analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://www.z2.com

Full analysis: https://app.any.run/tasks/96ede52f-5709-49bb-a9c1-a079b8a8dc36
Verdict: Malicious activity
Analysis date: January 17, 2019, 20:23:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

22117A774C0D6615B1E4A13A5EC480E1

SHA1:

040B104F84B522A48A7870520275A87982244C40

SHA256:

0EEE1FE4DE460677D29494A31F8A1D3F478E1E10B3D6D32C137CCE391ACA9432

SSDEEP:

3:N1KJS4DdI:Cc4DK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Reads CPU info

      • firefox.exe (PID: 3024)
      • firefox.exe (PID: 3952)
      • firefox.exe (PID: 3372)
      • firefox.exe (PID: 2916)
    • Application launched itself

      • firefox.exe (PID: 3372)
    • Creates files in the user directory

      • firefox.exe (PID: 3372)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
4
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start firefox.exe firefox.exe firefox.exe firefox.exe

Process information

PID
CMD
Path
Indicators
Parent process
3372"C:\Program Files\Mozilla Firefox\firefox.exe" http://www.z2.comC:\Program Files\Mozilla Firefox\firefox.exe
explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
61.0.2
3024"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3372.0.371004064\669345918" -childID 1 -isForBrowser -prefsHandle 1464 -prefsLen 8310 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3372 "\\.\pipe\gecko-crash-server-pipe.3372" 1512 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
61.0.2
3952"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3372.6.255140475\265724514" -childID 2 -isForBrowser -prefsHandle 2420 -prefsLen 11442 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3372 "\\.\pipe\gecko-crash-server-pipe.3372" 2416 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
61.0.2
2916"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3372.12.756071981\869299423" -childID 3 -isForBrowser -prefsHandle 2616 -prefsLen 12017 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3372 "\\.\pipe\gecko-crash-server-pipe.3372" 3112 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
61.0.2
Total events
593
Read events
591
Write events
2
Delete events
0

Modification events

(PID) Process:(3372) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3372) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
Executable files
0
Suspicious files
120
Text files
38
Unknown types
41

Dropped files

PID
Process
Filename
Type
3372firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm
MD5:
SHA256:
3372firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp
MD5:
SHA256:
3372firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js
MD5:
SHA256:
3372firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm
MD5:
SHA256:
3372firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm
MD5:
SHA256:
3372firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm
MD5:
SHA256:
3372firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm
MD5:
SHA256:
3372firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\base-track-digest256.sbstorebinary
MD5:CD82F4495EAFE523B9B6B938C828611B
SHA256:576A0D2C3AD8D66BB202439B18F9FD563F92D9DDD9582A3C4CCE0ECAFD4F0908
3372firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:7D8ECE9FA69B97549CA4E12ADF74E19C
SHA256:FDFC10B45C559CCDC971C2B129DE9FE0E76E69344AE058B5FBB1C0EFC56A3CEA
3372firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\google4\goog-badbinurl-proto.metadatabinary
MD5:AD03BC546B37EF44DB3CFA1E00C2EA47
SHA256:2FCA11241229FD4C5948F4C25657A9BCDCDFF44237D0D0450B01ED6496C769EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
54
TCP/UDP connections
38
DNS requests
83
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3372
firefox.exe
GET
301
23.210.249.30:80
http://cdn.optimizely.com/js/378010915.js
NL
whitelisted
3372
firefox.exe
GET
200
54.214.5.212:80
http://z2.com/generated/promotions.json?d41d8c
US
unknown
3372
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3372
firefox.exe
GET
200
54.214.5.212:80
http://z2.com/all.min.js?d41d8c
US
html
99.8 Kb
unknown
3372
firefox.exe
POST
200
172.217.23.142:80
http://ocsp.pki.goog/GTSGIAG3
US
der
463 b
whitelisted
3372
firefox.exe
GET
200
54.214.5.212:80
http://z2.com/display/images/pages/home/kindle.png
US
image
1.08 Kb
unknown
3372
firefox.exe
GET
200
54.214.5.212:80
http://z2.com/
US
html
3.57 Kb
unknown
3372
firefox.exe
GET
200
54.214.5.212:80
http://z2.com/generated/strings.json?d41d8c
US
html
4.01 Kb
unknown
GET
301
54.214.5.212:80
http://www.z2.com/
US
html
237 b
unknown
3372
firefox.exe
POST
200
172.217.23.142:80
http://ocsp.pki.goog/GTSGIAG3
US
der
463 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3372
firefox.exe
52.41.60.30:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
3372
firefox.exe
2.16.186.50:80
detectportal.firefox.com
Akamai International B.V.
whitelisted
3372
firefox.exe
172.217.21.202:80
fonts.googleapis.com
Google Inc.
US
whitelisted
3372
firefox.exe
54.214.5.212:80
www.z2.com
Amazon.com, Inc.
US
unknown
3372
firefox.exe
52.89.32.107:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
3372
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3372
firefox.exe
172.217.22.4:443
www.google.com
Google Inc.
US
whitelisted
3372
firefox.exe
23.210.249.30:443
cdn.optimizely.com
Akamai International B.V.
NL
whitelisted
3372
firefox.exe
23.210.249.30:80
cdn.optimizely.com
Akamai International B.V.
NL
whitelisted
3372
firefox.exe
172.217.21.234:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.z2.com
  • 54.214.5.212
  • 50.112.244.245
unknown
detectportal.firefox.com
  • 2.16.186.50
  • 2.16.186.112
whitelisted
a1089.dscd.akamai.net
  • 2.16.186.112
  • 2.16.186.50
whitelisted
web-plus-forums-270984324.us-west-2.elb.amazonaws.com
  • 50.112.244.245
  • 54.214.5.212
unknown
search.services.mozilla.com
  • 52.89.32.107
  • 52.27.184.151
  • 34.216.89.123
whitelisted
search.r53-2.services.mozilla.com
  • 34.216.89.123
  • 52.27.184.151
  • 52.89.32.107
whitelisted
tiles.services.mozilla.com
  • 52.41.60.30
  • 52.39.131.77
  • 52.40.109.206
  • 34.208.7.98
  • 52.41.78.152
  • 54.187.46.234
  • 52.43.40.243
  • 54.218.239.186
whitelisted
tiles.r53-2.services.mozilla.com
  • 54.218.239.186
  • 52.43.40.243
  • 54.187.46.234
  • 52.41.78.152
  • 34.208.7.98
  • 52.40.109.206
  • 52.39.131.77
  • 52.41.60.30
whitelisted
z2.com
  • 54.214.5.212
unknown
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

No threats detected
No debug info