URL: | https://dw.malavida.com/dUZEdWdWOGtMS1p0R0NlckVRaU9Zc2ZZUkJkM1RSeGVCNnErWEVHWFppcGxnRXBWQTkyQTdpRWh2alMvbXRMbW55USthN/nFFUmEyTHVUSWRhU2FaTkpBNVhNdmZidjdBUVp2cHhPaElkOG9Wa0w1b1luRDFGRWlYRHl6a0dwazY3b3cvekdkM3JIc2/pOaGMzQk53aVk3UWhFc3ZMUE5mY2ZIM21WN1BDdG1pK1Ard2RReXk3ZWxFaGpjZmF2MDhnbjhKTHBhNTY3Mm9iaWl5ZWN/6dmpiTzBPTzNaQ2NFT0VpL0R5TFpULzN2cFY1UW1KWmQxVUJDMmZIUmZEeTFNM1lKc25xM05ETnB1dkgrc1JBT0NQYUpD/dUxwL2gyeWR6Yk9JRk5tZUFXMGZGcXNralA3bDB4a2NmaTNNVGlUYk5NVWJ2U2xLYUJGRlFMbHpaaEdoMDc1ZHpQMERud/2NWVmhpcDBRU3dLTmZlSmZXZUcvbU90TFN0amhId0RHYTFUS0JyLzVCWjhVQ0FtdENDWnR0QUlKdXdMdzMxYkwzbVRXUD/Y4NTN1WnpmalE5Z09zT0JoMjYrRC9SVDF6dFlnblIwZ1M0NElXRmVKOSt0RG9aaXhVYTlHVEhEVzVaaWJPSjdEamxoSEZ/lMVBPV3JrUytqTHpJZlVXemZJdklqeHliWDFJTmFhNjI5c2pKZ1hwUmozUmd2MkxTNG9FRmFhckM2TFk2SkJ0cnVjPQ==/ad8e351919b3e37c |
Full analysis: | https://app.any.run/tasks/0c2e4690-8160-4c3d-b910-f723d2cf16e3 |
Verdict: | Malicious activity |
Analysis date: | January 24, 2022, 15:52:49 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 0E28074631A48E1F6A92178D534F5AFF |
SHA1: | 0F1B3D90E9FB844DFE135D578B78EBFCAAB460A1 |
SHA256: | 96498876CAEC5B073DF226DE1F39FA4E8CE0D18EF304F3B03162C7E6D16B4F20 |
SSDEEP: | 12:2NVaZocEM2JinxVK6EJRqChoY+SZZmZiXGHRu/NTmT6a2Jx0dBxmHkr3mj1n:2NVaSgxwtJRFCYfZb24aT+x0xI4y |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1528 | "C:\Program Files\Mozilla Firefox\firefox.exe" "https://dw.malavida.com/dUZEdWdWOGtMS1p0R0NlckVRaU9Zc2ZZUkJkM1RSeGVCNnErWEVHWFppcGxnRXBWQTkyQTdpRWh2alMvbXRMbW55USthN/nFFUmEyTHVUSWRhU2FaTkpBNVhNdmZidjdBUVp2cHhPaElkOG9Wa0w1b1luRDFGRWlYRHl6a0dwazY3b3cvekdkM3JIc2/pOaGMzQk53aVk3UWhFc3ZMUE5mY2ZIM21WN1BDdG1pK1Ard2RReXk3ZWxFaGpjZmF2MDhnbjhKTHBhNTY3Mm9iaWl5ZWN/6dmpiTzBPTzNaQ2NFT0VpL0R5TFpULzN2cFY1UW1KWmQxVUJDMmZIUmZEeTFNM1lKc25xM05ETnB1dkgrc1JBT0NQYUpD/dUxwL2gyeWR6Yk9JRk5tZUFXMGZGcXNralA3bDB4a2NmaTNNVGlUYk5NVWJ2U2xLYUJGRlFMbHpaaEdoMDc1ZHpQMERud/2NWVmhpcDBRU3dLTmZlSmZXZUcvbU90TFN0amhId0RHYTFUS0JyLzVCWjhVQ0FtdENDWnR0QUlKdXdMdzMxYkwzbVRXUD/Y4NTN1WnpmalE5Z09zT0JoMjYrRC9SVDF6dFlnblIwZ1M0NElXRmVKOSt0RG9aaXhVYTlHVEhEVzVaaWJPSjdEamxoSEZ/lMVBPV3JrUytqTHpJZlVXemZJdklqeHliWDFJTmFhNjI5c2pKZ1hwUmozUmd2MkxTNG9FRmFhckM2TFk2SkJ0cnVjPQ==/ad8e351919b3e37c" | C:\Program Files\Mozilla Firefox\firefox.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
2684 | "C:\Program Files\Mozilla Firefox\firefox.exe" https://dw.malavida.com/dUZEdWdWOGtMS1p0R0NlckVRaU9Zc2ZZUkJkM1RSeGVCNnErWEVHWFppcGxnRXBWQTkyQTdpRWh2alMvbXRMbW55USthN/nFFUmEyTHVUSWRhU2FaTkpBNVhNdmZidjdBUVp2cHhPaElkOG9Wa0w1b1luRDFGRWlYRHl6a0dwazY3b3cvekdkM3JIc2/pOaGMzQk53aVk3UWhFc3ZMUE5mY2ZIM21WN1BDdG1pK1Ard2RReXk3ZWxFaGpjZmF2MDhnbjhKTHBhNTY3Mm9iaWl5ZWN/6dmpiTzBPTzNaQ2NFT0VpL0R5TFpULzN2cFY1UW1KWmQxVUJDMmZIUmZEeTFNM1lKc25xM05ETnB1dkgrc1JBT0NQYUpD/dUxwL2gyeWR6Yk9JRk5tZUFXMGZGcXNralA3bDB4a2NmaTNNVGlUYk5NVWJ2U2xLYUJGRlFMbHpaaEdoMDc1ZHpQMERud/2NWVmhpcDBRU3dLTmZlSmZXZUcvbU90TFN0amhId0RHYTFUS0JyLzVCWjhVQ0FtdENDWnR0QUlKdXdMdzMxYkwzbVRXUD/Y4NTN1WnpmalE5Z09zT0JoMjYrRC9SVDF6dFlnblIwZ1M0NElXRmVKOSt0RG9aaXhVYTlHVEhEVzVaaWJPSjdEamxoSEZ/lMVBPV3JrUytqTHpJZlVXemZJdklqeHliWDFJTmFhNjI5c2pKZ1hwUmozUmd2MkxTNG9FRmFhckM2TFk2SkJ0cnVjPQ==/ad8e351919b3e37c | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
2084 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2684.0.151875765\873926639" -parentBuildID 20201112153044 -prefsHandle 1132 -prefMapHandle 1124 -prefsLen 1 -prefMapSize 238726 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2684 "\\.\pipe\gecko-crash-server-pipe.2684" 1216 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
2828 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2684.6.387868949\1239252718" -childID 1 -isForBrowser -prefsHandle 3028 -prefMapHandle 3024 -prefsLen 181 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2684 "\\.\pipe\gecko-crash-server-pipe.2684" 3040 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
3616 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2684.13.1282496374\1262695998" -childID 2 -isForBrowser -prefsHandle 2476 -prefMapHandle 2544 -prefsLen 6644 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2684 "\\.\pipe\gecko-crash-server-pipe.2684" 2416 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
1148 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2684.20.43508919\805132292" -childID 3 -isForBrowser -prefsHandle 3312 -prefMapHandle 2080 -prefsLen 7307 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2684 "\\.\pipe\gecko-crash-server-pipe.2684" 3432 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
1060 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2684.27.1172406357\2099999806" -childID 4 -isForBrowser -prefsHandle 2080 -prefMapHandle 3476 -prefsLen 7307 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2684 "\\.\pipe\gecko-crash-server-pipe.2684" 3576 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
3196 | "C:\Users\admin\Downloads\ChromeSetup.exe" | C:\Users\admin\Downloads\ChromeSetup.exe | firefox.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Update Setup Version: 1.3.36.112 Modules
| |||||||||||||||
2532 | C:\Users\admin\AppData\Local\Temp\GUMD46D.tmp\GoogleUpdate.exe /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={BAAA2717-2879-488F-B915-902DEA091C2F}&lang=es&browser=3&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" | C:\Users\admin\AppData\Local\Temp\GUMD46D.tmp\GoogleUpdate.exe | — | ChromeSetup.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Installer Version: 1.3.36.111 Modules
| |||||||||||||||
3956 | "C:\Users\admin\AppData\Local\Temp\GUMD46D.tmp\GoogleUpdateSetup.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={BAAA2717-2879-488F-B915-902DEA091C2F}&lang=es&browser=3&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installelevated /nomitag | C:\Users\admin\AppData\Local\Temp\GUMD46D.tmp\GoogleUpdateSetup.exe | GoogleUpdate.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: HIGH Description: Google Update Setup Version: 1.3.36.112 Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
2684 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin | — | |
MD5:— | SHA256:— | |||
2684 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-new.bin | — | |
MD5:— | SHA256:— | |||
2684 | firefox.exe | C:\Users\admin\AppData\Local\Temp\mz_etilqs_8S84Yt5wNzbHgQv | binary | |
MD5:BA7170ED996F161B36D08B0A63D6F428 | SHA256:FC6C95893ED897774B0914E43B19A46067B9CDD8C3F0D5E3E9937023CE067FA1 | |||
2684 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\recovery.jsonlz4.tmp | jsonlz4 | |
MD5:220CCCE0FD1B9DD0B8443DE251D7E350 | SHA256:7C1855A10A50415E9962DEE7315B3B2DF7C56901A2E9697D5660B97DC8A41389 | |||
2684 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache.bin | — | |
MD5:— | SHA256:— | |||
2684 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache.bin | binary | |
MD5:8E42F9C065937C0FB7CEB7328A0A7B1C | SHA256:4AE9EBBE38C213D35D58F2C2D4B3C1B3A43D3674C63FA0AEF540CBF592CAB87B | |||
2684 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal | binary | |
MD5:E1B4AB4838E45DD2EB612DBF042D0CAE | SHA256:F1F2E386D4DCE06D659CC109D45B2F464E12742A8FB4B6FA87DFE9C2341E7672 | |||
2684 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite | — | |
MD5:— | SHA256:— | |||
2684 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
2684 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\recovery.jsonlz4 | jsonlz4 | |
MD5:220CCCE0FD1B9DD0B8443DE251D7E350 | SHA256:7C1855A10A50415E9962DEE7315B3B2DF7C56901A2E9697D5660B97DC8A41389 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
