| URL: | sharepointle.com |
| Full analysis: | https://app.any.run/tasks/edda04f6-c627-4e46-8046-180cde309866 |
| Verdict: | Malicious activity |
| Analysis date: | March 07, 2024, 16:44:34 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | FF9B62684EF8CFC3C328077338CBCDDD |
| SHA1: | F223DA6CBFA758888C188C4DE2D01B8A02FA111D |
| SHA256: | 983D0B51D3C9999A28F3FF515FC39D5AD0CE3EFA28785DD7933C1F1FCC5AAC8D |
| SSDEEP: | 3:/yJA2n:ih |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1408 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2096 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3240.4.1589902522\1473843171" -childID 3 -isForBrowser -prefsHandle 3776 -prefMapHandle 3772 -prefsLen 29209 -prefMapSize 244195 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f63f99d2-0492-4b1c-97bd-9726431e5b3a} 3240 "\\.\pipe\gecko-crash-server-pipe.3240" 3788 21c7f560 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2112 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3240.5.1552735471\293086446" -childID 4 -isForBrowser -prefsHandle 3896 -prefMapHandle 3900 -prefsLen 29209 -prefMapSize 244195 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {83da5f6b-396b-4f39-a3b6-07baa60ad38d} 3240 "\\.\pipe\gecko-crash-server-pipe.3240" 3888 215eab20 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2376 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3240.7.376268776\1052517283" -childID 6 -isForBrowser -prefsHandle 3900 -prefMapHandle 3924 -prefsLen 29313 -prefMapSize 244195 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e4f9445-05d5-4fd7-9e96-a87e1c218d4e} 3240 "\\.\pipe\gecko-crash-server-pipe.3240" 1656 215eae00 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2596 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3240.3.1248328719\1357020354" -childID 2 -isForBrowser -prefsHandle 2896 -prefMapHandle 2892 -prefsLen 34225 -prefMapSize 244195 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a76d8fa-3b69-4824-8374-d780765ac541} 3240 "\\.\pipe\gecko-crash-server-pipe.3240" 2908 1f448c90 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2848 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3240.0.1704017318\622146418" -parentBuildID 20230710165010 -prefsHandle 1108 -prefMapHandle 1100 -prefsLen 28523 -prefMapSize 244195 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b437a46-0aae-4770-9f37-268211702b89} 3240 "\\.\pipe\gecko-crash-server-pipe.3240" 1180 165a7500 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2892 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3240.2.985945537\565081567" -childID 1 -isForBrowser -prefsHandle 2060 -prefMapHandle 2056 -prefsLen 24556 -prefMapSize 244195 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0368c273-9334-451e-919c-3f27b4332a01} 3240 "\\.\pipe\gecko-crash-server-pipe.3240" 2072 1a7fee00 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 3028 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3240.6.1178886163\2015488904" -childID 5 -isForBrowser -prefsHandle 3988 -prefMapHandle 3984 -prefsLen 34336 -prefMapSize 244195 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fa1bad7-083e-4887-a6f1-b77e02c5f1dc} 3240 "\\.\pipe\gecko-crash-server-pipe.3240" 3980 215eac90 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 3228 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3240.1.1171771633\1506723503" -parentBuildID 20230710165010 -prefsHandle 1404 -prefMapHandle 1400 -prefsLen 28600 -prefMapSize 244195 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ff22ad1-831c-4968-a47e-07236be23362} 3240 "\\.\pipe\gecko-crash-server-pipe.3240" 1416 16529bc0 socket | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 3240 | "C:\Program Files\Mozilla Firefox\firefox.exe" sharepointle.com | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| (PID) Process: | (3288) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Launcher |
Value: 981A394F01000000 | |||
| (PID) Process: | (3240) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Browser |
Value: 40FF3A4F01000000 | |||
| (PID) Process: | (3240) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Installer\308046B0AF4A39CB |
| Operation: | delete value | Name: | installer.taskbarpin.win10.enabled |
Value: | |||
| (PID) Process: | (3240) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry |
Value: 0 | |||
| (PID) Process: | (3240) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
| (PID) Process: | (3240) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Theme |
Value: 1 | |||
| (PID) Process: | (3240) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Enabled |
Value: 1 | |||
| (PID) Process: | (3240) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableTelemetry |
Value: 1 | |||
| (PID) Process: | (3240) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent |
Value: 0 | |||
| (PID) Process: | (3240) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|SetDefaultBrowserUserChoice |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3240 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js | text | |
MD5:60E0DE9E05EC76C749D80F0D15A81B21 | SHA256:08252FA62CCCCD316474E20CC7317A6B5C932B2C972234318E8CCDA39EC2EF48 | |||
| 3240 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 3240 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db | sqlite | |
MD5:5CF6C777960E08E2C636958E8DC064D4 | SHA256:C13A312810781F6A813A9CE07F49131529EDEE1FEADDF3B71BEB68DD5D5ABF6F | |||
| 3240 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js | text | |
MD5:60E0DE9E05EC76C749D80F0D15A81B21 | SHA256:08252FA62CCCCD316474E20CC7317A6B5C932B2C972234318E8CCDA39EC2EF48 | |||
| 3240 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage.sqlite-journal | binary | |
MD5:61F79E7899F8B5905EDD7A8B32777BF8 | SHA256:16A7B0CC309AB51B13143C8935D7AAAFBAC4BEC24C005F403C79BB9E5282C126 | |||
| 3240 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\activity-stream.discovery_stream.json | text | |
MD5:94A99A94DD21BABBFE9C979856D9556F | SHA256:FE01CF4E1EE0B31ED54EA9919DB3F1C7CBF38A43E598EFC0B763792EE0757596 | |||
| 3240 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 3240 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 3240 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\targeting.snapshot.json.tmp | binary | |
MD5:0EFF82E1DE1888D1A0B09F40A4148276 | SHA256:49121747A1E3AF984F6972B27E204F8F0CD45082CE3DCD7F211C0C57350D1902 | |||
| 3240 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite | — | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3240 | firefox.exe | POST | 200 | 195.138.255.19:80 | http://r3.o.lencr.org/ | unknown | binary | 503 b | unknown |
3240 | firefox.exe | POST | 200 | 195.138.255.19:80 | http://r3.o.lencr.org/ | unknown | binary | 503 b | unknown |
3240 | firefox.exe | GET | — | 13.107.246.42:80 | http://www.sharepointle.com/ | unknown | — | — | unknown |
3240 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | unknown | text | 90 b | unknown |
3240 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | unknown | text | 90 b | unknown |
3240 | firefox.exe | POST | 200 | 172.217.18.99:80 | http://ocsp.pki.goog/gts1c3 | unknown | binary | 471 b | unknown |
3240 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | text | 8 b | unknown |
3240 | firefox.exe | POST | 200 | 195.138.255.19:80 | http://r3.o.lencr.org/ | unknown | binary | 503 b | unknown |
3240 | firefox.exe | POST | 200 | 172.217.18.99:80 | http://ocsp.pki.goog/gts1c3 | unknown | binary | 471 b | unknown |
3240 | firefox.exe | GET | 504 | 13.107.246.42:80 | http://www.sharepointle.com/ | unknown | html | 1.35 Kb | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
3240 | firefox.exe | 216.58.206.42:443 | safebrowsing.googleapis.com | — | — | whitelisted |
3240 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | GOOGLE | US | whitelisted |
3240 | firefox.exe | 34.117.188.166:443 | spocs.getpocket.com | — | — | unknown |
3240 | firefox.exe | 34.117.237.239:443 | contile.services.mozilla.com | GOOGLE-CLOUD-PLATFORM | US | unknown |
3240 | firefox.exe | 172.217.18.99:80 | ocsp.pki.goog | GOOGLE | US | whitelisted |
3240 | firefox.exe | 34.107.243.93:443 | push.services.mozilla.com | — | — | unknown |
Domain | IP | Reputation |
|---|---|---|
sharepointle.com |
| unknown |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
example.org |
| whitelisted |
ipv4only.arpa |
| whitelisted |
contile.services.mozilla.com |
| whitelisted |
spocs.getpocket.com |
| shared |
prod.ads.prod.webservices.mozgcp.net |
| unknown |
r3.o.lencr.org |
| shared |
a1887.dscq.akamai.net |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
1080 | svchost.exe | Misc activity | ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (sharepointle .com) |
1080 | svchost.exe | Misc activity | ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (sharepointle .com) |
1080 | svchost.exe | Misc activity | ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (sharepointle .com) |
1080 | svchost.exe | Misc activity | ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (sharepointle .com) |
1080 | svchost.exe | Misc activity | ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (sharepointle .com) |
1080 | svchost.exe | Misc activity | ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (sharepointle .com) |
1080 | svchost.exe | Misc activity | ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (sharepointle .com) |