| URL: | https://canyoublockit.com/extreme-test/ |
| Full analysis: | https://app.any.run/tasks/d10a22c1-f0de-4ed6-a9a8-f9e064ada81b |
| Verdict: | Malicious activity |
| Analysis date: | January 01, 2024, 21:12:06 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | 58B3F545C4382580B4F49590DE1C2152 |
| SHA1: | 0F80ED265AD7F0A99F6630594178C74071CB6E3F |
| SHA256: | D9E246324995FC8B405CB41FA51E00B7B9FD78D4305C82F81D00CC5B29AFE73B |
| SSDEEP: | 3:N8ZLcldOFLqn:2WldOBqn |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 116 | "C:\Program Files\Mozilla Firefox\firefox.exe" https://canyoublockit.com/extreme-test/ | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 668 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="116.1.371810183\1168226357" -parentBuildID 20230710165010 -prefsHandle 1408 -prefMapHandle 1404 -prefsLen 28600 -prefMapSize 244195 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98e82329-7136-4a91-a4a0-a49ceeca7b4c} 116 "\\.\pipe\gecko-crash-server-pipe.116" 1432 ee42f40 socket | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 712 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="116.16.2092099054\654835274" -childID 12 -isForBrowser -prefsHandle 3304 -prefMapHandle 3764 -prefsLen 31535 -prefMapSize 244195 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {28ebbb0a-03e5-4a30-a3be-437fc947dade} 116 "\\.\pipe\gecko-crash-server-pipe.116" 7536 19dfc110 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 984 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="116.13.819147417\757872997" -childID 10 -isForBrowser -prefsHandle 4068 -prefMapHandle 4076 -prefsLen 31122 -prefMapSize 244195 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d49e631-2347-41ee-b67c-f81fec5e948c} 116 "\\.\pipe\gecko-crash-server-pipe.116" 3932 1d6fe6d0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1732 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="116.22.1142063805\545493622" -childID 18 -isForBrowser -prefsHandle 7376 -prefMapHandle 2752 -prefsLen 31682 -prefMapSize 244195 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9cc8ac18-68e8-4dbf-997c-4d0d89ddfd79} 116 "\\.\pipe\gecko-crash-server-pipe.116" 7116 19dfc3f0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1736 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="116.2.192806513\2013417102" -childID 1 -isForBrowser -prefsHandle 2040 -prefMapHandle 1932 -prefsLen 24491 -prefMapSize 244195 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f3de153-fb58-4355-b73e-f5acfea03b21} 116 "\\.\pipe\gecko-crash-server-pipe.116" 2084 12b8a3f0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1976 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="116.12.1188983684\1725883238" -childID 9 -isForBrowser -prefsHandle 3080 -prefMapHandle 3084 -prefsLen 31122 -prefMapSize 244195 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f582ec8-9cc3-43f2-b6e9-f81054e4a315} 116 "\\.\pipe\gecko-crash-server-pipe.116" 8212 1d6d3f70 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2016 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="116.0.2025115656\966619025" -parentBuildID 20230710165010 -prefsHandle 1112 -prefMapHandle 1104 -prefsLen 28523 -prefMapSize 244195 -appDir "C:\Program Files\Mozilla Firefox\browser" - {809241bc-389b-41e5-b46e-59a499132f91} 116 "\\.\pipe\gecko-crash-server-pipe.116" 1184 d5a9510 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2184 | "C:\Program Files\Mozilla Firefox\firefox.exe" "https://canyoublockit.com/extreme-test/" | C:\Program Files\Mozilla Firefox\firefox.exe | — | explorer.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2584 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="116.15.554782882\1855550276" -parentBuildID 20230710165010 -sandboxingKind 0 -prefsHandle 4080 -prefMapHandle 4084 -prefsLen 36705 -prefMapSize 244195 -appDir "C:\Program Files\Mozilla Firefox\browser" - {564250bd-57ae-45f0-92b9-02f2b671e235} 116 "\\.\pipe\gecko-crash-server-pipe.116" 8220 17f049d0 utility | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| (PID) Process: | (2184) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Launcher |
Value: 2166C0A101000000 | |||
| (PID) Process: | (116) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Browser |
Value: 044CC1A101000000 | |||
| (PID) Process: | (116) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry |
Value: 0 | |||
| (PID) Process: | (116) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
| (PID) Process: | (116) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Theme |
Value: 1 | |||
| (PID) Process: | (116) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Enabled |
Value: 1 | |||
| (PID) Process: | (116) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableTelemetry |
Value: 1 | |||
| (PID) Process: | (116) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent |
Value: 0 | |||
| (PID) Process: | (116) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|SetDefaultBrowserUserChoice |
Value: 1 | |||
| (PID) Process: | (116) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|AppLastRunTime |
Value: D14E5F3C23B0D901 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 116 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
| 116 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.bin | binary | |
MD5:B7A3C61D0C144CC5E166B1E769CA8F8C | SHA256:7FADCB77FFACA6B9E9F15C6F1CD3AAD4C20DCD90FA92429A627A3A7110CA2644 | |||
| 116 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 116 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js | text | |
MD5:60E0DE9E05EC76C749D80F0D15A81B21 | SHA256:08252FA62CCCCD316474E20CC7317A6B5C932B2C972234318E8CCDA39EC2EF48 | |||
| 116 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 116 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js | text | |
MD5:60E0DE9E05EC76C749D80F0D15A81B21 | SHA256:08252FA62CCCCD316474E20CC7317A6B5C932B2C972234318E8CCDA39EC2EF48 | |||
| 116 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db-journal | binary | |
MD5:20BD123A90EEE765A7DBB51ABB369145 | SHA256:B97A0D5E262F0D4B05D015617D6C7C161649201C85F3447671C6A500838B2130 | |||
| 116 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 116 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 116 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
116 | firefox.exe | POST | 200 | 216.58.206.35:80 | http://ocsp.pki.goog/gts1c3 | unknown | binary | 471 b | unknown |
116 | firefox.exe | POST | 200 | 2.16.202.121:80 | http://r3.o.lencr.org/ | unknown | binary | 503 b | unknown |
116 | firefox.exe | POST | 200 | 2.16.202.121:80 | http://r3.o.lencr.org/ | unknown | binary | 503 b | unknown |
116 | firefox.exe | POST | 200 | 2.16.202.121:80 | http://r3.o.lencr.org/ | unknown | binary | 503 b | unknown |
116 | firefox.exe | POST | 200 | 216.58.206.35:80 | http://ocsp.pki.goog/gts1c3 | unknown | binary | 471 b | unknown |
116 | firefox.exe | POST | 200 | 95.101.54.131:80 | http://r3.o.lencr.org/ | unknown | binary | 503 b | unknown |
116 | firefox.exe | POST | 200 | 18.245.147.27:80 | http://ocsp.r2m02.amazontrust.com/ | unknown | binary | 471 b | unknown |
116 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | unknown | text | 90 b | unknown |
116 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | text | 8 b | unknown |
116 | firefox.exe | POST | 200 | 216.58.206.35:80 | http://ocsp.pki.goog/gts1c3 | unknown | binary | 472 b | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
116 | firefox.exe | 34.117.237.239:443 | contile.services.mozilla.com | GOOGLE-CLOUD-PLATFORM | US | unknown |
116 | firefox.exe | 216.58.206.42:443 | safebrowsing.googleapis.com | — | — | whitelisted |
116 | firefox.exe | 3.226.103.37:443 | spocs.getpocket.com | AMAZON-AES | US | unknown |
116 | firefox.exe | 216.58.206.35:80 | ocsp.pki.goog | GOOGLE | US | whitelisted |
116 | firefox.exe | 2.16.202.121:80 | r3.o.lencr.org | Akamai International B.V. | NL | unknown |
116 | firefox.exe | 34.149.100.209:443 | firefox.settings.services.mozilla.com | GOOGLE | US | unknown |
116 | firefox.exe | 34.160.144.191:443 | content-signature-2.cdn.mozilla.net | GOOGLE | US | unknown |
Domain | IP | Reputation |
|---|---|---|
canyoublockit.com |
| whitelisted |
detectportal.firefox.com |
| whitelisted |
contile.services.mozilla.com |
| whitelisted |
spocs.getpocket.com |
| shared |
proxyserverecs-1736642167.us-east-1.elb.amazonaws.com |
| shared |
r3.o.lencr.org |
| shared |
firefox.settings.services.mozilla.com |
| whitelisted |
a1887.dscq.akamai.net |
| whitelisted |
prod.remote-settings.prod.webservices.mozgcp.net |
| whitelisted |
safebrowsing.googleapis.com |
| whitelisted |