884 | svchost.exe | HEAD | 403 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome/jskl2vqav7llvnpswum2rlzxee_97.0.4692.99/97.0.4692.99_chrome_installer.exe | US | — | — | whitelisted |
884 | svchost.exe | HEAD | 403 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome/jskl2vqav7llvnpswum2rlzxee_97.0.4692.99/97.0.4692.99_chrome_installer.exe | US | — | — | whitelisted |
884 | svchost.exe | HEAD | 200 | 173.194.135.104:80 | http://r3---sn-aigzrn7z.gvt1.com/edgedl/release2/chrome/jskl2vqav7llvnpswum2rlzxee_97.0.4692.99/97.0.4692.99_chrome_installer.exe?cms_redirect=yes&mh=Pg&mip=85.203.46.147&mm=28&mn=sn-aigzrn7z&ms=nvh&mt=1643039309&mv=m&mvi=3&pl=25&shardbypass=yes&smhost=r3---sn-aigzrn76.gvt1.com | US | — | — | whitelisted |
884 | svchost.exe | GET | — | 173.194.135.104:80 | http://r3---sn-aigzrn7z.gvt1.com/edgedl/release2/chrome/jskl2vqav7llvnpswum2rlzxee_97.0.4692.99/97.0.4692.99_chrome_installer.exe?cms_redirect=yes&mh=Pg&mip=85.203.46.147&mm=28&mn=sn-aigzrn7z&ms=nvh&mt=1643039309&mv=m&mvi=3&pl=25&shardbypass=yes&smhost=r3---sn-aigzrn76.gvt1.com | US | — | — | whitelisted |
884 | svchost.exe | HEAD | 302 | 142.250.186.142:80 | http://redirector.gvt1.com/edgedl/release2/chrome/jskl2vqav7llvnpswum2rlzxee_97.0.4692.99/97.0.4692.99_chrome_installer.exe | US | — | — | whitelisted |
2684 | firefox.exe | POST | 200 | 142.250.186.67:80 | http://ocsp.pki.goog/gts1c3 | US | der | 472 b | whitelisted |
2684 | firefox.exe | POST | 200 | 104.18.31.182:80 | http://ocsp.sectigo.com/ | US | der | 472 b | whitelisted |
2684 | firefox.exe | POST | 200 | 142.250.186.67:80 | http://ocsp.pki.goog/gts1c3 | US | der | 472 b | whitelisted |
2684 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | US | text | 8 b | whitelisted |
2684 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | US | text | 8 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2684 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | — | US | whitelisted |
2684 | firefox.exe | 18.66.139.28:443 | firefox.settings.services.mozilla.com | Massachusetts Institute of Technology | US | suspicious |
2684 | firefox.exe | 142.250.186.42:443 | safebrowsing.googleapis.com | Google Inc. | US | whitelisted |
2684 | firefox.exe | 5.145.168.100:443 | dw.malavida.com | Comvive Servidores S.L. | ES | unknown |
2684 | firefox.exe | 142.250.186.67:80 | ocsp.pki.goog | Google Inc. | US | whitelisted |
2684 | firefox.exe | 18.66.139.67:443 | content-signature-2.cdn.mozilla.net | Massachusetts Institute of Technology | US | suspicious |
2684 | firefox.exe | 13.32.121.85:443 | snippets.cdn.mozilla.net | Amazon.com, Inc. | US | suspicious |
2684 | firefox.exe | 18.66.139.31:443 | firefox.settings.services.mozilla.com | Massachusetts Institute of Technology | US | suspicious |
2684 | firefox.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2684 | firefox.exe | 54.186.128.121:443 | shavar.services.mozilla.com | Amazon.com, Inc. | US | unknown |
Domain | IP | Reputation |
---|---|---|
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
dw.malavida.com |
| unknown |
firefox.settings.services.mozilla.com |
| whitelisted |
location.services.mozilla.com |
| whitelisted |
locprod2-elb-us-west-2.prod.mozaws.net |
| whitelisted |
safebrowsing.googleapis.com |
| whitelisted |
push.services.mozilla.com |
| whitelisted |
autopush.prod.mozaws.net |
| whitelisted |
www.youtube.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
2684 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |
2684 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |
884 | svchost.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
884 | svchost.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
2684 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |
2684 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |