ |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 584 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3956.7.1970452838\1899119251" -childID 6 -isForBrowser -prefsHandle 4068 -prefMapHandle 3748 -prefsLen 29206 -prefMapSize 244195 -jsInitHandle 912 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {da5258fc-8caa-4a74-9c28-137627c2faad} 3956 "\\.\pipe\gecko-crash-server-pipe.3956" 3584 18086f70 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1336 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3956.13.714169396\274244361" -parentBuildID 20230710165010 -sandboxingKind 1 -prefsHandle 4596 -prefMapHandle 4652 -prefsLen 36639 -prefMapSize 244195 -appDir "C:\Program Files\Mozilla Firefox\browser" - {52be2b77-bad3-4ddc-98f3-80c8bed7043e} 3956 "\\.\pipe\gecko-crash-server-pipe.3956" 4648 17de6330 utility | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 1852 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3956.20.580056920\1818528789" -childID 16 -isForBrowser -prefsHandle 7552 -prefMapHandle 7556 -prefsLen 31256 -prefMapSize 244195 -jsInitHandle 912 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f98d257-b288-43bc-b5e6-34bd63a1e49a} 3956 "\\.\pipe\gecko-crash-server-pipe.3956" 3016 18e09560 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 2064 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3956.1.118333821\1609706193" -parentBuildID 20230710165010 -prefsHandle 1412 -prefMapHandle 1408 -prefsLen 28600 -prefMapSize 244195 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2901776-7c9c-4cdc-b8b2-99d69de3619b} 3956 "\\.\pipe\gecko-crash-server-pipe.3956" 1424 ed45010 socket | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 2136 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3956.22.652200981\857686647" -childID 18 -isForBrowser -prefsHandle 3988 -prefMapHandle 1648 -prefsLen 31256 -prefMapSize 244195 -jsInitHandle 912 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cea9cb2a-4828-4552-a610-a96f123e7161} 3956 "\\.\pipe\gecko-crash-server-pipe.3956" 3924 1c78b840 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 2360 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3956.17.706270869\2049171598" -childID 13 -isForBrowser -prefsHandle 7916 -prefMapHandle 7924 -prefsLen 31256 -prefMapSize 244195 -jsInitHandle 912 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0934b06-5296-44c9-8bcc-582f942a6cff} 3956 "\\.\pipe\gecko-crash-server-pipe.3956" 7904 1b5bf3f0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2568 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3956.5.233007285\1179382534" -childID 4 -isForBrowser -prefsHandle 3812 -prefMapHandle 3700 -prefsLen 29102 -prefMapSize 244195 -jsInitHandle 912 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d0bf9de-0416-4114-b5ae-b7523228e7bc} 3956 "\\.\pipe\gecko-crash-server-pipe.3956" 3796 17d559b0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2588 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3956.4.2088991171\530077080" -childID 3 -isForBrowser -prefsHandle 3704 -prefMapHandle 3628 -prefsLen 29102 -prefMapSize 244195 -jsInitHandle 912 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b7c8c4e-a2ab-4c09-aa62-292d04f1cf7b} 3956 "\\.\pipe\gecko-crash-server-pipe.3956" 3716 1384c9b0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2764 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3956.19.31450381\462626542" -childID 15 -isForBrowser -prefsHandle 3752 -prefMapHandle 3636 -prefsLen 31256 -prefMapSize 244195 -jsInitHandle 912 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d1a46b3-0736-4ee5-a4e0-9d4939e7045c} 3956 "\\.\pipe\gecko-crash-server-pipe.3956" 3744 1aa30560 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 2808 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3956.6.161008384\1947629737" -childID 5 -isForBrowser -prefsHandle 3892 -prefMapHandle 3748 -prefsLen 34225 -prefMapSize 244195 -jsInitHandle 912 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb520361-81ed-4111-a423-db4b2ba15c25} 3956 "\\.\pipe\gecko-crash-server-pipe.3956" 3920 17d55b20 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| (PID) Process: | (4008) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Launcher |
Value: 6E05495101000000 | |||
| (PID) Process: | (3956) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Browser |
Value: F6434B5101000000 | |||
| (PID) Process: | (3956) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Installer\308046B0AF4A39CB |
| Operation: | delete value | Name: | installer.taskbarpin.win10.enabled |
Value: | |||
| (PID) Process: | (3956) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry |
Value: 0 | |||
| (PID) Process: | (3956) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
| (PID) Process: | (3956) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Theme |
Value: 1 | |||
| (PID) Process: | (3956) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Enabled |
Value: 1 | |||
| (PID) Process: | (3956) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableTelemetry |
Value: 1 | |||
| (PID) Process: | (3956) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent |
Value: 0 | |||
| (PID) Process: | (3956) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|SetDefaultBrowserUserChoice |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3956 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.bin | binary | |
MD5:— | SHA256:— | |||
| 3956 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm | binary | |
MD5:— | SHA256:— | |||
| 3956 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp | binary | |
MD5:— | SHA256:— | |||
| 3956 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json | binary | |
MD5:— | SHA256:— | |||
| 3956 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm | binary | |
MD5:— | SHA256:— | |||
| 3956 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js | text | |
MD5:— | SHA256:— | |||
| 3956 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js | text | |
MD5:— | SHA256:— | |||
| 3956 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm | binary | |
MD5:— | SHA256:— | |||
| 3956 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm | binary | |
MD5:— | SHA256:— | |||
| 3956 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm | binary | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3956 | firefox.exe | POST | 200 | 142.250.184.227:80 | http://ocsp.pki.goog/gts1c3 | unknown | — | — | unknown |
3956 | firefox.exe | POST | 200 | 184.24.77.46:80 | http://r3.o.lencr.org/ | unknown | — | — | unknown |
3956 | firefox.exe | POST | 200 | 184.24.77.46:80 | http://r3.o.lencr.org/ | unknown | — | — | unknown |
3956 | firefox.exe | POST | 200 | 184.24.77.46:80 | http://r3.o.lencr.org/ | unknown | — | — | unknown |
3956 | firefox.exe | POST | 200 | 184.24.77.46:80 | http://r3.o.lencr.org/ | unknown | — | — | unknown |
3956 | firefox.exe | POST | 200 | 184.24.77.46:80 | http://r3.o.lencr.org/ | unknown | — | — | unknown |
3956 | firefox.exe | POST | 200 | 184.24.77.46:80 | http://r3.o.lencr.org/ | unknown | — | — | unknown |
3956 | firefox.exe | POST | 200 | 184.24.77.46:80 | http://r3.o.lencr.org/ | unknown | — | — | unknown |
3956 | firefox.exe | POST | 200 | 184.24.77.46:80 | http://r3.o.lencr.org/ | unknown | — | — | unknown |
3956 | firefox.exe | POST | 200 | 184.24.77.46:80 | http://r3.o.lencr.org/ | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
3956 | firefox.exe | 107.180.25.36:80 | segal-lawfirm.com | AS-26496-GO-DADDY-COM-LLC | US | unknown |
3956 | firefox.exe | 142.250.186.74:443 | safebrowsing.googleapis.com | — | — | whitelisted |
3956 | firefox.exe | 34.117.188.166:443 | spocs.getpocket.com | — | — | unknown |
3956 | firefox.exe | 192.124.249.41:80 | ocsp.godaddy.com | SUCURI-SEC | US | unknown |
3956 | firefox.exe | 34.107.243.93:443 | push.services.mozilla.com | — | — | unknown |
3956 | firefox.exe | 142.250.184.227:80 | ocsp.pki.goog | GOOGLE | US | whitelisted |
3956 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | GOOGLE | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
segal-lawfirm.com |
| unknown |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
ipv4only.arpa |
| whitelisted |
example.org |
| whitelisted |
contile.services.mozilla.com |
| whitelisted |
spocs.getpocket.com |
| shared |
prod.ads.prod.webservices.mozgcp.net |
| unknown |
firefox.settings.services.mozilla.com |
| whitelisted |
prod.remote-settings.prod.webservices.mozgcp.net |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
2064 | firefox.exe | Misc activity | ET INFO Session Traversal Utilities for NAT (STUN Binding Request) |
2064 | firefox.exe | Misc activity | ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port) |
2064 | firefox.exe | Misc activity | ET INFO Session Traversal Utilities for NAT (STUN Binding Request) |
— | — | Misc activity | ET INFO Session Traversal Utilities for NAT (STUN Binding Request) |
— | — | Misc activity | ET INFO Session Traversal Utilities for NAT (STUN Binding Request) |
3956 | firefox.exe | Not Suspicious Traffic | INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code.jquery .com) |