URL: | https://cwbot.tk/ |
Full analysis: | https://app.any.run/tasks/103c1629-27ce-4772-882d-1097c5e0c6ef |
Verdict: | Malicious activity |
Analysis date: | October 11, 2021, 19:31:39 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 569AFE726AC9CB83C591FBED303648F2 |
SHA1: | 11381033CA371CC3CAD45696C7A1B5EC0C531991 |
SHA256: | D7EE62B6466C804EB768DF8E5DD202080D739A03579821FC1DDC08EFDB14B284 |
SSDEEP: | 3:N8PqtoK:2CtoK |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2828 | "C:\Program Files\Mozilla Firefox\firefox.exe" "https://cwbot.tk/" | C:\Program Files\Mozilla Firefox\firefox.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 91.0 Modules
| |||||||||||||||
1876 | "C:\Program Files\Mozilla Firefox\firefox.exe" https://cwbot.tk/ | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 91.0 Modules
| |||||||||||||||
2296 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1876.0.1456243288\377867786" -parentBuildID 20210804193234 -prefsHandle 1112 -prefMapHandle 1104 -prefsLen 1 -prefMapSize 246031 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1876 "\\.\pipe\gecko-crash-server-pipe.1876" 1176 d696828 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 91.0 Modules
| |||||||||||||||
2760 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1876.1.1366761994\80555888" -childID 1 -isForBrowser -prefsHandle 1916 -prefMapHandle 1912 -prefsLen 282 -prefMapSize 246031 -jsInit 932 285716 -parentBuildID 20210804193234 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1876 "\\.\pipe\gecko-crash-server-pipe.1876" 1928 123b6f78 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 91.0 Modules
| |||||||||||||||
716 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1876.3.433110414\99926409" -childID 2 -isForBrowser -prefsHandle 2748 -prefMapHandle 2784 -prefsLen 5260 -prefMapSize 246031 -jsInit 932 285716 -parentBuildID 20210804193234 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1876 "\\.\pipe\gecko-crash-server-pipe.1876" 2788 1716d648 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 91.0 Modules
| |||||||||||||||
2588 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1876.5.1386633274\945625332" -childID 3 -isForBrowser -prefsHandle 3400 -prefMapHandle 3408 -prefsLen 5920 -prefMapSize 246031 -jsInit 932 285716 -parentBuildID 20210804193234 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1876 "\\.\pipe\gecko-crash-server-pipe.1876" 3376 17f4c8e8 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 91.0 Modules
| |||||||||||||||
4016 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1876.7.791593161\1198781634" -childID 4 -isForBrowser -prefsHandle 3584 -prefMapHandle 3520 -prefsLen 5920 -prefMapSize 246031 -jsInit 932 285716 -parentBuildID 20210804193234 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1876 "\\.\pipe\gecko-crash-server-pipe.1876" 3596 17f4cf78 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 91.0 Modules
| |||||||||||||||
2764 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1876.9.1015730182\336720018" -childID 5 -isForBrowser -prefsHandle 7992 -prefMapHandle 3232 -prefsLen 8120 -prefMapSize 246031 -jsInit 932 285716 -parentBuildID 20210804193234 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1876 "\\.\pipe\gecko-crash-server-pipe.1876" 7980 199e18e8 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 91.0 Modules
| |||||||||||||||
584 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1876.11.2017002485\1021589348" -childID 6 -isForBrowser -prefsHandle 2800 -prefMapHandle 7704 -prefsLen 8274 -prefMapSize 246031 -jsInit 932 285716 -parentBuildID 20210804193234 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1876 "\\.\pipe\gecko-crash-server-pipe.1876" 7692 c113a38 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 91.0 Modules
| |||||||||||||||
2372 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1876.14.1525793215\772137549" -childID 7 -isForBrowser -prefsHandle 1788 -prefMapHandle 1628 -prefsLen 8588 -prefMapSize 246031 -jsInit 932 285716 -parentBuildID 20210804193234 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1876 "\\.\pipe\gecko-crash-server-pipe.1876" 3252 12368258 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 91.0 Modules
|
(PID) Process: | (2828) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Launcher |
Value: 02AC14BB14000000 | |||
(PID) Process: | (1876) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Browser |
Value: CFB814BB14000000 | |||
(PID) Process: | (1876) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry |
Value: 0 | |||
(PID) Process: | (1876) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
(PID) Process: | (1876) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Theme |
Value: 1 | |||
(PID) Process: | (1876) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Enabled |
Value: 1 | |||
(PID) Process: | (1876) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableTelemetry |
Value: 1 | |||
(PID) Process: | (1876) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent |
Value: 0 | |||
(PID) Process: | (1876) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox|ServicesSettingsServer |
Value: https://firefox.settings.services.mozilla.com/v1 | |||
(PID) Process: | (1876) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox|SecurityContentSignatureRootHash |
Value: 97:E8:BA:9C:F1:2F:B3:DE:53:CC:42:A4:E6:57:7E:D6:4D:F4:93:C2:47:B4:14:FE:A0:36:81:8D:38:23:56:0E |
PID | Process | Filename | Type | |
---|---|---|---|---|
1876 | firefox.exe | C:\ProgramData\Mozilla\updates\308046B0AF4A39CB\update-config.json | text | |
MD5:64CF5CFF1D92B0E6C1176A4D6D00AA0C | SHA256:2392EA2FB42A92BF2D310337ADC75A815D50C3A6DC34A1594220746CBEFA9C1A | |||
1876 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js | text | |
MD5:9F1308886B2A8CE36D207F099F457A00 | SHA256:2E9B7F62510D177F12322088322370BB9C4DE509FF8F3D2D7A6B8958240E5A0E | |||
1876 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js | text | |
MD5:9F1308886B2A8CE36D207F099F457A00 | SHA256:2E9B7F62510D177F12322088322370BB9C4DE509FF8F3D2D7A6B8958240E5A0E | |||
1876 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.bin | binary | |
MD5:0308C6EA18FC8109F3B6EF5D777CF8AE | SHA256:52B9ACD85C90EFDC079F759A6514F779DEB31E1D9F932BB2C16818D657E75B49 | |||
1876 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-current.bin | binary | |
MD5:89A8A086336AA27BA1E56E33B155165A | SHA256:5D0D04952D693FA2F40AE23EB7F4BC9888ED3526A55C9ECD0F6B8ADDF03DD9AC | |||
1876 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-wal | — | |
MD5:— | SHA256:— | |||
1876 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\QLDYZ5~1.DEF\cert9.db-journal | binary | |
MD5:7E8C1C5CD0EE6707517F95880577C6E1 | SHA256:82985D2E0B7035D7A7E11506C22647D0F36327417BB64D20F0C45F364D7F509B | |||
1876 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\QLDYZ5~1.DEF\cert9.db | sqlite | |
MD5:D7798F264410F44C2B7F8EEA030F5203 | SHA256:56EF75F857FD74285D7CD94030FD60D2EE74211718CBCEE9C6D43E1A5895B7DF | |||
1876 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4 | jsonlz4 | |
MD5:91F5C9A00E9CBED1E465ABFB07552C21 | SHA256:747F2A59C195821874833EB9A9D22451DC186B4536472AC34D4A593007F11DA6 | |||
1876 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\addonStartup.json.lz4 | jsonlz4 | |
MD5:9C204B64FBFC31C979F9137C7BA45793 | SHA256:E2385DBDA6083E0413A35725DEFD719819DB6EECF6AD1441A2E8D690D1EBF56F |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1876 | firefox.exe | GET | 200 | 172.67.130.50:80 | http://download-files.ml/E8mkOuVz?filename=cw_bot | US | html | 350 b | suspicious |
1876 | firefox.exe | GET | 200 | 172.67.130.50:80 | http://download-files.ml/03032020.js | US | text | 17.9 Kb | suspicious |
1876 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
1876 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
1876 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | US | text | 8 b | whitelisted |
1876 | firefox.exe | POST | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gts1c3 | US | der | 472 b | whitelisted |
1876 | firefox.exe | GET | 200 | 104.21.7.113:80 | http://download-files.ml/.well-known/http-opportunistic | US | text | 48 b | suspicious |
1876 | firefox.exe | POST | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gts1c3 | US | der | 472 b | whitelisted |
1876 | firefox.exe | POST | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gts1c3 | US | der | 472 b | whitelisted |
1876 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | US | text | 90 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1876 | firefox.exe | 142.250.186.138:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
1876 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | — | US | whitelisted |
1876 | firefox.exe | 172.67.182.138:443 | cwbot.tk | — | US | unknown |
1876 | firefox.exe | 172.217.23.99:80 | ocsp.pki.goog | Google Inc. | US | whitelisted |
1876 | firefox.exe | 143.204.98.29:443 | firefox.settings.services.mozilla.com | — | US | malicious |
1876 | firefox.exe | 142.250.185.170:443 | safebrowsing.googleapis.com | Google Inc. | US | whitelisted |
1876 | firefox.exe | 143.204.98.4:443 | firefox-settings-attachments.cdn.mozilla.net | — | US | suspicious |
1876 | firefox.exe | 143.204.98.30:443 | content-signature-2.cdn.mozilla.net | — | US | suspicious |
— | — | 143.204.98.30:443 | content-signature-2.cdn.mozilla.net | — | US | suspicious |
1876 | firefox.exe | 52.36.47.189:443 | push.services.mozilla.com | Amazon.com, Inc. | US | suspicious |
Domain | IP | Reputation |
---|---|---|
firefox.settings.services.mozilla.com |
| whitelisted |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
cwbot.tk |
| malicious |
example.org |
| whitelisted |
ipv4only.arpa |
| whitelisted |
safebrowsing.googleapis.com |
| whitelisted |
push.services.mozilla.com |
| whitelisted |
autopush.prod.mozaws.net |
| whitelisted |
ocsp.pki.goog |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET DNS Query to a .tk domain - Likely Hostile |
— | — | Potentially Bad Traffic | ET DNS Query to a .tk domain - Likely Hostile |
— | — | Potentially Bad Traffic | ET DNS Query to a .tk domain - Likely Hostile |
— | — | Potentially Bad Traffic | ET INFO DNS Query for Suspicious .ml Domain |
1876 | firefox.exe | Potentially Bad Traffic | ET INFO HTTP Request to a *.ml domain |
1876 | firefox.exe | Potentially Bad Traffic | ET INFO Suspicious Domain (*.ml) in TLS SNI |
1876 | firefox.exe | Potentially Bad Traffic | ET INFO HTTP Request to a *.ml domain |
1876 | firefox.exe | Potentially Bad Traffic | ET INFO HTTP Request to a *.ml domain |
1876 | firefox.exe | Potentially Bad Traffic | ET INFO HTTP Request to a *.ml domain |