analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://spotify-br.com/?code=lyVLBxsp

Full analysis: https://app.any.run/tasks/bf017a65-3008-43d2-b4aa-1026c1889f67
Verdict: Malicious activity
Analysis date: April 14, 2019, 16:04:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

BEE6B7C56C6193F251E6035F8665FC83

SHA1:

8970EDF09AB7B5FED15B78215A0D92171ED7E8EB

SHA256:

808C47EE6CFC5AC581FA29E9F9D52967453785AB6E9B042D501A6CC7E3D83CF7

SSDEEP:

3:N1KNVQQOSfWVn:CwQrqn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 304)

  • INFO

    • Reads CPU info

      • firefox.exe (PID: 1500)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • firefox.exe (PID: 2820)

    • Application launched itself

      • firefox.exe (PID: 1500)
      • chrome.exe (PID: 304)

    • Dropped object may contain Bitcoin addresses

      • chrome.exe (PID: 304)
      • firefox.exe (PID: 1500)

    • Reads settings of System Certificates

      • chrome.exe (PID: 3112)
      • firefox.exe (PID: 1500)

    • Creates files in the user directory

      • firefox.exe (PID: 1500)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
72
Monitored processes
41
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1500"C:\Program Files\Mozilla Firefox\firefox.exe" http://spotify-br.com/?code=lyVLBxspC:\Program Files\Mozilla Firefox\firefox.exe
explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
65.0.2
1768"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.0.189117376\242254238" -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - "C:\Users\admin\AppData\LocalLow\Mozilla\Temp-{ce348e4c-7d33-445e-89f9-60108c51bcaf}" 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 1120 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
65.0.2
2820"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.6.384889732\1905584541" -childID 1 -isForBrowser -prefsHandle 1624 -prefMapHandle 1580 -prefsLen 1 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 1700 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
65.0.2
2244"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.13.1421258999\615181371" -childID 2 -isForBrowser -prefsHandle 2536 -prefMapHandle 2548 -prefsLen 216 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 2468 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
65.0.2
1344"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.20.1154051895\40314560" -childID 3 -isForBrowser -prefsHandle 3328 -prefMapHandle 3416 -prefsLen 5824 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 3428 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
65.0.2
304"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
73.0.3683.75
3932"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=73.0.3683.75 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6c8e0f18,0x6c8e0f28,0x6c8e0f34C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
73.0.3683.75
3196"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=1740 --on-initialized-event-handle=308 --parent-handle=312 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
73.0.3683.75
3020"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=964,6194532380574416350,10434561395773722813,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwAAAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=14345591068537769267 --mojo-platform-channel-handle=952 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Version:
73.0.3683.75
3112"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=964,6194532380574416350,10434561395773722813,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=14995952155955606138 --mojo-platform-channel-handle=1504 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
73.0.3683.75
Total events
1 599
Read events
1 453
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
441
Text files
589
Unknown types
98

Dropped files

PID
Process
Filename
Type
1500firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
1500firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js —
MD5:—
SHA256:—
1500firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp —
MD5:—
SHA256:—
1500firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-current.binbinary
MD5:82F61C08D68502377826CA7EA054CEA7
SHA256:85801BCE5D7CE3A2ABC14E3208151AC9D324A6EA82FB2ADA1D10BAA8EF58E7DF
1500firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:79262A046A800BC3C3125FF94893CC51
SHA256:EA78CB0E02CA9BD0DC9AE055B82486E63ED4643A53717970A20D5FED7D18A51E
1500firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:C52C31E2D546FC217645CD7F542CF3E0
SHA256:73974F60357B038693803F51CA750E9ED609A3376548C88C117FA1FCBB328236
1500firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\entries\DDEDA7D0965523D2AFA47FFC58005886CEF51E20compressed
MD5:9E7A10DD2C8ECBF412F5DA4F1C5B63F9
SHA256:0367F109EA6445736F6FE8727D1C2E67A1B54FA9C9B5B114D9AAE9AB312D37C7
1500firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\except-flashsubdoc-digest256.sbstore —
MD5:—
SHA256:—
1500firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\block-flash-digest256.sbstorebinary
MD5:0E8FE60CCD7E9B4C32589A5743A95302
SHA256:2B124D4026850A3CFFD28DBACB58AEC28F7DCD4D40BC14E52BBE96D60CE4E749
1500firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\except-flash-digest256.sbstorebinary
MD5:C921D8E98FA01B4F303481E112202E92
SHA256:4EF1038730EC8BC7206713C29A936768831B922C5E6C83355FD62D7401D8C1DC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
81
TCP/UDP connections
175
DNS requests
205
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1500
firefox.exe
GET
200
34.207.109.250:80
http://whatsapp-cores.com/install.html
US
html
43.1 Kb
unknown
1500
firefox.exe
GET
200
3.86.233.115:80
http://spotify-br.com/?code=lyVLBxsp
US
html
3.93 Kb
unknown
1500
firefox.exe
GET
200
34.207.109.250:80
http://whatsapp-cores.com/files/codigos_install.js
US
text
1.02 Kb
unknown
1500
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
1500
firefox.exe
POST
200
2.21.242.245:80
http://ocsp.int-x3.letsencrypt.org/
NL
der
527 b
whitelisted
1500
firefox.exe
GET
200
2.16.186.112:80
http://detectportal.firefox.com/success.txt
unknown
text
8 b
whitelisted
1500
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
1500
firefox.exe
GET
200
104.111.214.175:80
http://ak.staticimgfarm.com/images/webtooltab/ttdetect-2/prd/ttDetectUtil.js
NL
text
3.81 Kb
whitelisted
1500
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
1500
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1500
firefox.exe
2.16.186.112:80
detectportal.firefox.com
Akamai International B.V.
—
whitelisted
1500
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1500
firefox.exe
172.217.18.10:443
fonts.googleapis.com
Google Inc.
US
whitelisted
1500
firefox.exe
13.32.159.2:443
snippets.cdn.mozilla.net
Amazon.com, Inc.
US
unknown
1500
firefox.exe
52.26.103.165:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
1500
firefox.exe
104.111.214.175:443
ak.staticimgfarm.com
Akamai International B.V.
NL
whitelisted
1500
firefox.exe
172.217.21.234:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
1500
firefox.exe
104.111.214.175:80
ak.staticimgfarm.com
Akamai International B.V.
NL
whitelisted
1500
firefox.exe
34.207.109.250:80
whatsapp-cores.com
Amazon.com, Inc.
US
unknown
1500
firefox.exe
3.86.233.115:80
spotify-br.com
—
US
unknown

DNS requests

Domain
IP
Reputation
spotify-br.com
  • 3.86.233.115
unknown
detectportal.firefox.com
  • 2.16.186.112
  • 2.16.186.50
whitelisted
a1089.dscd.akamai.net
  • 35.244.218.203
  • 2.16.186.112
  • 2.16.186.50
whitelisted
search.services.mozilla.com
  • 35.166.112.39
  • 34.213.175.109
  • 52.88.150.81
whitelisted
search.r53-2.services.mozilla.com
  • 52.88.150.81
  • 34.213.175.109
  • 35.166.112.39
whitelisted
tiles.services.mozilla.com
  • 52.26.103.165
  • 52.35.250.5
  • 35.165.22.140
  • 52.10.122.55
  • 52.39.131.77
  • 52.34.132.219
  • 35.164.197.9
  • 35.164.130.113
whitelisted
tiles.r53-2.services.mozilla.com
  • 35.164.130.113
  • 35.164.197.9
  • 52.34.132.219
  • 52.39.131.77
  • 52.10.122.55
  • 35.165.22.140
  • 52.35.250.5
  • 52.26.103.165
whitelisted
snippets.cdn.mozilla.net
  • 13.32.159.2
whitelisted
drcwo519tnci7.cloudfront.net
  • 13.32.159.2
shared
href.li
  • 192.0.78.27
  • 192.0.78.26
shared

Threats

PID
Process
Class
Message
1500
firefox.exe
Generic Protocol Command Decode
SURICATA STREAM reassembly overlap with different data
1500
firefox.exe
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
1500
firefox.exe
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Response)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://spotify-br.com/?code=lyVLBxsp