| URL: | https://tse1.explicit.bing.net |
| Full analysis: | https://app.any.run/tasks/6f94058a-4661-474a-8919-d981ff3557a9 |
| Verdict: | Malicious activity |
| Analysis date: | April 08, 2022, 13:43:13 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | 05B2B128FAE4A0263B4428F917396F96 |
| SHA1: | 4A74F17D288179967A7C9D4EBEFA123960013EDE |
| SHA256: | EF45857A396F5D624D044A102B293609AA2B1C9D64F731D5909AAD7C55444608 |
| SSDEEP: | 3:N8eAz/nR:2eADR |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Checks supported languages
- opera.exe (PID: 804)
- opera.exe (PID: 2528)
- firefox.exe (PID: 2380)
- firefox.exe (PID: 3184)
- firefox.exe (PID: 2936)
- firefox.exe (PID: 1840)
- firefox.exe (PID: 3672)
- firefox.exe (PID: 2824)
Check for Java to be installed
- opera.exe (PID: 804)
- opera.exe (PID: 2528)
Reads the computer name
- opera.exe (PID: 2528)
- firefox.exe (PID: 3184)
- opera.exe (PID: 804)
- firefox.exe (PID: 2380)
- firefox.exe (PID: 3672)
- firefox.exe (PID: 1840)
- firefox.exe (PID: 2824)
Creates files in the user directory
- opera.exe (PID: 2528)
- opera.exe (PID: 804)
- firefox.exe (PID: 2380)
Reads the date of Windows installation
- opera.exe (PID: 2528)
- opera.exe (PID: 804)
- firefox.exe (PID: 2380)
Manual execution by user
- firefox.exe (PID: 2936)
- opera.exe (PID: 2528)
Application launched itself
- firefox.exe (PID: 2936)
- firefox.exe (PID: 2380)
Reads CPU info
- firefox.exe (PID: 2380)
Creates files in the program directory
- firefox.exe (PID: 2380)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
42
Monitored processes
8
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 804 | "C:\Program Files\Opera\opera.exe" "https://tse1.explicit.bing.net" | C:\Program Files\Opera\opera.exe | Explorer.EXE | ||||||||||||
User: admin Company: Opera Software Integrity Level: MEDIUM Description: Opera Internet Browser Exit code: 0 Version: 1748 Modules
| |||||||||||||||
| 1840 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2380.6.1882863395\786763709" -childID 1 -isForBrowser -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 181 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2380 "\\.\pipe\gecko-crash-server-pipe.2380" 2404 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
| 2380 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
| 2528 | "C:\Program Files\Opera\opera.exe" | C:\Program Files\Opera\opera.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Opera Software Integrity Level: MEDIUM Description: Opera Internet Browser Exit code: 0 Version: 1748 Modules
| |||||||||||||||
| 2824 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2380.13.546532525\1760110497" -childID 2 -isForBrowser -prefsHandle 3080 -prefMapHandle 3068 -prefsLen 6644 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2380 "\\.\pipe\gecko-crash-server-pipe.2380" 3100 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
| 2936 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
| 3184 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2380.0.1092062621\281326910" -parentBuildID 20201112153044 -prefsHandle 1108 -prefMapHandle 792 -prefsLen 1 -prefMapSize 238726 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2380 "\\.\pipe\gecko-crash-server-pipe.2380" 1208 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 1 Version: 83.0 Modules
| |||||||||||||||
| 3672 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2380.20.1634302167\124174598" -childID 3 -isForBrowser -prefsHandle 3340 -prefMapHandle 3300 -prefsLen 6736 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2380 "\\.\pipe\gecko-crash-server-pipe.2380" 3336 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
Total events
7 009
Read events
6 761
Write events
248
Delete events
0
Modification events
| (PID) Process: | (804) opera.exe | Key: | HKEY_CURRENT_USER\Software\Opera Software |
| Operation: | write | Name: | Last CommandLine v2 |
Value: C:\Program Files\Opera\opera.exe "https://tse1.explicit.bing.net" | |||
| (PID) Process: | (804) opera.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2528) opera.exe | Key: | HKEY_CURRENT_USER\Software\Opera Software |
| Operation: | write | Name: | Last CommandLine v2 |
Value: C:\Program Files\Opera\opera.exe | |||
| (PID) Process: | (2528) opera.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2936) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Launcher |
Value: 80F652B50F000000 | |||
| (PID) Process: | (2380) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Browser |
Value: 0CFF52B50F000000 | |||
| (PID) Process: | (2380) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry |
Value: 0 | |||
| (PID) Process: | (2380) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
| (PID) Process: | (2380) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableTelemetry |
Value: 1 | |||
| (PID) Process: | (2380) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent |
Value: 0 | |||
Executable files
0
Suspicious files
73
Text files
39
Unknown types
12
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 804 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.ini | text | |
MD5:— | SHA256:— | |||
| 804 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opr9916.tmp | text | |
MD5:— | SHA256:— | |||
| 804 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opr9985.tmp | xml | |
MD5:— | SHA256:— | |||
| 804 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xml | xml | |
MD5:— | SHA256:— | |||
| 804 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win.bak | text | |
MD5:46A734B275C8C258D9D6F508E73B36AD | SHA256:B80192EDC377DD212C9E488E1983FBCD68CF83330576EFD7579B7AB30FA3672B | |||
| 804 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.dat | binary | |
MD5:— | SHA256:— | |||
| 804 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\opr9906.tmp | text | |
MD5:0100E3D2A29941CEEF4E37312A7FA332 | SHA256:0C42C7737A5ABA75C8E2EA967E2A994542B2C641D0A370EDC41BC4D70A7CAC70 | |||
| 804 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win | text | |
MD5:0100E3D2A29941CEEF4E37312A7FA332 | SHA256:0C42C7737A5ABA75C8E2EA967E2A994542B2C641D0A370EDC41BC4D70A7CAC70 | |||
| 804 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opicacrt6.dat | binary | |
MD5:82F1A2B1176A5ECC457D32301E2AD833 | SHA256:A783052804DD4C232BE2ED3DC00C430CB67A20370890E235562ED2B27B5A602E | |||
| 804 | opera.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7PAT9IFB029RRFD8MIFZ.temp | binary | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
25
DNS requests
35
Threats
4
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2380 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2380 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt | US | text | 8 b | whitelisted |
2380 | firefox.exe | POST | 200 | 142.250.185.67:80 | http://ocsp.pki.goog/gts1c3 | US | der | 471 b | whitelisted |
2380 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2380 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | US | text | 8 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
804 | opera.exe | 185.26.182.94:443 | sitecheck2.opera.com | Opera Software AS | — | whitelisted |
804 | opera.exe | 185.26.182.111:443 | sitecheck2.opera.com | Opera Software AS | — | whitelisted |
— | — | 185.26.182.94:443 | sitecheck2.opera.com | Opera Software AS | — | whitelisted |
— | — | 185.26.182.111:443 | sitecheck2.opera.com | Opera Software AS | — | whitelisted |
804 | opera.exe | 185.26.182.93:443 | sitecheck2.opera.com | Opera Software AS | — | whitelisted |
804 | opera.exe | 93.184.220.29:80 | crl3.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2380 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | — | US | whitelisted |
2380 | firefox.exe | 18.66.248.43:443 | firefox.settings.services.mozilla.com | Massachusetts Institute of Technology | US | suspicious |
2380 | firefox.exe | 35.161.154.128:443 | location.services.mozilla.com | Amazon.com, Inc. | US | unknown |
2380 | firefox.exe | 93.184.220.29:80 | crl3.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
tse1.explicit.bing.net |
| suspicious |
sitecheck2.opera.com |
| whitelisted |
certs.opera.com |
| whitelisted |
crl3.digicert.com |
| whitelisted |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
example.org |
| whitelisted |
ipv4only.arpa |
| whitelisted |
firefox.settings.services.mozilla.com |
| whitelisted |
location.services.mozilla.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
804 | opera.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
804 | opera.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
2380 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |
2380 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |