URL:

https://telegra.ph/New-Soft-2023-02-14

Full analysis: https://app.any.run/tasks/0e1ac7b4-3efa-45bf-9e69-5b117c0d05b0
Verdict: Malicious activity
Analysis date: April 05, 2023, 21:36:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

9F60CDBC7E3ED32069C03E623ECFCFCC

SHA1:

A5C6AEEC8F9919840AED89D7CA219C8783206F70

SHA256:

F7E84962F7F4CE3BB34CA2E7DBDED736267E0D9A41A8029A82639BE522A2B370

SSDEEP:

3:N8IEukIVPn:2IEukIVP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • firefox.exe (PID: 2424)

  • INFO

    • Application launched itself

      • firefox.exe (PID: 2424)
      • firefox.exe (PID: 2884)

    • Create files in a temporary directory

      • firefox.exe (PID: 2424)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
7
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2420"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2424.6.1949151576\1500939026" -childID 1 -isForBrowser -prefsHandle 3772 -prefMapHandle 3768 -prefsLen 181 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2424 "\\.\pipe\gecko-crash-server-pipe.2424" 3784 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msasn1.dll
2424"C:\Program Files\Mozilla Firefox\firefox.exe" https://telegra.ph/New-Soft-2023-02-14C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\rpcrt4.dll
2772"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2424.27.1667268034\1572464886" -childID 4 -isForBrowser -prefsHandle 3156 -prefMapHandle 2664 -prefsLen 7307 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2424 "\\.\pipe\gecko-crash-server-pipe.2424" 2628 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msasn1.dll
2884"C:\Program Files\Mozilla Firefox\firefox.exe" "https://telegra.ph/New-Soft-2023-02-14"C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\advapi32.dll
3060"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2424.20.71451154\421503844" -childID 3 -isForBrowser -prefsHandle 3156 -prefMapHandle 3160 -prefsLen 7307 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2424 "\\.\pipe\gecko-crash-server-pipe.2424" 3188 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msasn1.dll
3680"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2424.0.553001096\1564273319" -parentBuildID 20201112153044 -prefsHandle 1092 -prefMapHandle 800 -prefsLen 1 -prefMapSize 238726 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2424 "\\.\pipe\gecko-crash-server-pipe.2424" 1172 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\rpcrt4.dll
3708"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2424.13.232868157\505904092" -childID 2 -isForBrowser -prefsHandle 3356 -prefMapHandle 2224 -prefsLen 6644 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2424 "\\.\pipe\gecko-crash-server-pipe.2424" 3232 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
Total events
13 842
Read events
13 794
Write events
48
Delete events
0

Modification events

(PID) Process:(2884) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Launcher
Value:
09611C1E1E000000
(PID) Process:(2424) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
AD681C1E1E000000
(PID) Process:(2424) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry
Value:
0
(PID) Process:(2424) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(2424) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableTelemetry
Value:
1
(PID) Process:(2424) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent
Value:
0
(PID) Process:(2424) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|ServicesSettingsServer
Value:
https://firefox.settings.services.mozilla.com/v1
(PID) Process:(2424) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|SecurityContentSignatureRootHash
Value:
97:E8:BA:9C:F1:2F:B3:DE:53:CC:42:A4:E6:57:7E:D6:4D:F4:93:C2:47:B4:14:FE:A0:36:81:8D:38:23:56:0E
(PID) Process:(2424) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2424) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
0
Suspicious files
38
Text files
24
Unknown types
16

Dropped files

PID
Process
Filename
Type
2424firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
2424firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-new.bin —
MD5:—
SHA256:—
2424firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache.bin —
MD5:—
SHA256:—
2424firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\recovery.jsonlz4jsonlz4
MD5:—
SHA256:—
2424firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-wal —
MD5:—
SHA256:—
2424firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-new.binbinary
MD5:—
SHA256:—
2424firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\recovery.jsonlz4.tmpjsonlz4
MD5:—
SHA256:—
2424firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-new.binbinary
MD5:—
SHA256:—
2424firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache.binbinary
MD5:—
SHA256:—
2424firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child.binbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
44
DNS requests
65
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2424
firefox.exe
35.244.181.201:443
aus5.mozilla.org
GOOGLE
US
suspicious
2424
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
2424
firefox.exe
149.154.164.13:443
telegra.ph
Telegram Messenger Inc
GB
suspicious
2424
firefox.exe
35.241.9.150:443
firefox.settings.services.mozilla.com
GOOGLE
US
suspicious
2424
firefox.exe
52.38.245.94:443
location.services.mozilla.com
AMAZON-02
US
unknown
—
—
149.154.164.13:443
telegra.ph
Telegram Messenger Inc
GB
suspicious
2424
firefox.exe
35.162.160.191:443
push.services.mozilla.com
AMAZON-02
US
unknown
2424
firefox.exe
44.241.53.229:443
shavar.services.mozilla.com
AMAZON-02
US
unknown
—
—
44.241.53.229:443
shavar.services.mozilla.com
AMAZON-02
US
unknown
2424
firefox.exe
2.16.106.209:80
ciscobinary.openh264.org
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 34.107.221.82
whitelisted
telegra.ph
  • 149.154.164.13
malicious
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
location.services.mozilla.com
  • 52.38.245.94
  • 35.165.145.80
  • 52.40.44.47
  • 52.33.22.51
  • 35.83.159.54
  • 54.187.233.68
whitelisted
firefox.settings.services.mozilla.com
  • 35.241.9.150
whitelisted
locprod2-elb-us-west-2.prod.mozaws.net
  • 54.187.233.68
  • 35.83.159.54
  • 52.33.22.51
  • 52.40.44.47
  • 35.165.145.80
  • 52.38.245.94
whitelisted
safebrowsing.googleapis.com
  • 142.250.186.138
  • 2a00:1450:4001:811::200a
whitelisted
push.services.mozilla.com
  • 34.117.65.55
  • 35.162.160.191
  • 34.209.185.33
  • 52.42.244.254
  • 34.218.147.141
  • 35.164.227.207
  • 35.155.15.231
  • 44.238.120.190
  • 35.81.58.203
whitelisted
autopush.prod.mozaws.net
  • 34.117.65.55
  • 35.81.58.203
  • 44.238.120.190
  • 35.155.15.231
  • 35.164.227.207
  • 34.218.147.141
  • 52.42.244.254
  • 34.209.185.33
  • 35.162.160.191
whitelisted
www.facebook.com
  • 157.240.252.35
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://telegra.ph/New-Soft-2023-02-14