| URL: | https://tse1.explicit.bing.net |
| Full analysis: | https://app.any.run/tasks/6f94058a-4661-474a-8919-d981ff3557a9 |
| Verdict: | Malicious activity |
| Analysis date: | April 08, 2022, 13:43:13 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | 05B2B128FAE4A0263B4428F917396F96 |
| SHA1: | 4A74F17D288179967A7C9D4EBEFA123960013EDE |
| SHA256: | EF45857A396F5D624D044A102B293609AA2B1C9D64F731D5909AAD7C55444608 |
| SSDEEP: | 3:N8eAz/nR:2eADR |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Creates files in the user directory
- opera.exe (PID: 804)
- opera.exe (PID: 2528)
- firefox.exe (PID: 2380)
Manual execution by user
- opera.exe (PID: 2528)
- firefox.exe (PID: 2936)
Checks supported languages
- opera.exe (PID: 804)
- opera.exe (PID: 2528)
- firefox.exe (PID: 2936)
- firefox.exe (PID: 3184)
- firefox.exe (PID: 2380)
- firefox.exe (PID: 1840)
- firefox.exe (PID: 3672)
- firefox.exe (PID: 2824)
Reads the computer name
- opera.exe (PID: 804)
- opera.exe (PID: 2528)
- firefox.exe (PID: 2380)
- firefox.exe (PID: 3184)
- firefox.exe (PID: 2824)
- firefox.exe (PID: 1840)
- firefox.exe (PID: 3672)
Reads the date of Windows installation
- opera.exe (PID: 804)
- opera.exe (PID: 2528)
- firefox.exe (PID: 2380)
Check for Java to be installed
- opera.exe (PID: 804)
- opera.exe (PID: 2528)
Application launched itself
- firefox.exe (PID: 2936)
- firefox.exe (PID: 2380)
Reads CPU info
- firefox.exe (PID: 2380)
Creates files in the program directory
- firefox.exe (PID: 2380)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
42
Monitored processes
8
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 804 | "C:\Program Files\Opera\opera.exe" "https://tse1.explicit.bing.net" | C:\Program Files\Opera\opera.exe | Explorer.EXE | ||||||||||||
User: admin Company: Opera Software Integrity Level: MEDIUM Description: Opera Internet Browser Exit code: 0 Version: 1748 Modules
| |||||||||||||||
| 1840 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2380.6.1882863395\786763709" -childID 1 -isForBrowser -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 181 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2380 "\\.\pipe\gecko-crash-server-pipe.2380" 2404 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
| 2380 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
| 2528 | "C:\Program Files\Opera\opera.exe" | C:\Program Files\Opera\opera.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Opera Software Integrity Level: MEDIUM Description: Opera Internet Browser Exit code: 0 Version: 1748 Modules
| |||||||||||||||
| 2824 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2380.13.546532525\1760110497" -childID 2 -isForBrowser -prefsHandle 3080 -prefMapHandle 3068 -prefsLen 6644 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2380 "\\.\pipe\gecko-crash-server-pipe.2380" 3100 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
| 2936 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
| 3184 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2380.0.1092062621\281326910" -parentBuildID 20201112153044 -prefsHandle 1108 -prefMapHandle 792 -prefsLen 1 -prefMapSize 238726 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2380 "\\.\pipe\gecko-crash-server-pipe.2380" 1208 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 1 Version: 83.0 Modules
| |||||||||||||||
| 3672 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2380.20.1634302167\124174598" -childID 3 -isForBrowser -prefsHandle 3340 -prefMapHandle 3300 -prefsLen 6736 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2380 "\\.\pipe\gecko-crash-server-pipe.2380" 3336 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
Total events
7 009
Read events
6 761
Write events
248
Delete events
0
Modification events
| (PID) Process: | (804) opera.exe | Key: | HKEY_CURRENT_USER\Software\Opera Software |
| Operation: | write | Name: | Last CommandLine v2 |
Value: C:\Program Files\Opera\opera.exe "https://tse1.explicit.bing.net" | |||
| (PID) Process: | (804) opera.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2528) opera.exe | Key: | HKEY_CURRENT_USER\Software\Opera Software |
| Operation: | write | Name: | Last CommandLine v2 |
Value: C:\Program Files\Opera\opera.exe | |||
| (PID) Process: | (2528) opera.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2936) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Launcher |
Value: 80F652B50F000000 | |||
| (PID) Process: | (2380) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Browser |
Value: 0CFF52B50F000000 | |||
| (PID) Process: | (2380) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry |
Value: 0 | |||
| (PID) Process: | (2380) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
| (PID) Process: | (2380) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableTelemetry |
Value: 1 | |||
| (PID) Process: | (2380) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent |
Value: 0 | |||
Executable files
0
Suspicious files
73
Text files
39
Unknown types
12
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 804 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opr9916.tmp | text | |
MD5:CEEF8A48B186A7C07692A75C188DE6F1 | SHA256:F5533CA391F6EB89C8455CF86950E384CE992E1E7CB191E7F64EEAA082B0C798 | |||
| 804 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.ini | text | |
MD5:CEEF8A48B186A7C07692A75C188DE6F1 | SHA256:F5533CA391F6EB89C8455CF86950E384CE992E1E7CB191E7F64EEAA082B0C798 | |||
| 804 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opr9985.tmp | xml | |
MD5:E5FFB9F2366E3A701BA54BF75C9D453B | SHA256:359468828E92BBDED9C6CA212256ECFA7D8A98B4C3EC73FE38E1F08C094366D5 | |||
| 804 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xml | xml | |
MD5:E5FFB9F2366E3A701BA54BF75C9D453B | SHA256:359468828E92BBDED9C6CA212256ECFA7D8A98B4C3EC73FE38E1F08C094366D5 | |||
| 804 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.dat | binary | |
MD5:7A9B8E6842332B4077A0027159996D7F | SHA256:A9CFE1EB3768EB5F0DDB64904DB3B2CD5A6D09349C1385D9B3041546EA05DD56 | |||
| 804 | opera.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PU5UTWWO2GMO7JF49QRE.temp | binary | |
MD5:3F7590FD56AC999E0289444034C9CC80 | SHA256:632F80B7AD1F589FE608EF8546E3E7D1B0501A9EC3E38C0140EA1C10ED3E602B | |||
| 804 | opera.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\16ec093b8f51508f.customDestinations-ms | binary | |
MD5:3F7590FD56AC999E0289444034C9CC80 | SHA256:632F80B7AD1F589FE608EF8546E3E7D1B0501A9EC3E38C0140EA1C10ED3E602B | |||
| 804 | opera.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\16ec093b8f51508f.customDestinations-ms~RF10a932.TMP | binary | |
MD5:3F7590FD56AC999E0289444034C9CC80 | SHA256:632F80B7AD1F589FE608EF8546E3E7D1B0501A9EC3E38C0140EA1C10ED3E602B | |||
| 804 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win | text | |
MD5:0100E3D2A29941CEEF4E37312A7FA332 | SHA256:0C42C7737A5ABA75C8E2EA967E2A994542B2C641D0A370EDC41BC4D70A7CAC70 | |||
| 804 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opcert6.dat | binary | |
MD5:1AA8644C9261DC10F7247F6A145C1DD2 | SHA256:58A8933F65361633C6AB194000D312DC9D566F717B1A16814A0DBEE24A60EBE3 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
25
DNS requests
35
Threats
4
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2380 | firefox.exe | POST | 200 | 142.250.185.67:80 | http://ocsp.pki.goog/gts1c3 | US | der | 471 b | whitelisted |
2380 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | US | text | 8 b | whitelisted |
2380 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt | US | text | 8 b | whitelisted |
2380 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2380 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
804 | opera.exe | 185.26.182.94:443 | sitecheck2.opera.com | Opera Software AS | — | whitelisted |
804 | opera.exe | 185.26.182.111:443 | sitecheck2.opera.com | Opera Software AS | — | whitelisted |
— | — | 185.26.182.94:443 | sitecheck2.opera.com | Opera Software AS | — | whitelisted |
— | — | 185.26.182.111:443 | sitecheck2.opera.com | Opera Software AS | — | whitelisted |
804 | opera.exe | 185.26.182.93:443 | sitecheck2.opera.com | Opera Software AS | — | whitelisted |
804 | opera.exe | 93.184.220.29:80 | crl3.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2380 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | — | US | whitelisted |
2380 | firefox.exe | 18.66.248.43:443 | firefox.settings.services.mozilla.com | Massachusetts Institute of Technology | US | suspicious |
2380 | firefox.exe | 35.161.154.128:443 | location.services.mozilla.com | Amazon.com, Inc. | US | unknown |
2380 | firefox.exe | 93.184.220.29:80 | crl3.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
tse1.explicit.bing.net |
| suspicious |
sitecheck2.opera.com |
| whitelisted |
certs.opera.com |
| whitelisted |
crl3.digicert.com |
| whitelisted |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
example.org |
| whitelisted |
ipv4only.arpa |
| whitelisted |
firefox.settings.services.mozilla.com |
| whitelisted |
location.services.mozilla.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
804 | opera.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
804 | opera.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
2380 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |
2380 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |