| URL: | https://protection.greathorn.com/services/v2/lookupUrl/0b580184-6ca3-41ad-b7ac-af842ef198f5/222/5e698016cbe1d71415c56c04fe7a8e8f87976def?domain=axufcs.space&path=/bonus/com-soam-cc-s10-ipx-cdn/co-lp1.php |
| Full analysis: | https://app.any.run/tasks/0abb27ab-29b4-47b2-b3e8-f23b6dd8bbc0 |
| Verdict: | Malicious activity |
| Analysis date: | July 17, 2023, 12:48:47 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | 06B1E213BCF801EFF42960254BF0E3E4 |
| SHA1: | 834C3FA7152FF8EFA5C14A11A7BD2BE89C7F8F29 |
| SHA256: | E25CEAB82141A0EB0F5BA89E6197F03CB3AE9D3105D9F26AB5F641F7471D226E |
| SSDEEP: | 6:2WmgLd3WyAGkcoZBXjmtVKjTRXaANVJE10YKT:2iZmpG/oTTBhWKT |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 240 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3852.0.244887353\2015141740" -parentBuildID 20230710165010 -prefsHandle 1088 -prefMapHandle 1080 -prefsLen 25853 -prefMapSize 243323 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4418eb46-2a12-4d97-8563-c057b6c61ad4} 3852 "\\.\pipe\gecko-crash-server-pipe.3852" 1172 d67b350 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1656 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3852.9.1913186658\1640728853" -childID 7 -isForBrowser -prefsHandle 2204 -prefMapHandle 3852 -prefsLen 33044 -prefMapSize 243323 -jsInitHandle 904 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c1d93c1-7611-4320-9c7c-8ad48f9ab103} 3852 "\\.\pipe\gecko-crash-server-pipe.3852" 4172 1a4a2280 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2000 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3852.3.1318982111\1908707804" -childID 2 -isForBrowser -prefsHandle 1848 -prefMapHandle 1964 -prefsLen 27510 -prefMapSize 243323 -jsInitHandle 904 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ba0952b-3f97-4eb3-8ad9-85c86835aeef} 3852 "\\.\pipe\gecko-crash-server-pipe.3852" 2400 15e87f70 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2740 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3852.1.95215204\2110587228" -parentBuildID 20230710165010 -prefsHandle 1404 -prefMapHandle 1400 -prefsLen 25929 -prefMapSize 243323 -appDir "C:\Program Files\Mozilla Firefox\browser" - {be0549a1-942f-4061-82b6-409deff63cfe} 3852 "\\.\pipe\gecko-crash-server-pipe.3852" 1416 f3bb8a0 socket | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2796 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3852.7.852397091\1034667612" -childID 5 -isForBrowser -prefsHandle 3844 -prefMapHandle 3856 -prefsLen 29657 -prefMapSize 243323 -jsInitHandle 904 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6e81434-756a-41bf-b32e-a7e3b0aa487f} 3852 "\\.\pipe\gecko-crash-server-pipe.3852" 3944 199d8c90 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2884 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3852.6.609932490\588771031" -childID 4 -isForBrowser -prefsHandle 3808 -prefMapHandle 3788 -prefsLen 29657 -prefMapSize 243323 -jsInitHandle 904 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec38cc88-6de8-41b0-9530-a90bfad19a33} 3852 "\\.\pipe\gecko-crash-server-pipe.3852" 3832 16fbb840 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2976 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3852.4.2110747938\1147367746" -childID 3 -isForBrowser -prefsHandle 1764 -prefMapHandle 1768 -prefsLen 24580 -prefMapSize 243323 -jsInitHandle 904 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eef730ba-94e1-4d60-881c-40f4daf572d5} 3852 "\\.\pipe\gecko-crash-server-pipe.3852" 2472 15e87280 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 3400 | "C:\Program Files\Mozilla Firefox\firefox.exe" "https://protection.greathorn.com/services/v2/lookupUrl/0b580184-6ca3-41ad-b7ac-af842ef198f5/222/5e698016cbe1d71415c56c04fe7a8e8f87976def?domain=axufcs.space&path=/bonus/com-soam-cc-s10-ipx-cdn/co-lp1.php" | C:\Program Files\Mozilla Firefox\firefox.exe | — | explorer.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 3656 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3852.5.870712007\521324837" -parentBuildID 20230710165010 -prefsHandle 3120 -prefMapHandle 3116 -prefsLen 27916 -prefMapSize 243323 -appDir "C:\Program Files\Mozilla Firefox\browser" - {902ba9d7-5164-49b3-82aa-30f82bda6e9e} 3852 "\\.\pipe\gecko-crash-server-pipe.3852" 3132 16c889e0 rdd | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 3780 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3852.2.966736862\500641131" -childID 1 -isForBrowser -prefsHandle 1852 -prefMapHandle 2072 -prefsLen 24503 -prefMapSize 243323 -jsInitHandle 904 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d09bad1b-f963-4102-80c4-24ec74ea9a83} 3852 "\\.\pipe\gecko-crash-server-pipe.3852" 1996 f3a3f70 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| (PID) Process: | (3400) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | delete value | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Launcher |
Value: 09611C1E1E000000 | |||
| (PID) Process: | (3400) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | delete value | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Browser |
Value: AD681C1E1E000000 | |||
| (PID) Process: | (3852) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry |
Value: 1 | |||
| (PID) Process: | (3852) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
| (PID) Process: | (3852) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableTelemetry |
Value: 1 | |||
| (PID) Process: | (3852) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent |
Value: 0 | |||
| (PID) Process: | (3852) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (3852) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 4600000040010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3852) firefox.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3852 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\webappsstore.sqlite-wal | — | |
MD5:— | SHA256:— | |||
| 3852 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\permissions.sqlite-journal | binary | |
MD5:D42EB78D5C69B5EA5A98469CA379D8F4 | SHA256:5B1792FB54BD3A6CB095172DFE1661320272F40E72B237426D4D600C9566F12D | |||
| 3852 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 3852 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20230710165010 | text | |
MD5:D0ECB04194521EB4053E4628759CD819 | SHA256:5BE61345303F9D37963CD1ECC3E2DEDD6237409AA6828FCA73FF171CB2B3FEF1 | |||
| 3852 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\compatibility.ini | text | |
MD5:5A14BC3397EA072906B63D69FC704FEA | SHA256:03F45724EA1FE89E753AA76B40DE9078BFC9160AA1065ED9D4D98DA04B7FB3E7 | |||
| 3852 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extensions.json | text | |
MD5:DCB7D98619AD8F48B27A856840EA57C8 | SHA256:22D71054043C265C91591D65B9046560FA32FEE2EB9BF00678B2FE01D815FC1A | |||
| 3852 | firefox.exe | C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json | binary | |
MD5:E812E56D0B6EDF84B4A0B959F53E239F | SHA256:D55B72651CD0C5B834EAA29BA778BE7EDC357C16163A77AE778DCD61E85C3582 | |||
| 3852 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js | text | |
MD5:14ADADF56A4D7E02F85302256536E2AE | SHA256:059A26AD577F5D719F46528F0EE1C2F3A3D22CB3A25EE39C9CC46988837236A9 | |||
| 3852 | firefox.exe | C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\updates.xml | xml | |
MD5:D9BC3A7CCB24B554BE35C97FA3D7C7D3 | SHA256:EF3711EB7E08CF646A50CCD66CB11DD88C7750BC1908CA09F5219269FEE3B348 | |||
| 3852 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js | text | |
MD5:14ADADF56A4D7E02F85302256536E2AE | SHA256:059A26AD577F5D719F46528F0EE1C2F3A3D22CB3A25EE39C9CC46988837236A9 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3852 | firefox.exe | POST | — | 2.16.202.121:80 | http://r3.o.lencr.org/ | NL | — | — | shared |
3852 | firefox.exe | POST | 200 | 2.16.202.121:80 | http://r3.o.lencr.org/ | NL | binary | 503 b | shared |
3852 | firefox.exe | POST | 200 | 2.16.202.121:80 | http://r3.o.lencr.org/ | NL | binary | 503 b | shared |
3852 | firefox.exe | POST | — | 13.225.35.229:80 | http://ocsp.r2m02.amazontrust.com/ | US | — | — | whitelisted |
3852 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | US | text | 90 b | whitelisted |
3852 | firefox.exe | POST | 200 | 2.16.202.121:80 | http://r3.o.lencr.org/ | NL | binary | 503 b | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3852 | firefox.exe | 3.229.85.40:443 | spocs.getpocket.com | AMAZON-AES | US | unknown |
3852 | firefox.exe | 142.250.185.202:443 | safebrowsing.googleapis.com | GOOGLE | US | whitelisted |
3852 | firefox.exe | 2.16.202.121:80 | r3.o.lencr.org | Akamai International B.V. | NL | suspicious |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2640 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
3852 | firefox.exe | 34.117.237.239:443 | contile.services.mozilla.com | GOOGLE-CLOUD-PLATFORM | US | suspicious |
3852 | firefox.exe | 34.98.75.36:443 | classify-client.services.mozilla.com | GOOGLE | US | suspicious |
3852 | firefox.exe | 13.225.35.229:80 | ocsp.r2m02.amazontrust.com | AMAZON-02 | US | unknown |
3852 | firefox.exe | 52.222.149.95:443 | protection.greathorn.com | AMAZON-02 | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
protection.greathorn.com |
| suspicious |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
d2rzsaos5pdse6.cloudfront.net |
| suspicious |
example.org |
| whitelisted |
ipv4only.arpa |
| whitelisted |
contile.services.mozilla.com |
| whitelisted |
spocs.getpocket.com |
| shared |
proxyserverecs-1736642167.us-east-1.elb.amazonaws.com |
| shared |
normandy.cdn.mozilla.net |
| whitelisted |