analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| URL: | https://syndication.realsrv.com |
| Full analysis: | https://app.any.run/tasks/eb8a0e66-f570-4a6a-b2b0-7e91490df189 |
| Verdict: | Malicious activity |
| Analysis date: | July 19, 2023 at 09:34:15 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | 722FBEFCBA15D6369CBC198F6C69794F |
| SHA1: | 4E694E6494083F29588920020B4932511C7EC4C0 |
| SHA256: | D97B15A6AFE71FD15DB8B9757D40905B2EFE581BCDE920429F219AC397FECABF |
| SSDEEP: | 3:N8RixLjWNI:2Y96I |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads settings of System Certificates
- default-browser-agent.exe (PID: 304)
Reads the Internet Settings
- default-browser-agent.exe (PID: 304)
The process executes via Task Scheduler
- default-browser-agent.exe (PID: 304)
Checks Windows Trust Settings
- default-browser-agent.exe (PID: 304)
Reads security settings of Internet Explorer
- default-browser-agent.exe (PID: 304)
Loads DLL from Mozilla Firefox
- default-browser-agent.exe (PID: 304)
INFO
Checks supported languages
- default-browser-agent.exe (PID: 304)
Checks proxy server information
- default-browser-agent.exe (PID: 304)
Reads the computer name
- default-browser-agent.exe (PID: 304)
The process checks LSA protection
- default-browser-agent.exe (PID: 304)
Reads the machine GUID from the registry
- default-browser-agent.exe (PID: 304)
Executable content was dropped or overwritten
- firefox.exe (PID: 3856)
Application launched itself
- firefox.exe (PID: 3436)
- firefox.exe (PID: 3856)
Create files in a temporary directory
- default-browser-agent.exe (PID: 304)
Creates files or folders in the user directory
- default-browser-agent.exe (PID: 304)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
50
Monitored processes
13
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3436 | "C:\Program Files\Mozilla Firefox\firefox.exe" "https://syndication.realsrv.com" | C:\Program Files\Mozilla Firefox\firefox.exe | — | explorer.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 3856 | "C:\Program Files\Mozilla Firefox\firefox.exe" https://syndication.realsrv.com | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 272 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.0.1848428033\2015141740" -parentBuildID 20230710165010 -prefsHandle 1080 -prefMapHandle 1072 -prefsLen 25853 -prefMapSize 243323 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d981233f-d762-47ed-b238-a0822698a3a5} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 1164 d67bbc0 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 2704 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.1.95215204\613569770" -parentBuildID 20230710165010 -prefsHandle 1396 -prefMapHandle 1392 -prefsLen 25929 -prefMapSize 243323 -appDir "C:\Program Files\Mozilla Firefox\browser" - {262146e6-3698-4908-8d1c-c87ec7bd4ca3} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 1408 f1bdee0 socket | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 3516 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.2.1353652602\459987012" -childID 1 -isForBrowser -prefsHandle 2132 -prefMapHandle 2136 -prefsLen 24503 -prefMapSize 243323 -jsInitHandle 880 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6bc4eef1-237f-4651-a461-6c042aac7060} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 2148 f1f39b0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 3996 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.3.1743348299\1908707804" -childID 2 -isForBrowser -prefsHandle 2312 -prefMapHandle 1940 -prefsLen 27510 -prefMapSize 243323 -jsInitHandle 880 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {41529ddd-83e3-4e10-858d-81701452cabb} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 2460 15966e00 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 2016 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.4.250409468\2125531531" -childID 3 -isForBrowser -prefsHandle 2624 -prefMapHandle 2628 -prefsLen 24580 -prefMapSize 243323 -jsInitHandle 880 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1864015-e8d0-48d3-bf25-33b649cdfff4} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 2612 15966f70 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 4016 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.5.1922036537\1856440180" -parentBuildID 20230710165010 -prefsHandle 3180 -prefMapHandle 3172 -prefsLen 27916 -prefMapSize 243323 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed755bb4-c2f6-4aeb-8d37-fb15408f8a49} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 3192 17e582e0 rdd | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 1664 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.6.594465973\1053541362" -childID 4 -isForBrowser -prefsHandle 2128 -prefMapHandle 2112 -prefsLen 29553 -prefMapSize 243323 -jsInitHandle 880 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {36592f02-5538-4e49-8b7e-f4a00b85aef8} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 2344 161e8f70 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 328 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.7.37539012\913730091" -childID 5 -isForBrowser -prefsHandle 3896 -prefMapHandle 3836 -prefsLen 29657 -prefMapSize 243323 -jsInitHandle 880 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0fbe692-8b88-4009-9fda-9c515f9f0635} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 3904 16fe8840 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
Total events
16 019
Read events
15 950
Write events
67
Delete events
2
Modification events
| (PID) Process: | (3436) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | delete value | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Launcher |
Value: 09611C1E1E000000 | |||
| (PID) Process: | (3436) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | delete value | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Browser |
Value: AD681C1E1E000000 | |||
| (PID) Process: | (3856) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry |
Value: 1 | |||
| (PID) Process: | (3856) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
| (PID) Process: | (3856) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableTelemetry |
Value: 1 | |||
| (PID) Process: | (3856) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent |
Value: 0 | |||
| (PID) Process: | (3856) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (3856) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 4600000040010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3856) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|ScreenX |
Value: 0 | |||
| (PID) Process: | (3856) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|ScreenY |
Value: 43 | |||
Executable files
5
Suspicious files
199
Text files
78
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3856 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\webappsstore.sqlite-wal | — | |
MD5:— | SHA256:— | |||
| 3856 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 3856 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\ls-archive-tmp.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 3856 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
| 3856 | firefox.exe | C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\updates.xml | xml | |
MD5:D9BC3A7CCB24B554BE35C97FA3D7C7D3 | SHA256:EF3711EB7E08CF646A50CCD66CB11DD88C7750BC1908CA09F5219269FEE3B348 | |||
| 3856 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extensions.json.tmp | text | |
MD5:64828B487772E9875888E8549E4B59FA | SHA256:41355BA525A9674D5E1866342823904F04C85B169C0D3BCBBFFB39366A14F4A2 | |||
| 3856 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\webappsstore.sqlite-shm | binary | |
MD5:AAC051C7589CD3ED03820E1471EEC52B | SHA256:E147A9231DE3A1CEB5AEAD821148199C9A3003C04762C72E57BF6B43B8A4C672 | |||
| 3856 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\compatibility.ini | text | |
MD5:5A14BC3397EA072906B63D69FC704FEA | SHA256:03F45724EA1FE89E753AA76B40DE9078BFC9160AA1065ED9D4D98DA04B7FB3E7 | |||
| 3856 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20230710165010 | text | |
MD5:587DDB7E8B97C1430F2C0B5724FE6522 | SHA256:14DE25DC9FEE204D77F0DA0546BDDFE134EE991CFCF4A4F762B71B4C1A0AF26D | |||
| 3856 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js | text | |
MD5:9C030FA318189A0AA0AD881357928F14 | SHA256:DE0564F84B8DCCB74EAA4C16668DD5447246052BAD3BE6C2B20332818F5A7098 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
67
DNS requests
138
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3856 | firefox.exe | POST | — | 142.250.186.163:80 | http://ocsp.pki.goog/gts1c3 | US | — | — | whitelisted |
3856 | firefox.exe | POST | — | 2.16.107.33:80 | http://r3.o.lencr.org/ | unknown | — | — | shared |
3856 | firefox.exe | GET | 200 | 23.53.40.129:80 | http://ciscobinary.openh264.org/openh264-win32-31c4d2e4a037526fd30d4e5c39f60885986cf865.zip | NL | compressed | 461 Kb | whitelisted |
3856 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | US | text | 90 b | whitelisted |
3856 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | US | text | 90 b | whitelisted |
3856 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | US | text | 8 b | whitelisted |
3856 | firefox.exe | POST | 200 | 142.250.186.163:80 | http://ocsp.pki.goog/gts1c3 | US | binary | 472 b | whitelisted |
3856 | firefox.exe | POST | 200 | 142.250.186.163:80 | http://ocsp.pki.goog/gts1c3 | US | binary | 472 b | whitelisted |
3856 | firefox.exe | POST | 200 | 2.16.107.33:80 | http://r3.o.lencr.org/ | unknown | der | 503 b | shared |
3856 | firefox.exe | POST | 200 | 2.16.107.33:80 | http://r3.o.lencr.org/ | unknown | binary | 503 b | shared |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2640 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
1068 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
3856 | firefox.exe | 34.160.144.191:443 | content-signature-2.cdn.mozilla.net | GOOGLE | US | suspicious |
3856 | firefox.exe | 142.250.181.234:443 | safebrowsing.googleapis.com | — | — | whitelisted |
3856 | firefox.exe | 95.211.229.247:443 | syndication.realsrv.com | LeaseWeb Netherlands B.V. | NL | suspicious |
3856 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | GOOGLE | US | whitelisted |
3856 | firefox.exe | 34.117.237.239:443 | contile.services.mozilla.com | GOOGLE-CLOUD-PLATFORM | US | suspicious |
3856 | firefox.exe | 142.250.186.163:80 | ocsp.pki.goog | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
syndication.realsrv.com |
| whitelisted |
detectportal.firefox.com |
| whitelisted |
tk6if76q.ab1n.net |
| suspicious |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
contile.services.mozilla.com |
| whitelisted |
example.org |
| whitelisted |
ipv4only.arpa |
| whitelisted |
spocs.getpocket.com |
| shared |
proxyserverecs-1736642167.us-east-1.elb.amazonaws.com |
| shared |
normandy.cdn.mozilla.net |
| whitelisted |