URL: | https://mega.nz/#!nrBFRK7b!RYnscno_Sj3WMKqmXh0mY6jQpUeJOrGeAVK3U88soLM |
Full analysis: | https://app.any.run/tasks/ebd4ac16-29a0-49f9-bd9f-a8efd8cfd1bb |
Verdict: | Malicious activity |
Threats: | Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. |
Analysis date: | January 17, 2020, 22:51:18 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MD5: | D6BFDBBF2F285B265E69C95ADD7E311A |
SHA1: | F3C4BB23F290257CFC0B004D5843DABE6649127E |
SHA256: | BA4BD19035C1815F2D4983AE58C0FA085398C0427AC6759A0F5BE3E45934B5D6 |
SSDEEP: | 3:N8X/iGEjLu95MIviMRKcswfWyo:290LuLM2YsfW7 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2520 | "C:\Program Files\Mozilla Firefox\firefox.exe" "https://mega.nz/#!nrBFRK7b!RYnscno_Sj3WMKqmXh0mY6jQpUeJOrGeAVK3U88soLM" | C:\Program Files\Mozilla Firefox\firefox.exe | — | explorer.exe |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 68.0.1 | ||||
1956 | "C:\Program Files\Mozilla Firefox\firefox.exe" https://mega.nz/#!nrBFRK7b!RYnscno_Sj3WMKqmXh0mY6jQpUeJOrGeAVK3U88soLM | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 68.0.1 | ||||
964 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1956.0.502793132\701979972" -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 1956 "\\.\pipe\gecko-crash-server-pipe.1956" 1132 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 68.0.1 | ||||
3976 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1956.3.1054923503\1254435007" -childID 1 -isForBrowser -prefsHandle 1688 -prefMapHandle 1684 -prefsLen 1 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 1956 "\\.\pipe\gecko-crash-server-pipe.1956" 1708 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 68.0.1 | ||||
932 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1956.13.586133139\1519966725" -childID 2 -isForBrowser -prefsHandle 2924 -prefMapHandle 2928 -prefsLen 5996 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 1956 "\\.\pipe\gecko-crash-server-pipe.1956" 2944 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 68.0.1 | ||||
3708 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1956.20.224251307\552169489" -childID 3 -isForBrowser -prefsHandle 3876 -prefMapHandle 3880 -prefsLen 7300 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 1956 "\\.\pipe\gecko-crash-server-pipe.1956" 3892 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 68.0.1 | ||||
3936 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\LetsBuildRansomware.rar" | C:\Program Files\WinRAR\WinRAR.exe | — | firefox.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3008 | "C:\Users\admin\Desktop\rans\LetsBuildRansomware.exe" | C:\Users\admin\Desktop\rans\LetsBuildRansomware.exe | explorer.exe | |
User: admin Integrity Level: HIGH Exit code: 0 | ||||
1896 | "C:\Users\admin\AppData\Local\Temp\Let'sBuildRansom.exe" | C:\Users\admin\AppData\Local\Temp\Let'sBuildRansom.exe | LetsBuildRansomware.exe | |
User: admin Company: Microsoft Integrity Level: HIGH Description: Let'sBuildRansom Version: 1.0.0.0 | ||||
3200 | "C:\Program Files\WinRAR\WinRAR.exe" a -ep1 -scul -r0 -iext -- . C:\Users\admin\Desktop\IMG1.jpg C:\Users\admin\Desktop\msg.rsw C:\Users\admin\Desktop\msgtxt.rsw C:\Users\admin\Desktop\preventchangedesktop.bat C:\Users\admin\Desktop\RSW.exe C:\Users\admin\Desktop\t.vbs C:\Users\admin\Desktop\task.vbs C:\Users\admin\Desktop\wallet.rsw C:\Users\admin\Desktop\windowdefender.vbs C:\Users\admin\Desktop\desktop.vbs C:\Users\admin\Desktop\exten.rsw C:\Users\admin\Desktop\IMG.jpg | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1956 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin | — | |
MD5:— | SHA256:— | |||
1956 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm | — | |
MD5:— | SHA256:— | |||
1956 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js | — | |
MD5:— | SHA256:— | |||
1956 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp | — | |
MD5:— | SHA256:— | |||
1956 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.tmp | — | |
MD5:— | SHA256:— | |||
1956 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js | text | |
MD5:354459382F30B8994109C88659DFA1F3 | SHA256:E3E8E2B7E7EECA231620D83C70FA5A926E8B9CE74C51F595F71191DC0B50527E | |||
1956 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-current.bin | binary | |
MD5:5027177F513CDAE07DB2330E1DED5934 | SHA256:0C53F16051E738287A4612F68E296238087627E594CFD6DDFA1FECC2E998328B | |||
1956 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\entries\486EDEB7EB98C1F19F6F093530829F1817EA3BDE | der | |
MD5:6745069F30BB8AD55EA57F8918097FA4 | SHA256:E9F62DE88C776696055DFAF568C98F2BF951ECA82E71450B34D78AEC9281B55B | |||
1956 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.bin | binary | |
MD5:DE9496ACA551ADE408EF6466A11833A1 | SHA256:8F9C7FDB3E0BC01024E43A8E242468FC4DD4F74C725E32A883571635203DC10A | |||
1956 | firefox.exe | C:\Users\admin\AppData\Local\Temp\mz_etilqs_JupW2Rovhyfd34U | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1956 | firefox.exe | POST | 200 | 151.139.128.14:80 | http://ocsp.comodoca.com/ | US | der | 471 b | whitelisted |
1956 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
1956 | firefox.exe | POST | 200 | 151.139.128.14:80 | http://ocsp.comodoca.com/ | US | der | 471 b | whitelisted |
1956 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
1956 | firefox.exe | POST | 200 | 151.139.128.14:80 | http://ocsp.comodoca.com/ | US | der | 471 b | whitelisted |
1956 | firefox.exe | POST | 200 | 151.139.128.14:80 | http://ocsp.comodoca.com/ | US | der | 471 b | whitelisted |
1956 | firefox.exe | POST | 200 | 2.20.190.17:80 | http://ocsp.int-x3.letsencrypt.org/ | unknown | der | 527 b | whitelisted |
1956 | firefox.exe | POST | 200 | 151.139.128.14:80 | http://ocsp.comodoca.com/ | US | der | 472 b | whitelisted |
1956 | firefox.exe | POST | 200 | 216.58.210.3:80 | http://ocsp.pki.goog/gts1o1 | US | der | 471 b | whitelisted |
1956 | firefox.exe | POST | 200 | 151.139.128.14:80 | http://ocsp.comodoca.com/ | US | der | 472 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1956 | firefox.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
1956 | firefox.exe | 2.16.186.50:80 | detectportal.firefox.com | Akamai International B.V. | — | whitelisted |
1956 | firefox.exe | 31.216.148.10:443 | mega.nz | Datacenter Luxembourg S.A. | LU | unknown |
1956 | firefox.exe | 54.69.207.70:443 | tiles.services.mozilla.com | Amazon.com, Inc. | US | unknown |
1956 | firefox.exe | 151.139.128.14:80 | ocsp.comodoca.com | Highwinds Network Group, Inc. | US | suspicious |
1956 | firefox.exe | 143.204.101.27:443 | snippets.cdn.mozilla.net | — | US | unknown |
1956 | firefox.exe | 35.164.109.147:443 | search.services.mozilla.com | Amazon.com, Inc. | US | unknown |
1956 | firefox.exe | 31.216.148.13:443 | eu.static.mega.co.nz | Datacenter Luxembourg S.A. | LU | unknown |
1956 | firefox.exe | 13.224.196.69:443 | firefox.settings.services.mozilla.com | — | US | unknown |
1956 | firefox.exe | 2.20.190.17:80 | ocsp.int-x3.letsencrypt.org | Akamai International B.V. | — | whitelisted |
Domain | IP | Reputation |
---|---|---|
detectportal.firefox.com |
| whitelisted |
mega.nz |
| whitelisted |
a1089.dscd.akamai.net |
| whitelisted |
ocsp.int-x3.letsencrypt.org |
| whitelisted |
a771.dscq.akamai.net |
| whitelisted |
search.services.mozilla.com |
| whitelisted |
search.r53-2.services.mozilla.com |
| whitelisted |
push.services.mozilla.com |
| whitelisted |
autopush.prod.mozaws.net |
| whitelisted |
snippets.cdn.mozilla.net |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET INFO Observed DNS Query to .cloud TLD |
— | — | Potentially Bad Traffic | ET INFO Observed DNS Query to .cloud TLD |