URL: | https://primewire.tf |
Full analysis: | https://app.any.run/tasks/315808db-5487-4559-9b21-d4fd9ead7700 |
Verdict: | Malicious activity |
Analysis date: | August 21, 2023, 13:29:27 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 881F7665F6222EC47793C5C6CE038130 |
SHA1: | 4B26F7BF5B313FCD9F086ADC33DFCA11F460E994 |
SHA256: | 92B3B5F5000B1A50473F8F20F116FC2B04F26B1B3514422731CB562B6B5C4793 |
SSDEEP: | 3:N8TMwWul:2BWul |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
692 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.7.1670507174\1056361600" -childID 6 -isForBrowser -prefsHandle 4248 -prefMapHandle 4252 -prefsLen 29011 -prefMapSize 243955 -jsInitHandle 908 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3414d6d-8fac-46cf-b37d-68efaad219c7} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 4236 223bb110 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
1132 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.12.2008110875\387042912" -childID 11 -isForBrowser -prefsHandle 7712 -prefMapHandle 2604 -prefsLen 31681 -prefMapSize 243955 -jsInitHandle 908 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e3c58c4-415a-4e14-abd1-e2a4c617ba8c} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 7752 12244560 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
1388 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.8.294323664\1438018792" -childID 7 -isForBrowser -prefsHandle 3972 -prefMapHandle 3984 -prefsLen 31517 -prefMapSize 243955 -jsInitHandle 908 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d95439f3-cddd-4391-b9cf-83a7747f7ca5} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 8172 223c9280 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
1768 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.14.1728074419\1337916422" -parentBuildID 20230710165010 -sandboxingKind 1 -prefsHandle 4004 -prefMapHandle 3964 -prefsLen 37131 -prefMapSize 243955 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98b298bb-cfa4-4b5a-9cf3-f4aab8678ee5} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 8176 28a20910 utility | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
1936 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.0.995553799\1920998556" -parentBuildID 20230710165010 -prefsHandle 1116 -prefMapHandle 1108 -prefsLen 28025 -prefMapSize 243955 -appDir "C:\Program Files\Mozilla Firefox\browser" - {960c729a-b724-44b2-91e3-91244c3c8660} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 1188 dae0f20 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
2028 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.2.405138911\384145226" -childID 1 -isForBrowser -prefsHandle 1632 -prefMapHandle 2052 -prefsLen 24255 -prefMapSize 243955 -jsInitHandle 908 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b25749c-0368-42e8-9a58-9064e2b167a8} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 2060 12d6fe00 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
2392 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.5.585956498\1442520859" -childID 4 -isForBrowser -prefsHandle 3932 -prefMapHandle 3936 -prefsLen 29011 -prefMapSize 243955 -jsInitHandle 908 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e73962d4-10c9-4175-b468-0f1045de6ecd} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 3948 220a8e00 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
2404 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.1.955028453\1762646424" -parentBuildID 20230710165010 -prefsHandle 1428 -prefMapHandle 1424 -prefsLen 28102 -prefMapSize 243955 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba7451a0-2dd6-4656-a8c1-2994befaef8e} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 1440 da27f40 socket | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
2492 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.9.1771286930\1827026908" -childID 8 -isForBrowser -prefsHandle 3192 -prefMapHandle 3924 -prefsLen 31681 -prefMapSize 243955 -jsInitHandle 908 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c714afa-fc81-446f-b832-538be425f385} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 4164 12aef3f0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
2588 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.6.432490024\1209140951" -childID 5 -isForBrowser -prefsHandle 4080 -prefMapHandle 4084 -prefsLen 29011 -prefMapSize 243955 -jsInitHandle 908 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f555173f-3378-4a66-a3a0-c49275f03cb5} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 4068 220a8f70 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
|
(PID) Process: | (3868) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Launcher |
Value: 815441AB02000000 | |||
(PID) Process: | (3636) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Browser |
Value: B73F42AB02000000 | |||
(PID) Process: | (3636) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry |
Value: 0 | |||
(PID) Process: | (3636) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
(PID) Process: | (3636) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Theme |
Value: 1 | |||
(PID) Process: | (3636) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Enabled |
Value: 1 | |||
(PID) Process: | (3636) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableTelemetry |
Value: 1 | |||
(PID) Process: | (3636) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent |
Value: 0 | |||
(PID) Process: | (3636) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox|SetDefaultBrowserUserChoice |
Value: 1 | |||
(PID) Process: | (3636) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox|AppLastRunTime |
Value: EA362D0F13B0D901 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3636 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin | — | |
MD5:— | SHA256:— | |||
3636 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-current.bin | binary | |
MD5:B801EAD6CCEAE6F6F3C1A313631B5831 | SHA256:62B29F3316F95F92B1F95BD758D20D605C0242CC71D08AAA531D0E3FEC0657A9 | |||
3636 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
3636 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.bin | binary | |
MD5:098201E7EEFBB94E6D50BEC41D1C3C03 | SHA256:4C7455DE1E410148C659EF5765F1555CC379742906F79558AB6A6AFBDDC7A462 | |||
3636 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
3636 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
3636 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js | text | |
MD5:33B1483937C16FDFD0FEE1AF8E9746F0 | SHA256:E6280203750BB80548B14CA76986983950D872ECE01044CC936E97153F04B372 | |||
3636 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-new.bin | — | |
MD5:— | SHA256:— | |||
3636 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache.bin | — | |
MD5:— | SHA256:— | |||
3636 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js | text | |
MD5:33B1483937C16FDFD0FEE1AF8E9746F0 | SHA256:E6280203750BB80548B14CA76986983950D872ECE01044CC936E97153F04B372 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3636 | firefox.exe | GET | — | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | US | — | — | whitelisted |
3636 | firefox.exe | GET | — | 23.55.161.185:80 | http://ciscobinary.openh264.org/openh264-win32-31c4d2e4a037526fd30d4e5c39f60885986cf865.zip | US | — | — | whitelisted |
3636 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | US | text | 90 b | whitelisted |
3636 | firefox.exe | POST | 200 | 95.101.54.131:80 | http://r3.o.lencr.org/ | DE | der | 503 b | shared |
3636 | firefox.exe | POST | 200 | 95.101.54.131:80 | http://r3.o.lencr.org/ | DE | der | 503 b | shared |
3636 | firefox.exe | POST | 200 | 142.250.185.131:80 | http://ocsp.pki.goog/gts1c3 | US | der | 472 b | whitelisted |
3636 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | US | text | 8 b | whitelisted |
3636 | firefox.exe | POST | — | 142.250.185.131:80 | http://ocsp.pki.goog/gts1c3 | US | — | — | whitelisted |
3636 | firefox.exe | POST | 200 | 95.101.54.131:80 | http://r3.o.lencr.org/ | DE | der | 503 b | shared |
3636 | firefox.exe | POST | 200 | 54.192.87.164:80 | http://ocsp.r2m02.amazontrust.com/ | US | der | 471 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3636 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | GOOGLE | US | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
3284 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
3636 | firefox.exe | 188.114.96.3:443 | primewire.tf | CLOUDFLARENET | NL | malicious |
3636 | firefox.exe | 172.217.16.202:443 | safebrowsing.googleapis.com | — | — | whitelisted |
3636 | firefox.exe | 34.160.144.191:443 | content-signature-2.cdn.mozilla.net | GOOGLE | US | suspicious |
3636 | firefox.exe | 34.117.65.55:443 | push.services.mozilla.com | — | — | suspicious |
3636 | firefox.exe | 34.120.115.102:443 | contile-images.services.mozilla.com | GOOGLE-CLOUD-PLATFORM | US | unknown |
3636 | firefox.exe | 3.82.68.133:443 | spocs.getpocket.com | AMAZON-AES | US | unknown |
3636 | firefox.exe | 34.117.237.239:443 | contile.services.mozilla.com | GOOGLE-CLOUD-PLATFORM | US | suspicious |
Domain | IP | Reputation |
---|---|---|
primewire.tf |
| malicious |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
contile.services.mozilla.com |
| whitelisted |
spocs.getpocket.com |
| shared |
proxyserverecs-1736642167.us-east-1.elb.amazonaws.com |
| shared |
firefox.settings.services.mozilla.com |
| whitelisted |
prod.remote-settings.prod.webservices.mozgcp.net |
| whitelisted |
safebrowsing.googleapis.com |
| whitelisted |
push.services.mozilla.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Misc activity | ET INFO Observed ZeroSSL SSL/TLS Certificate |