analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

fannieae.txt

Full analysis: https://app.any.run/tasks/56de553b-36a1-4cec-b88b-cfa609215724
Verdict: Malicious activity
Analysis date: June 11, 2019, 23:43:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with no line terminators
MD5:

09CFCC0B8FFF906E9BAAB5833D57F3F6

SHA1:

D3DBA26A5F17924491BA21E7CF27C26ED9F16AA6

SHA256:

952059D0CA44FC5AB3B221188A7C6BCBB953825E75D53460C37DA122564B8F07

SSDEEP:

3:O0EL4hhn:OpWhn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Creates files in the program directory

      • firefox.exe (PID: 3576)
    • Executable content was dropped or overwritten

      • firefox.exe (PID: 3576)
  • INFO

    • Manual execution by user

      • firefox.exe (PID: 3576)
    • Application launched itself

      • firefox.exe (PID: 3576)
    • Reads settings of System Certificates

      • firefox.exe (PID: 3576)
    • Reads CPU info

      • firefox.exe (PID: 3576)
    • Dropped object may contain Bitcoin addresses

      • firefox.exe (PID: 3576)
    • Creates files in the user directory

      • firefox.exe (PID: 3576)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
6
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start notepad.exe no specs firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe

Process information

PID
CMD
Path
Indicators
Parent process
3320"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\fannieae.txtC:\Windows\system32\NOTEPAD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3576"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe
explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
65.0.2
2832"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3576.0.1491389032\1622747598" -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - "C:\Users\admin\AppData\LocalLow\Mozilla\Temp-{ce348e4c-7d33-445e-89f9-60108c51bcaf}" 3576 "\\.\pipe\gecko-crash-server-pipe.3576" 1128 gpuC:\Program Files\Mozilla Firefox\firefox.exefirefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
65.0.2
932"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3576.6.1995306759\233697120" -childID 1 -isForBrowser -prefsHandle 1264 -prefMapHandle 1564 -prefsLen 1 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3576 "\\.\pipe\gecko-crash-server-pipe.3576" 1744 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
65.0.2
2464"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3576.13.1101328626\2065260777" -childID 2 -isForBrowser -prefsHandle 2588 -prefMapHandle 2592 -prefsLen 216 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3576 "\\.\pipe\gecko-crash-server-pipe.3576" 2604 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
65.0.2
2592"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3576.20.2033764110\2015061080" -childID 3 -isForBrowser -prefsHandle 3416 -prefMapHandle 3420 -prefsLen 5824 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3576 "\\.\pipe\gecko-crash-server-pipe.3576" 3432 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
65.0.2
Total events
1 043
Read events
1 031
Write events
12
Delete events
0

Modification events

(PID) Process:(3576) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3576) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000071000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3576) firefox.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
1
Suspicious files
98
Text files
34
Unknown types
74

Dropped files

PID
Process
Filename
Type
3576firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin
MD5:
SHA256:
3576firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\trash5087
MD5:
SHA256:
3576firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js
MD5:
SHA256:
3576firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp
MD5:
SHA256:
3576firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm
MD5:
SHA256:
3576firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-current.binbinary
MD5:82F61C08D68502377826CA7EA054CEA7
SHA256:85801BCE5D7CE3A2ABC14E3208151AC9D324A6EA82FB2ADA1D10BAA8EF58E7DF
3576firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:8F89A5889E1615F65674DAF6A01A2454
SHA256:F6D3FDE91836D607A3311A6E0A12463C811F791A9F231D2FF8542D772FA22ED7
3576firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\entries\A4F58CBF6889E0B35C633F4612D52C30FADF3B72der
MD5:22DBBEBECD8D1DBF7D7FF6FBC15D4994
SHA256:ACB8A7E3B2EB5A0EF80E983D1B345C0321F05B42C7744C615B32D5EB2FFF96F2
3576firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\block-flashsubdoc-digest256.sbstorebinary
MD5:04824A1F92353F43EBB9E7F74B7476FD
SHA256:B48E58EBAB82E4C376F16150A3FFF850C1111FF1F5985D68819CFD6F0DB159D2
3576firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\base-track-digest256.sbstorebinary
MD5:23E438FD4AF1829D4469FF8D0BC83854
SHA256:96E0D7644AEA81D26F039AE633EB405583E11B020363090DAC5CAD9B4B188846
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
53
TCP/UDP connections
63
DNS requests
142
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3576
firefox.exe
GET
302
103.224.182.252:80
http://12puvapp01.fannieae.com/
AU
suspicious
3576
firefox.exe
GET
200
216.58.207.68:80
http://www.google.com/adsense/domains/caf.js
US
text
55.7 Kb
whitelisted
3576
firefox.exe
GET
200
199.59.242.151:80
http://ww25.12puvapp01.fannieae.com/glp?r=&u=http%3A%2F%2Fww25.12puvapp01.fannieae.com%2F&rw=1280&rh=720&ww=1280&wh=587
US
text
7.90 Kb
malicious
3576
firefox.exe
POST
200
172.217.23.131:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3576
firefox.exe
GET
404
199.59.242.151:80
http://ww25.12puvapp01.fannieae.com/favicon.ico
US
html
3.93 Kb
malicious
3576
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3576
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3576
firefox.exe
GET
200
199.59.242.151:80
http://ww25.12puvapp01.fannieae.com/
US
html
3.93 Kb
malicious
3576
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3576
firefox.exe
POST
200
199.59.242.151:80
http://ww25.12puvapp01.fannieae.com/gzb
US
text
94 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3576
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3576
firefox.exe
172.217.21.234:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
3576
firefox.exe
52.88.72.192:443
shavar.services.mozilla.com
Amazon.com, Inc.
US
unknown
3576
firefox.exe
172.217.23.131:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3576
firefox.exe
172.217.22.42:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3576
firefox.exe
35.164.130.113:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
3576
firefox.exe
143.204.173.62:443
snippets.cdn.mozilla.net
US
unknown
3576
firefox.exe
199.59.242.151:80
ww25.12puvapp01.fannieae.com
Bodis, LLC
US
malicious
103.224.182.252:80
12puvapp01.fannieae.com
Trellian Pty. Limited
AU
unknown
3576
firefox.exe
216.58.207.68:80
www.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 88.221.144.128
  • 88.221.144.105
  • 2.16.186.112
  • 2.16.186.50
whitelisted
aus5.mozilla.org
  • 52.34.120.127
  • 52.40.226.98
  • 34.218.159.169
  • 52.34.127.169
  • 52.35.34.27
  • 54.213.5.202
  • 52.43.79.30
  • 35.161.58.143
  • 35.165.116.96
whitelisted
balrog-aus5.r53-2.services.mozilla.com
  • 35.161.58.143
  • 52.43.79.30
  • 54.213.5.202
  • 52.35.34.27
  • 52.34.127.169
  • 34.218.159.169
  • 52.40.226.98
  • 52.34.120.127
  • 35.165.116.96
whitelisted
a1089.dscd.akamai.net
  • 88.221.144.105
  • 88.221.144.128
  • 2.16.186.50
  • 2.16.186.112
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
cs9.wac.phicdn.net
  • 93.184.220.29
whitelisted
search.services.mozilla.com
  • 54.190.222.97
  • 52.11.30.237
  • 34.215.70.240
whitelisted
search.r53-2.services.mozilla.com
  • 34.215.70.240
  • 52.11.30.237
  • 54.190.222.97
whitelisted
tiles.services.mozilla.com
  • 35.164.130.113
  • 52.26.103.165
  • 34.210.151.118
  • 34.208.138.0
  • 54.186.163.246
  • 52.25.71.236
  • 34.213.89.114
  • 34.209.86.85
whitelisted
tiles.r53-2.services.mozilla.com
  • 34.209.86.85
  • 34.213.89.114
  • 52.25.71.236
  • 54.186.163.246
  • 34.208.138.0
  • 34.210.151.118
  • 52.26.103.165
  • 35.164.130.113
whitelisted

Threats

No threats detected
No debug info