analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://www.gamesdreamsonline.com/showthread.php?289542-Play-Episode-Choose-Your-Story-Game-Online

Full analysis: https://app.any.run/tasks/f20f06d2-a854-4425-8df7-ffabad9bb1b5
Verdict: Malicious activity
Analysis date: March 22, 2019, 13:40:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
coinhive
opendir
Indicators:
MD5:

8EDC1C08DB0253DAD7F77839B19E3E65

SHA1:

0C8B6D5B45E51E024DE2ECA7A5C9DD0936F93A91

SHA256:

91C8D1BF8AD608349F2DDF25D6ED69A5A4469BEBB699E978938540C39CCBECD5

SSDEEP:

3:N1KJS4UBXhrQCLhKWNJ19+3IK5ZTUNKKhKCnhAXpn:Cc4UBRrQC7N39i3ZTUNbhA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Reads CPU info

      • firefox.exe (PID: 1360)
    • Application launched itself

      • firefox.exe (PID: 1360)
    • Creates files in the user directory

      • firefox.exe (PID: 1360)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
7
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe firefox.exe firefox.exe

Process information

PID
CMD
Path
Indicators
Parent process
1360"C:\Program Files\Mozilla Firefox\firefox.exe" http://www.gamesdreamsonline.com/showthread.php?289542-Play-Episode-Choose-Your-Story-Game-OnlineC:\Program Files\Mozilla Firefox\firefox.exe
explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
65.0.2
2928"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1360.0.1292492323\1803422725" -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - "C:\Users\admin\AppData\LocalLow\Mozilla\Temp-{ce348e4c-7d33-445e-89f9-60108c51bcaf}" 1360 "\\.\pipe\gecko-crash-server-pipe.1360" 1128 gpuC:\Program Files\Mozilla Firefox\firefox.exefirefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
65.0.2
1868"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1360.6.1141797179\1754645412" -childID 1 -isForBrowser -prefsHandle 840 -prefMapHandle 1708 -prefsLen 1 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 1360 "\\.\pipe\gecko-crash-server-pipe.1360" 1724 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
65.0.2
1104"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1360.13.847359172\470608579" -childID 2 -isForBrowser -prefsHandle 2780 -prefMapHandle 2912 -prefsLen 5094 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 1360 "\\.\pipe\gecko-crash-server-pipe.1360" 2764 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
65.0.2
3256"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1360.20.678204480\277076908" -childID 3 -isForBrowser -prefsHandle 3404 -prefMapHandle 3384 -prefsLen 5824 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 1360 "\\.\pipe\gecko-crash-server-pipe.1360" 3412 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
65.0.2
3980"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1360.21.681497468\447599514" -childID 4 -isForBrowser -prefsHandle 3472 -prefMapHandle 3480 -prefsLen 5824 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 1360 "\\.\pipe\gecko-crash-server-pipe.1360" 3604 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
65.0.2
2500"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1360.34.1127917811\1146308723" -childID 5 -isForBrowser -prefsHandle 7800 -prefMapHandle 7808 -prefsLen 5824 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 1360 "\\.\pipe\gecko-crash-server-pipe.1360" 7676 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
65.0.2
Total events
633
Read events
631
Write events
2
Delete events
0

Modification events

(PID) Process:(1360) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1360) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000006E000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
Executable files
0
Suspicious files
180
Text files
69
Unknown types
57

Dropped files

PID
Process
Filename
Type
1360firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js
MD5:
SHA256:
1360firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp
MD5:
SHA256:
1360firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm
MD5:
SHA256:
1360firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm
MD5:
SHA256:
1360firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-current.binbinary
MD5:C8C881CB2BCDAE33DA6F19BB200BC4BF
SHA256:BF7A738A7F98D25531E0CE0DA229B9031C1040795AC30BC3D341759B6083EFAC
1360firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:95802314368804DC02B0983737400430
SHA256:792AF4DB39ACE4FCD52AB3512769B6F2BA508C541A62D4E137A2BA91314ECF55
1360firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.binbinary
MD5:AC883E1540054B6B75B0229FD8CF8BB3
SHA256:1298683E48691721E36AD37EA14504B4EE025A0317B58AD259704FFD088F0625
1360firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
1360firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:C3A9989BA17002377D139ECE64F6989F
SHA256:783A90DE10044CC155212243ED346C2AB51BFF1FF3B50232CABFD9DF8EB0091A
1360firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\block-flashsubdoc-digest256.sbstorebinary
MD5:04824A1F92353F43EBB9E7F74B7476FD
SHA256:B48E58EBAB82E4C376F16150A3FFF850C1111FF1F5985D68819CFD6F0DB159D2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
94
TCP/UDP connections
112
DNS requests
215
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1360
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
1360
firefox.exe
GET
200
50.116.94.29:80
http://gamesdreamsonline.com/clientscript/vbulletin_css/style00001l/main-rollup.css?d=1490274102
US
text
14.8 Kb
unknown
1360
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
1360
firefox.exe
GET
200
50.116.94.29:80
http://gamesdreamsonline.com/clientscript/vbulletin_css/style00001l/additional.css?d=1490274102
US
unknown
1360
firefox.exe
GET
404
50.116.94.29:80
http://gamesdreamsonline.com/clientscript/md5.js?v=422
US
html
453 b
unknown
1360
firefox.exe
GET
200
2.23.104.167:80
http://s7.addthis.com/js/250/addthis_widget.js
unknown
text
109 Kb
whitelisted
1360
firefox.exe
GET
200
50.116.94.29:80
http://www.gamesdreamsonline.com/showthread.php?289542-Play-Episode-Choose-Your-Story-Game-Online
US
html
14.6 Kb
unknown
1360
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
1360
firefox.exe
GET
200
50.116.94.29:80
http://gamesdreamsonline.com/images/reputation/reputation_pos.png
US
image
234 b
unknown
1360
firefox.exe
GET
200
50.116.94.29:80
http://gamesdreamsonline.com/clientscript/vbulletin_css/style00001l/showthread-rollup.css?d=1490274102
US
text
7.69 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1360
firefox.exe
34.213.175.109:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
1360
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1360
firefox.exe
2.16.186.112:80
detectportal.firefox.com
Akamai International B.V.
whitelisted
1360
firefox.exe
172.217.21.202:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
1360
firefox.exe
50.116.94.29:80
www.gamesdreamsonline.com
CyrusOne LLC
US
unknown
1360
firefox.exe
52.35.250.5:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
1360
firefox.exe
52.85.184.170:443
snippets.cdn.mozilla.net
Amazon.com, Inc.
US
whitelisted
1360
firefox.exe
104.20.2.47:80
www.statcounter.com
Cloudflare Inc
US
shared
1360
firefox.exe
157.240.9.35:443
www.facebook.com
Facebook, Inc.
US
malicious
1360
firefox.exe
2.23.104.167:80
s7.addthis.com
Akamai International B.V.
whitelisted

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 2.16.186.112
  • 2.16.186.50
whitelisted
www.gamesdreamsonline.com
  • 50.116.94.29
unknown
a1089.dscd.akamai.net
  • 2.16.186.50
  • 2.16.186.112
whitelisted
gamesdreamsonline.com
  • 50.116.94.29
unknown
search.services.mozilla.com
  • 34.213.175.109
  • 35.166.112.39
  • 52.88.150.81
whitelisted
search.r53-2.services.mozilla.com
  • 52.88.150.81
  • 35.166.112.39
  • 34.213.175.109
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
snippets.cdn.mozilla.net
  • 52.85.184.170
whitelisted
tiles.services.mozilla.com
  • 52.35.250.5
  • 35.160.41.125
  • 35.164.197.9
  • 52.26.103.165
  • 52.39.131.77
  • 52.25.148.139
  • 35.164.130.113
  • 35.165.22.140
whitelisted
drcwo519tnci7.cloudfront.net
  • 52.85.184.170
shared

Threats

No threats detected
No debug info