analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://arolsen-archives.org/en/

Full analysis: https://app.any.run/tasks/b8bfd7a9-0bf4-4cd3-984e-038743bf2b50
Verdict: Malicious activity
Analysis date: May 24, 2019, 02:44:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

BC367B968CB049D0A74C424DFFDCA771

SHA1:

F8B29DB45DCCE95B29B4C656BDBC5EB7DB71D3A7

SHA256:

FAE127039CCAAB5844644EBE61D8B6F58F14E8A03489EE492C79C9D5A4EBD112

SSDEEP:

3:N81I5lT:21I5lT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Creates files in the program directory

      • firefox.exe (PID: 3332)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 3332)

  • INFO

    • Reads CPU info

      • firefox.exe (PID: 3332)

    • Reads settings of System Certificates

      • firefox.exe (PID: 3332)

    • Application launched itself

      • firefox.exe (PID: 3332)

    • Dropped object may contain Bitcoin addresses

      • firefox.exe (PID: 3332)

    • Creates files in the user directory

      • firefox.exe (PID: 3332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
7
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe pingsender.exe no specs firefox.exe

Process information

PID
CMD
Path
Indicators
Parent process
3332"C:\Program Files\Mozilla Firefox\firefox.exe" https://arolsen-archives.org/en/C:\Program Files\Mozilla Firefox\firefox.exe
explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
65.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2728"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.0.1491389032\1622747598" -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - "C:\Users\admin\AppData\LocalLow\Mozilla\Temp-{ce348e4c-7d33-445e-89f9-60108c51bcaf}" 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 1120 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
65.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1736"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.6.1995306759\233697120" -childID 1 -isForBrowser -prefsHandle 1716 -prefMapHandle 1712 -prefsLen 1 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 1736 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
65.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2540"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.13.2065260777\1516410196" -childID 2 -isForBrowser -prefsHandle 2596 -prefMapHandle 2600 -prefsLen 216 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 2612 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
65.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
3944"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.20.1754489698\1774383413" -childID 3 -isForBrowser -prefsHandle 3508 -prefMapHandle 3540 -prefsLen 5824 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 3524 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
65.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
3716"C:\Program Files\Mozilla Firefox\pingsender.exe" undefined/submit/telemetry/9f614009-22e7-47a0-8e27-c186748ab34f/update/Firefox/65.0.2/release/20190225143501?v=4 C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\9f614009-22e7-47a0-8e27-c186748ab34fC:\Program Files\Mozilla Firefox\pingsender.exe—firefox.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
1
Version:
65.0.2
Modules
Images
c:\program files\mozilla firefox\pingsender.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
3716"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3332.27.259792082\441527018" -childID 4 -isForBrowser -prefsHandle 1388 -prefMapHandle 3000 -prefsLen 7202 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3332 "\\.\pipe\gecko-crash-server-pipe.3332" 2816 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
65.0.2
Modules
Images
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\profapi.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msctf.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
Total events
1 262
Read events
1 250
Write events
12
Delete events
0

Modification events

(PID) Process:(3332) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3332) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000071000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3332) firefox.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
1
Suspicious files
140
Text files
85
Unknown types
116

Dropped files

PID
Process
Filename
Type
3332firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
3332firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\trash27417 —
MD5:—
SHA256:—
3332firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js —
MD5:—
SHA256:—
3332firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp —
MD5:—
SHA256:—
3332firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db-journal —
MD5:—
SHA256:—
3332firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm —
MD5:—
SHA256:—
3332firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:8F89A5889E1615F65674DAF6A01A2454
SHA256:F6D3FDE91836D607A3311A6E0A12463C811F791A9F231D2FF8542D772FA22ED7
3332firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:6C32CB3FD01869207E7AAE8B28598F29
SHA256:4F8ECF8007F6CC603991256AACF38224ADBA7D0A16685706072D1AADC0604303
3332firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.dbsqlite
MD5:D04EEE8FDD644DAA321C065F43509AB9
SHA256:49AF59939556B5D19B11BAA7314865F77A9C0075814F3AD385AD165A8BFC6073
3332firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\entries\181088E82499432B576D3A9B917D3149664F5253der
MD5:208823CC2C0650CA836BB6B5C9AFB76C
SHA256:C1CF32B90B153D19EA3F7DAA5712FC822F999FA750B2E9878EC7D0D9D06EE7FA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
65
DNS requests
168
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3332
firefox.exe
POST
200
172.217.21.227:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3332
firefox.exe
POST
200
172.217.21.227:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3332
firefox.exe
GET
302
52.204.4.3:80
http://download.mozilla.org/?product=firefox-67.0-complete&os=win&lang=en-US
US
html
125 b
whitelisted
3332
firefox.exe
POST
200
172.217.21.227:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3332
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3332
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3332
firefox.exe
POST
200
172.217.21.227:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3332
firefox.exe
GET
200
52.222.225.70:80
http://download.cdn.mozilla.net/pub/firefox/releases/67.0/update/win32/en-US/firefox-67.0.complete.mar
US
m
47.0 Mb
whitelisted
3332
firefox.exe
POST
200
172.217.21.227:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3332
firefox.exe
POST
200
172.217.21.227:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3332
firefox.exe
216.58.206.10:443
ajax.googleapis.com
Google Inc.
US
whitelisted
3332
firefox.exe
52.32.77.100:443
aus5.mozilla.org
Amazon.com, Inc.
US
unknown
3332
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3332
firefox.exe
2.16.186.50:80
detectportal.firefox.com
Akamai International B.V.
—
whitelisted
3332
firefox.exe
172.217.21.227:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3332
firefox.exe
78.46.148.194:443
arolsen-archives.org
Hetzner Online GmbH
DE
unknown
3332
firefox.exe
52.88.179.171:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
3332
firefox.exe
52.222.225.85:443
snippets.cdn.mozilla.net
—
US
unknown
3332
firefox.exe
34.210.151.118:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
3332
firefox.exe
172.217.22.10:443
ajax.googleapis.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
arolsen-archives.org
  • 78.46.148.194
unknown
detectportal.firefox.com
  • 2.16.186.50
  • 2.16.186.112
whitelisted
aus5.mozilla.org
  • 52.32.77.100
  • 54.148.138.18
  • 54.244.6.221
  • 34.216.134.104
  • 34.218.159.169
  • 54.148.105.101
  • 52.43.79.30
  • 52.40.226.98
  • 34.214.241.105
whitelisted
a1089.dscd.akamai.net
  • 2.16.186.112
  • 2.16.186.50
whitelisted
balrog-aus5.r53-2.services.mozilla.com
  • 52.40.226.98
  • 52.43.79.30
  • 54.148.105.101
  • 34.218.159.169
  • 34.216.134.104
  • 54.244.6.221
  • 54.148.138.18
  • 52.32.77.100
  • 34.214.241.105
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
search.services.mozilla.com
  • 52.88.179.171
  • 52.27.173.161
  • 52.10.97.252
whitelisted
cs9.wac.phicdn.net
  • 93.184.220.29
whitelisted
search.r53-2.services.mozilla.com
  • 52.10.97.252
  • 52.27.173.161
  • 52.88.179.171
whitelisted
tiles.services.mozilla.com
  • 34.210.151.118
  • 52.25.71.236
  • 54.149.115.79
  • 34.213.89.114
  • 35.164.130.113
  • 34.209.86.85
  • 54.186.163.246
  • 34.208.138.0
  • 52.43.91.152
  • 52.42.232.148
  • 52.34.132.219
  • 52.35.96.157
  • 52.27.87.181
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://arolsen-archives.org/en/