| URL: | http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh |
| Full analysis: | https://app.any.run/tasks/6982286f-26e3-420f-bcc2-0fb0449d7a2e |
| Verdict: | Malicious activity |
| Threats: | Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email. |
| Analysis date: | July 11, 2022, 10:07:18 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 15674F6667B0B837F0DEEAFCFA1E5B96 |
| SHA1: | 7991177DAFE6E3EB13F1B3958133BBB7542A24D6 |
| SHA256: | 9F5A6F78017C6DC0E08B8C47AA5F3C1138CFCC3195CAAF7DB5ACD3BD9B6F55FB |
| SSDEEP: | 3:N1KdEfXEV/V1VADtYcEGu:CGfX83eGcJu |
MALICIOUS
Drops executable file immediately after starts
- firefox.exe (PID: 1104)
SUSPICIOUS
Executable content was dropped or overwritten
- firefox.exe (PID: 1104)
Drops a file with a compile date too recent
- firefox.exe (PID: 1104)
INFO
Application launched itself
- firefox.exe (PID: 2972)
- firefox.exe (PID: 1104)
Checks supported languages
- firefox.exe (PID: 2972)
- firefox.exe (PID: 1104)
- firefox.exe (PID: 4024)
- firefox.exe (PID: 528)
- firefox.exe (PID: 2840)
- firefox.exe (PID: 2944)
- firefox.exe (PID: 2704)
- firefox.exe (PID: 1788)
Reads the computer name
- firefox.exe (PID: 528)
- firefox.exe (PID: 1104)
- firefox.exe (PID: 2704)
- firefox.exe (PID: 2840)
- firefox.exe (PID: 2944)
- firefox.exe (PID: 4024)
- firefox.exe (PID: 1788)
Reads CPU info
- firefox.exe (PID: 1104)
Creates files in the program directory
- firefox.exe (PID: 1104)
Creates files in the user directory
- firefox.exe (PID: 1104)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
44
Monitored processes
8
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 528 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1104.0.1387806478\1394813967" -parentBuildID 20201112153044 -prefsHandle 896 -prefMapHandle 1144 -prefsLen 1 -prefMapSize 238726 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1104 "\\.\pipe\gecko-crash-server-pipe.1104" 1212 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 83.0 | ||||
| 1104 | "C:\Program Files\Mozilla Firefox\firefox.exe" http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 83.0 | ||||
| 1788 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1104.34.1096210175\18330763" -childID 5 -isForBrowser -prefsHandle 3928 -prefMapHandle 3884 -prefsLen 7470 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1104 "\\.\pipe\gecko-crash-server-pipe.1104" 3816 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 | ||||
| 2704 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1104.20.558329181\1096535933" -childID 3 -isForBrowser -prefsHandle 3628 -prefMapHandle 3620 -prefsLen 7307 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1104 "\\.\pipe\gecko-crash-server-pipe.1104" 3380 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 | ||||
| 2840 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1104.6.589213549\1802248656" -childID 1 -isForBrowser -prefsHandle 2980 -prefMapHandle 2976 -prefsLen 181 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1104 "\\.\pipe\gecko-crash-server-pipe.1104" 2992 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 | ||||
| 2944 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1104.21.2047760104\736315027" -childID 4 -isForBrowser -prefsHandle 3636 -prefMapHandle 3632 -prefsLen 7307 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1104 "\\.\pipe\gecko-crash-server-pipe.1104" 3656 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 | ||||
| 2972 | "C:\Program Files\Mozilla Firefox\firefox.exe" "http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh" | C:\Program Files\Mozilla Firefox\firefox.exe | — | Explorer.EXE |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 83.0 | ||||
| 4024 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1104.13.1335824148\874372148" -childID 2 -isForBrowser -prefsHandle 3196 -prefMapHandle 3188 -prefsLen 6644 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1104 "\\.\pipe\gecko-crash-server-pipe.1104" 3208 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 | ||||
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
4
Suspicious files
109
Text files
38
Unknown types
20
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1104 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin | — | |
MD5:— | SHA256:— | |||
| 1104 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite | — | |
MD5:— | SHA256:— | |||
| 1104 | firefox.exe | C:\Users\admin\AppData\Local\Temp\mz_etilqs_mfc54RAgg4YzKSc | binary | |
MD5:— | SHA256:— | |||
| 1104 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal | binary | |
MD5:— | SHA256:— | |||
| 1104 | firefox.exe | C:\Users\admin\AppData\Local\Temp\mz_etilqs_FpKRTXLCYWGA7IG | binary | |
MD5:— | SHA256:— | |||
| 1104 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 1104 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.bin | binary | |
MD5:994A33896BB41A278A315D0D796422B6 | SHA256:54EC50A20FFF8CC016710E49437CF6A11D3FE5EE7B28C185E4A9AAFEE2908B63 | |||
| 1104 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\places.sqlite-wal | sqlite-wal | |
MD5:— | SHA256:— | |||
| 1104 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
| 1104 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js | text | |
MD5:299A2B747C11E4BDA194E563FEA4A699 | SHA256:94EE461F62E8B4A0A65471A41E10C8C56722B73C0A019D76ACA7F5BAF109813E | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
38
DNS requests
79
Threats
6
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1104 | firefox.exe | GET | 200 | 46.101.25.250:80 | http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh/ | GB | html | 72 b | unknown |
1104 | firefox.exe | POST | 200 | 142.250.187.163:80 | http://ocsp.pki.goog/gts1c3 | US | der | 472 b | whitelisted |
1104 | firefox.exe | POST | 200 | 142.250.187.163:80 | http://ocsp.pki.goog/gts1c3 | US | der | 471 b | whitelisted |
1104 | firefox.exe | GET | 200 | 46.101.25.250:80 | http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh/favicon.ico | GB | html | 72 b | unknown |
1104 | firefox.exe | POST | 200 | 142.250.187.163:80 | http://ocsp.pki.goog/gts1c3 | US | der | 471 b | whitelisted |
1104 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt | US | text | 8 b | whitelisted |
1104 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
1104 | firefox.exe | GET | 200 | 2.16.106.209:80 | http://ciscobinary.openh264.org/openh264-win32-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip | unknown | compressed | 479 Kb | whitelisted |
1104 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
1104 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | US | text | 8 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1104 | firefox.exe | 2.16.106.209:80 | ciscobinary.openh264.org | Akamai International B.V. | — | whitelisted |
— | — | 192.168.100.2:53 | — | — | — | whitelisted |
1104 | firefox.exe | 46.101.25.250:80 | caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh | Digital Ocean, Inc. | GB | unknown |
1104 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | — | US | whitelisted |
1104 | firefox.exe | 52.222.214.84:443 | firefox.settings.services.mozilla.com | Amazon.com, Inc. | US | suspicious |
1104 | firefox.exe | 54.187.225.50:443 | location.services.mozilla.com | Amazon.com, Inc. | US | unknown |
1104 | firefox.exe | 18.66.248.112:443 | content-signature-2.cdn.mozilla.net | Massachusetts Institute of Technology | US | suspicious |
1104 | firefox.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
1104 | firefox.exe | 108.157.4.125:443 | firefox-settings-attachments.cdn.mozilla.net | — | US | suspicious |
— | — | 142.250.184.238:443 | redirector.gvt1.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.microsoft.com |
| whitelisted |
detectportal.firefox.com |
| whitelisted |
caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh |
| unknown |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
firefox.settings.services.mozilla.com |
| whitelisted |
location.services.mozilla.com |
| whitelisted |
locprod2-elb-us-west-2.prod.mozaws.net |
| whitelisted |
example.org |
| whitelisted |
ipv4only.arpa |
| whitelisted |
content-signature-2.cdn.mozilla.net |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | A Network Trojan was detected | ET TROJAN Interactsh Control Panel (DNS) |
— | — | Potentially Bad Traffic | ET INFO Interactsh Domain in DNS Lookup (.interact .sh) |
— | — | Potentially Bad Traffic | ET INFO Interactsh Domain in DNS Lookup (.interact .sh) |
— | — | Potentially Bad Traffic | ET INFO Interactsh Domain in DNS Lookup (.interact .sh) |
1104 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |
1104 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |