| URL: | https://spiceworks.com |
| Full analysis: | https://app.any.run/tasks/6052d064-79d4-463a-b096-23d90044ad8f |
| Verdict: | Malicious activity |
| Analysis date: | July 31, 2023, 08:26:05 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | D7A3B614A9BAF8BA8266966A57B67A53 |
| SHA1: | 2A6EA9028644260E8EF3883873855E59EB3600D3 |
| SHA256: | 9EFB069E4FBE9F577A6A5FDB0EBEAEF53A3A90B8A2255DD2680FDE4A49D712A6 |
| SSDEEP: | 3:N8Ya8KI:2Ya8KI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1000 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.10.1320276604\1239333746" -parentBuildID 20230710165010 -sandboxingKind 1 -prefsHandle 8520 -prefMapHandle 3456 -prefsLen 35223 -prefMapSize 243323 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e504605-e02e-4131-b92f-f9377c8308b3} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 8288 19c367e0 utility | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1488 | "C:\Program Files\Mozilla Firefox\firefox.exe" "https://spiceworks.com" | C:\Program Files\Mozilla Firefox\firefox.exe | — | explorer.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1992 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.5.1400114496\71766107" -parentBuildID 20230710165010 -prefsHandle 2796 -prefMapHandle 2800 -prefsLen 27916 -prefMapSize 243323 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2375e20a-383a-4dff-aaed-6cc560919499} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 3056 1666c120 rdd | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2696 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.11.1660701758\389644283" -childID 8 -isForBrowser -prefsHandle 8208 -prefMapHandle 3248 -prefsLen 29940 -prefMapSize 243323 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8be55ed-3245-4dfe-8708-d93717e721b2} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 8152 1d3fe840 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2744 | "C:\Program Files\Mozilla Firefox\firefox.exe" https://spiceworks.com | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2848 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.2.111400263\1320218259" -childID 1 -isForBrowser -prefsHandle 2164 -prefMapHandle 2160 -prefsLen 24503 -prefMapSize 243323 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {81042e39-321e-47d3-9f9a-46eeb2457ff7} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 2176 ebcee00 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 3108 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.3.1299777082\2124981328" -childID 2 -isForBrowser -prefsHandle 2520 -prefMapHandle 2032 -prefsLen 27510 -prefMapSize 243323 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {781f5abc-2ebc-46af-a7ab-0e1cf0baa84e} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 2144 156303f0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 3148 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.9.18363106\1253041733" -childID 7 -isForBrowser -prefsHandle 4208 -prefMapHandle 4212 -prefsLen 34960 -prefMapSize 243323 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c5c371d-f6b8-4496-9871-e90575575377} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 4196 19710840 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 3292 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.0.823969476\1912263988" -parentBuildID 20230710165010 -prefsHandle 1092 -prefMapHandle 1084 -prefsLen 25853 -prefMapSize 243323 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f0af22d-66a0-4e91-91af-ad4329ad3695} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 1176 d27b500 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 3556 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.6.1535942299\1481599879" -childID 4 -isForBrowser -prefsHandle 3756 -prefMapHandle 3752 -prefsLen 29802 -prefMapSize 243323 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {96975688-34a1-4e54-8475-99f00ca7dbce} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 3768 16619840 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| (PID) Process: | (1488) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | delete value | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Launcher |
Value: 09611C1E1E000000 | |||
| (PID) Process: | (1488) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | delete value | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Browser |
Value: AD681C1E1E000000 | |||
| (PID) Process: | (2744) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry |
Value: 1 | |||
| (PID) Process: | (2744) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
| (PID) Process: | (2744) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableTelemetry |
Value: 1 | |||
| (PID) Process: | (2744) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent |
Value: 0 | |||
| (PID) Process: | (2744) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (2744) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 4600000049010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2744) firefox.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3832) wmpnscfg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{2712E316-C3CB-4A88-A820-747F7F10436A}\{26C05E24-A4B9-425B-8860-28D2FE3C6861} |
| Operation: | delete key | Name: | (default) |
Value: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2744 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\webappsstore.sqlite-wal | — | |
MD5:— | SHA256:— | |||
| 2744 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20230710165010 | text | |
MD5:83CC93097A4D1DE5B0F09243D194F225 | SHA256:8D5EDB25E6C8C25491F18C49F2ABB0715F419CBC7ADCC6EA8B01197449BD469D | |||
| 2744 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\permissions.sqlite-journal | binary | |
MD5:FAB3B895A745B61D3444CFB78F83020E | SHA256:A071F517B71368F0D23B840003DB8824ED3DD0F7B2C07C463B0E615A1C3B777D | |||
| 2744 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 2744 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\compatibility.ini | text | |
MD5:5A14BC3397EA072906B63D69FC704FEA | SHA256:03F45724EA1FE89E753AA76B40DE9078BFC9160AA1065ED9D4D98DA04B7FB3E7 | |||
| 2744 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js | text | |
MD5:27EE4145587DD995F3D73A10B33502C9 | SHA256:7EA9F1B4418340764C52DDB1C0676B45BE944A1962B9D7C5D1528159011CD286 | |||
| 2744 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extensions.json.tmp | text | |
MD5:5295709022CEBD0187755A9416EB779D | SHA256:C3FA1FA423BF8F0F63ACBE051A82928738D9F9D29264FCC08EF40E125A40B384 | |||
| 2744 | firefox.exe | C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\updates.xml | xml | |
MD5:D9BC3A7CCB24B554BE35C97FA3D7C7D3 | SHA256:EF3711EB7E08CF646A50CCD66CB11DD88C7750BC1908CA09F5219269FEE3B348 | |||
| 2744 | firefox.exe | C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\profile_count_308046B0AF4A39CB.json | binary | |
MD5:58728D2E9D553BB2369BDB4A618ACAE5 | SHA256:7EBC652A4B5B43608F61AC1057C51EC2EC1C8E33BBEB130794E15AF72BEB42E8 | |||
| 2744 | firefox.exe | C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json | binary | |
MD5:E812E56D0B6EDF84B4A0B959F53E239F | SHA256:D55B72651CD0C5B834EAA29BA778BE7EDC357C16163A77AE778DCD61E85C3582 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2744 | firefox.exe | POST | — | 142.250.181.227:80 | http://ocsp.pki.goog/gts1c3 | US | — | — | whitelisted |
2744 | firefox.exe | POST | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/ | US | binary | 471 b | whitelisted |
2744 | firefox.exe | POST | 200 | 108.138.16.146:80 | http://ocsp.r2m02.amazontrust.com/ | US | der | 471 b | whitelisted |
2744 | firefox.exe | POST | — | 2.16.241.8:80 | http://r3.o.lencr.org/ | unknown | — | — | shared |
2744 | firefox.exe | POST | — | 108.138.16.146:80 | http://ocsp.r2m02.amazontrust.com/ | US | — | — | whitelisted |
2744 | firefox.exe | POST | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/ | US | binary | 471 b | whitelisted |
2744 | firefox.exe | POST | 200 | 108.138.16.146:80 | http://ocsp.r2m02.amazontrust.com/ | US | binary | 471 b | whitelisted |
2744 | firefox.exe | POST | 200 | 142.250.181.227:80 | http://ocsp.pki.goog/gts1c3 | US | der | 471 b | whitelisted |
2744 | firefox.exe | POST | 200 | 142.250.181.227:80 | http://ocsp.pki.goog/gts1c3 | US | der | 471 b | whitelisted |
2744 | firefox.exe | POST | — | 192.229.221.95:80 | http://ocsp.digicert.com/ | US | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2640 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2744 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | GOOGLE | US | whitelisted |
2744 | firefox.exe | 45.60.11.212:443 | spiceworks.com | INCAPSULA | US | unknown |
2744 | firefox.exe | 34.117.237.239:443 | contile.services.mozilla.com | GOOGLE-CLOUD-PLATFORM | US | suspicious |
2744 | firefox.exe | 34.193.43.112:443 | spocs.getpocket.com | AMAZON-AES | US | unknown |
2744 | firefox.exe | 45.60.13.212:443 | www.spiceworks.com | INCAPSULA | US | suspicious |
2744 | firefox.exe | 34.117.65.55:443 | push.services.mozilla.com | GOOGLE-CLOUD-PLATFORM | US | suspicious |
2744 | firefox.exe | 172.217.16.202:443 | safebrowsing.googleapis.com | — | — | whitelisted |
Domain | IP | Reputation |
|---|---|---|
spiceworks.com |
| whitelisted |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
contile.services.mozilla.com |
| whitelisted |
spocs.getpocket.com |
| shared |
proxyserverecs-1736642167.us-east-1.elb.amazonaws.com |
| shared |
normandy.cdn.mozilla.net |
| whitelisted |
normandy-cdn.services.mozilla.com |
| whitelisted |
safebrowsing.googleapis.com |
| whitelisted |
r3.o.lencr.org |
| shared |