analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://cas5.z9.web.core.windows.net/outlook/index.html#[email protected]

Full analysis: https://app.any.run/tasks/f7d355ec-8bbd-4913-b348-16165e7156c8
Verdict: Malicious activity
Analysis date: July 11, 2019, 15:52:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

E3897EA5DFD837114491BB6809666BF8

SHA1:

07A8D2913E263C75F4B3EF3BC1B595A01B517C02

SHA256:

660F8A7D7E5A5CEF5F30A3431834FA8B6D46BC9745113C8A0050E9780CA0439A

SSDEEP:

3:N8ZWAcmiLdNXfKIRE2LWB2+SMMK:2o53ZhKIRER2/MMK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 2440)

  • SUSPICIOUS

    • Creates files in the program directory

      • firefox.exe (PID: 3700)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 3700)

  • INFO

    • Reads CPU info

      • firefox.exe (PID: 3700)
      • firefox.exe (PID: 3116)

    • Application launched itself

      • firefox.exe (PID: 3116)
      • firefox.exe (PID: 3700)

    • Creates files in the user directory

      • firefox.exe (PID: 3116)
      • firefox.exe (PID: 3700)

    • Dropped object may contain TOR URL's

      • firefox.exe (PID: 3700)

    • Dropped object may contain Bitcoin addresses

      • firefox.exe (PID: 3700)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
18
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe pingsender.exe pingsender.exe pingsender.exe firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe firefox.exe firefox.exe firefox.exe firefox.exe searchprotocolhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3116"C:\Program Files\Mozilla Firefox\firefox.exe" https://cas5.z9.web.core.windows.net/outlook/index.html#[email protected]C:\Program Files\Mozilla Firefox\firefox.exe
explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
67.0.4
1048"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3116.0.1212313205\1889868271" -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3116 "\\.\pipe\gecko-crash-server-pipe.3116" 1184 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
67.0.4
1956"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3116.3.1714865492\612318419" -childID 1 -isForBrowser -prefsHandle 1860 -prefMapHandle 1840 -prefsLen 1 -prefMapSize 188076 -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3116 "\\.\pipe\gecko-crash-server-pipe.3116" 1728 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
67.0.4
2452"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3116.13.153283209\203408658" -childID 2 -isForBrowser -prefsHandle 2700 -prefMapHandle 2684 -prefsLen 5842 -prefMapSize 188076 -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3116 "\\.\pipe\gecko-crash-server-pipe.3116" 2712 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
67.0.4
3736"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3116.20.290223304\1871584221" -childID 3 -isForBrowser -prefsHandle 2628 -prefMapHandle 3464 -prefsLen 6604 -prefMapSize 188076 -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3116 "\\.\pipe\gecko-crash-server-pipe.3116" 3536 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
67.0.4
2024"C:\Program Files\Mozilla Firefox\pingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/9da1a7c3-1179-4169-b3fc-dc9d697c3ada/event/Firefox/67.0.4/release/20190619235627?v=4 C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\9da1a7c3-1179-4169-b3fc-dc9d697c3adaC:\Program Files\Mozilla Firefox\pingsender.exe
firefox.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
0
Version:
67.0.4
3720"C:\Program Files\Mozilla Firefox\pingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/dba68d9d-8584-4def-b795-2ace7262b57b/health/Firefox/67.0.4/release/20190619235627?v=4 C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\dba68d9d-8584-4def-b795-2ace7262b57bC:\Program Files\Mozilla Firefox\pingsender.exe
firefox.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
0
Version:
67.0.4
4080"C:\Program Files\Mozilla Firefox\pingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/aa991d84-dbf5-47cd-8e60-08199e421302/main/Firefox/67.0.4/release/20190619235627?v=4 C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\aa991d84-dbf5-47cd-8e60-08199e421302C:\Program Files\Mozilla Firefox\pingsender.exe
firefox.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
0
Version:
67.0.4
3700"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
67.0.4
2844"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3700.0.1356245008\2114986093" -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3700 "\\.\pipe\gecko-crash-server-pipe.3700" 1088 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
67.0.4
Total events
1 809
Read events
1 760
Write events
48
Delete events
1

Modification events

(PID) Process:(3116) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
0000000000000000
(PID) Process:(3116) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3116) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000078000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3700) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
0000000000000000
(PID) Process:(2024) pingsender.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2024) pingsender.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000079000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3720) pingsender.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3720) pingsender.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000007A000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(4080) pingsender.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(4080) pingsender.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000007B000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
Executable files
4
Suspicious files
162
Text files
137
Unknown types
216

Dropped files

PID
Process
Filename
Type
3116firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
3116firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pluginreg.dat.tmp —
MD5:—
SHA256:—
3116firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js —
MD5:—
SHA256:—
3116firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp —
MD5:—
SHA256:—
3116firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm —
MD5:—
SHA256:—
3116firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.tmp —
MD5:—
SHA256:—
3116firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pluginreg.dattext
MD5:37818D9B7248F34395C2DB3C0BD4B07F
SHA256:FF229E03D2AB696E81957957EA8D71280B5800A2B0F70EA77998C3FA4E98A8A6
3116firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4jsonlz4
MD5:03E22F63EA4BE5ADD7AEF9050D485611
SHA256:0B5A2BCD1EDF7EE6252F04B41403E0BC21F2EEDF7CBAA6565F6562238C771C13
3116firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-current.binbinary
MD5:6A1EF5C5AE2F682A0606848FA329072B
SHA256:29312A09916820DEC3EEE29B40C503FEE9569204E291320BD9C908B3386B1896
3116firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:FD4AC055B608CF2C11C9B2C796A4FE1A
SHA256:1D8A349613F7DCB71BF648C8C7F780F3953A2BC53435846289101FD77D8887AF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
64
DNS requests
115
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3116
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3700
firefox.exe
POST
200
216.58.208.35:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3700
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3700
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3116
firefox.exe
GET
200
2.16.186.50:80
http://detectportal.firefox.com/success.txt
unknown
text
8 b
whitelisted
3700
firefox.exe
GET
200
2.16.186.112:80
http://detectportal.firefox.com/success.txt
unknown
text
8 b
whitelisted
3116
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3116
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3116
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3700
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3116
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3116
firefox.exe
34.218.52.26:443
push.services.mozilla.com
Amazon.com, Inc.
US
unknown
3116
firefox.exe
2.16.186.112:80
detectportal.firefox.com
Akamai International B.V.
—
whitelisted
3116
firefox.exe
172.217.16.202:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
3116
firefox.exe
34.251.59.153:443
location.services.mozilla.com
Amazon.com, Inc.
IE
unknown
3116
firefox.exe
52.239.189.1:443
cas5.z9.web.core.windows.net
Microsoft Corporation
CA
unknown
3116
firefox.exe
13.224.192.58:443
snippets.cdn.mozilla.net
—
US
unknown
3116
firefox.exe
52.11.30.237:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
3116
firefox.exe
52.43.91.152:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
3116
firefox.exe
34.243.21.190:443
location.services.mozilla.com
Amazon.com, Inc.
IE
unknown

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 2.16.186.112
  • 2.16.186.50
whitelisted
a1089.dscd.akamai.net
  • 2.16.186.50
  • 2.16.186.112
whitelisted
location.services.mozilla.com
  • 34.251.59.153
  • 52.18.148.152
  • 34.243.21.190
whitelisted
locprod1-elb-eu-west-1.prod.mozaws.net
  • 34.243.21.190
  • 52.18.148.152
  • 34.251.59.153
whitelisted
cas5.z9.web.core.windows.net
  • 52.239.189.1
unknown
push.services.mozilla.com
  • 34.218.52.26
  • 54.213.45.184
whitelisted
autopush.prod.mozaws.net
  • 34.218.52.26
  • 54.213.45.184
whitelisted
web.yt1prdstr06a.store.core.windows.net
  • 52.239.189.1
unknown
tiles.services.mozilla.com
  • 52.43.91.152
  • 52.27.87.181
  • 52.26.166.58
  • 52.34.132.219
  • 52.35.96.157
  • 52.42.232.148
  • 52.26.103.165
  • 54.186.163.246
  • 34.208.138.0
  • 34.210.151.118
  • 34.209.86.85
  • 54.186.90.148
whitelisted
tiles.r53-2.services.mozilla.com
  • 54.186.163.246
  • 52.26.103.165
  • 52.42.232.148
  • 52.35.96.157
  • 52.34.132.219
  • 52.26.166.58
  • 52.27.87.181
  • 52.43.91.152
  • 54.186.90.148
  • 34.209.86.85
  • 34.210.151.118
  • 34.208.138.0
whitelisted

Threats

No threats detected
No debug info