analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://2.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/445d4f65-271f-455b-a525-0e7fb9aa895d?P1=1562690353&P2=402&P3=2&P4=kkabvacZj7vzS%2bBAtN82B0zHthUcMsHTnISfbOqoaf96XQQnDwRj5d9%2fsxWDqr0IA4ChcoVTIJmrZSs1Qa5GZw%3d%3d

Full analysis: https://app.any.run/tasks/d69dc6a4-08aa-4a2f-8ce7-4690d59e656f
Verdict: Malicious activity
Analysis date: July 11, 2019, 12:44:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

F8B1ECF95482D823F5CC3A2758943208

SHA1:

C4F3A3A71456DAD1C62D9F3E1447F654B69D2585

SHA256:

94C9FBF4B8D89BC6579BD737D360F6D9B928F5544AA5FB25E516EE204494F35A

SSDEEP:

6:27JedFIeeDMkh2D235AxfI60XQx0uRCx4VH:2NTeeDMg2G5AxfI6ucH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 3140)
  • INFO

    • Application launched itself

      • firefox.exe (PID: 3140)
    • Reads CPU info

      • firefox.exe (PID: 3140)
    • Creates files in the user directory

      • firefox.exe (PID: 3140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
5
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe

Process information

PID
CMD
Path
Indicators
Parent process
3140"C:\Program Files\Mozilla Firefox\firefox.exe" https://2.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/445d4f65-271f-455b-a525-0e7fb9aa895d?P1=1562690353&P2=402&P3=2&P4=kkabvacZj7vzS%2bBAtN82B0zHthUcMsHTnISfbOqoaf96XQQnDwRj5d9%2fsxWDqr0IA4ChcoVTIJmrZSs1Qa5GZw%3d%3dC:\Program Files\Mozilla Firefox\firefox.exe
explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
67.0.4
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2436"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3140.0.1212313205\1889868271" -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3140 "\\.\pipe\gecko-crash-server-pipe.3140" 1180 gpuC:\Program Files\Mozilla Firefox\firefox.exefirefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
67.0.4
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
3176"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3140.3.1714865492\612318419" -childID 1 -isForBrowser -prefsHandle 1336 -prefMapHandle 1756 -prefsLen 1 -prefMapSize 188076 -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3140 "\\.\pipe\gecko-crash-server-pipe.3140" 836 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
67.0.4
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1676"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3140.13.153283209\203408658" -childID 2 -isForBrowser -prefsHandle 2724 -prefMapHandle 2728 -prefsLen 5842 -prefMapSize 188076 -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3140 "\\.\pipe\gecko-crash-server-pipe.3140" 2736 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
67.0.4
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1800"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3140.20.686865194\290223304" -childID 3 -isForBrowser -prefsHandle 3448 -prefMapHandle 3612 -prefsLen 6564 -prefMapSize 188076 -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3140 "\\.\pipe\gecko-crash-server-pipe.3140" 3596 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
67.0.4
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
Total events
563
Read events
560
Write events
3
Delete events
0

Modification events

(PID) Process:(3140) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
0000000000000000
(PID) Process:(3140) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3140) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000078000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
Executable files
2
Suspicious files
65
Text files
28
Unknown types
52

Dropped files

PID
Process
Filename
Type
3140firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin
MD5:
SHA256:
3140firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm
MD5:
SHA256:
3140firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pluginreg.dat.tmp
MD5:
SHA256:
3140firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js
MD5:
SHA256:
3140firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp
MD5:
SHA256:
3140firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.tmp
MD5:
SHA256:
3140firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:D65B2BD591A1D6CC666241E6EEF1AFE7
SHA256:1B94F69A3BF3CB9F7349FE274CA82166C22D675F9B043B19F2770D044AE9BD16
3140firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:FD4AC055B608CF2C11C9B2C796A4FE1A
SHA256:1D8A349613F7DCB71BF648C8C7F780F3953A2BC53435846289101FD77D8887AF
3140firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4jsonlz4
MD5:03E22F63EA4BE5ADD7AEF9050D485611
SHA256:0B5A2BCD1EDF7EE6252F04B41403E0BC21F2EEDF7CBAA6565F6562238C771C13
3140firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-current.binbinary
MD5:6A1EF5C5AE2F682A0606848FA329072B
SHA256:29312A09916820DEC3EEE29B40C503FEE9569204E291320BD9C908B3386B1896
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
30
DNS requests
81
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3140
firefox.exe
GET
200
23.62.98.18:80
http://detectportal.firefox.com/success.txt
NL
text
8 b
whitelisted
3140
firefox.exe
POST
200
216.58.213.131:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3140
firefox.exe
GET
200
23.62.98.18:80
http://detectportal.firefox.com/success.txt
NL
text
8 b
whitelisted
3140
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3140
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3140
firefox.exe
POST
200
216.58.213.131:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3140
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3140
firefox.exe
POST
200
216.58.213.131:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3140
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3140
firefox.exe
GET
200
88.221.134.155:80
http://ciscobinary.openh264.org/openh264-win32-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
unknown
compressed
479 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3140
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3140
firefox.exe
23.62.98.18:80
detectportal.firefox.com
Akamai International B.V.
NL
whitelisted
3140
firefox.exe
95.101.39.10:443
2.tlu.dl.delivery.mp.microsoft.com
Akamai International B.V.
whitelisted
3140
firefox.exe
52.34.132.219:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
3140
firefox.exe
34.243.21.190:443
location.services.mozilla.com
Amazon.com, Inc.
IE
unknown
3140
firefox.exe
52.85.254.108:443
snippets.cdn.mozilla.net
Amazon.com, Inc.
US
unknown
3140
firefox.exe
172.217.19.234:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
3140
firefox.exe
52.33.98.91:443
push.services.mozilla.com
Amazon.com, Inc.
US
unknown
3140
firefox.exe
216.58.213.131:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3140
firefox.exe
88.221.134.155:80
ciscobinary.openh264.org
Akamai International B.V.
whitelisted

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 23.62.98.18
whitelisted
location.services.mozilla.com
  • 34.243.21.190
whitelisted
push.services.mozilla.com
  • 52.33.98.91
whitelisted
2.tlu.dl.delivery.mp.microsoft.com
  • 95.101.39.10
whitelisted
tiles.services.mozilla.com
  • 52.34.132.219
whitelisted
snippets.cdn.mozilla.net
  • 52.85.254.108
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
safebrowsing.googleapis.com
  • 172.217.19.234
whitelisted
ocsp.pki.goog
  • 216.58.213.131
whitelisted
support.mozilla.org
  • 52.39.170.29
whitelisted

Threats

No threats detected
No debug info