URL:

https://minecraft.net/download

Full analysis: https://app.any.run/tasks/116bd864-4dfe-4a3b-b49f-60fd858b0cac
Verdict: Malicious activity
Analysis date: July 26, 2019, 11:11:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MD5:

3916E983C790A8A2F363CFE4056FCAB6

SHA1:

9172BFB8F9E9B8EC4C3F13BCC23867B270E5D2A7

SHA256:

BF8F46685676AC2D4D2EC9DB58F48238F108DE5A325C00BE64BEAB35CEF23E74

SSDEEP:

3:N8LU10BM:24KBM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Checks for external IP

      • firefox.exe (PID: 3868)

    • Starts Microsoft Installer

      • firefox.exe (PID: 3868)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 3868)
      • msiexec.exe (PID: 1752)

    • Executed as Windows Service

      • vssvc.exe (PID: 3372)

    • Executed via COM

      • DrvInst.exe (PID: 4084)

  • INFO

    • Application launched itself

      • firefox.exe (PID: 3868)
      • msiexec.exe (PID: 1752)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • firefox.exe (PID: 696)

    • Reads settings of System Certificates

      • firefox.exe (PID: 3868)

    • Reads CPU info

      • firefox.exe (PID: 3868)

    • Searches for installed software

      • msiexec.exe (PID: 1752)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3372)

    • Creates files in the user directory

      • firefox.exe (PID: 3868)

    • Creates files in the program directory

      • msiexec.exe (PID: 1752)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 1752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
15
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe firefox.exe firefox.exe firefox.exe msiexec.exe no specs msiexec.exe msiexec.exe no specs vssvc.exe no specs drvinst.exe no specs msiexec.exe no specs msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
456C:\Windows\system32\MsiExec.exe -Embedding F5120E18460049DDBAD0858C8D96A442 CC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
576C:\Windows\system32\MsiExec.exe -Embedding D0243A0E0591205E3871DC75C06EBBDFC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
592"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3868.13.278566924\1583222420" -childID 2 -isForBrowser -prefsHandle 2688 -prefMapHandle 2692 -prefsLen 5842 -prefMapSize 188076 -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3868 "\\.\pipe\gecko-crash-server-pipe.3868" 2708 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
67.0.4
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\dbghelp.dll
696"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3868.21.2014398536\410265596" -childID 4 -isForBrowser -prefsHandle 3480 -prefMapHandle 3552 -prefsLen 6604 -prefMapSize 188076 -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3868 "\\.\pipe\gecko-crash-server-pipe.3868" 3564 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
67.0.4
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1512C:\Windows\system32\MsiExec.exe -Embedding 43F3E915A7FC5C34C24C85C12C545203 M Global\MSI0000C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1728"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3868.0.897904207\98899121" -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3868 "\\.\pipe\gecko-crash-server-pipe.3868" 1176 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
67.0.4
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1752C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2140"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3868.20.1348036672\1054267881" -childID 3 -isForBrowser -prefsHandle 3332 -prefMapHandle 3328 -prefsLen 6604 -prefMapSize 188076 -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3868 "\\.\pipe\gecko-crash-server-pipe.3868" 3460 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
67.0.4
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
3324"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3868.41.2069000813\971927968" -childID 6 -isForBrowser -prefsHandle 6920 -prefMapHandle 6916 -prefsLen 7099 -prefMapSize 188076 -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3868 "\\.\pipe\gecko-crash-server-pipe.3868" 6904 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
67.0.4
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
3372C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
1 777
Read events
1 477
Write events
288
Delete events
12

Modification events

(PID) Process:(3868) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
0000000000000000
(PID) Process:(3868) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3868) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000078000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3868) firefox.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3868) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3868) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3868) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.msi\OpenWithProgids
Operation:writeName:Msi.Package
Value:
(PID) Process:(3868) firefox.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E
Operation:writeName:@C:\Windows\System32\msimsg.dll,-36
Value:
&Install
(PID) Process:(3868) firefox.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E
Operation:writeName:@C:\Windows\System32\msimsg.dll,-37
Value:
Re&pair
(PID) Process:(3868) firefox.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E
Operation:writeName:@C:\Windows\System32\msimsg.dll,-38
Value:
&Uninstall
Executable files
7
Suspicious files
256
Text files
134
Unknown types
115

Dropped files

PID
Process
Filename
Type
3868firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
3868firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pluginreg.dat.tmp —
MD5:—
SHA256:—
3868firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js —
MD5:—
SHA256:—
3868firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp —
MD5:—
SHA256:—
3868firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm —
MD5:—
SHA256:—
3868firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.tmp —
MD5:—
SHA256:—
3868firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db-journal —
MD5:—
SHA256:—
3868firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-current.binbinary
MD5:—
SHA256:—
3868firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pluginreg.dattext
MD5:—
SHA256:—
3868firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
55
TCP/UDP connections
135
DNS requests
265
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3868
firefox.exe
POST
200
172.217.18.99:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3868
firefox.exe
POST
200
172.217.18.99:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3868
firefox.exe
GET
200
104.16.154.36:80
http://whatismyipaddress.com/cdn-cgi/scripts/zepto.min.js
US
text
9.12 Kb
shared
3868
firefox.exe
POST
200
172.217.18.99:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3868
firefox.exe
POST
200
172.217.18.99:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3868
firefox.exe
POST
200
172.217.18.99:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3868
firefox.exe
GET
429
104.16.154.36:80
http://whatismyipaddress.com/
US
html
3.04 Kb
shared
3868
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3868
firefox.exe
POST
200
172.217.18.99:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3868
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3868
firefox.exe
2.16.106.152:80
detectportal.firefox.com
Akamai International B.V.
—
whitelisted
3868
firefox.exe
52.222.145.22:443
minecraft.net
Amazon.com, Inc.
US
unknown
3868
firefox.exe
52.210.139.31:443
location.services.mozilla.com
Amazon.com, Inc.
IE
malicious
3868
firefox.exe
35.163.127.188:443
push.services.mozilla.com
Amazon.com, Inc.
US
unknown
3868
firefox.exe
52.222.156.180:443
snippets.cdn.mozilla.net
Amazon.com, Inc.
US
unknown
3868
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3868
firefox.exe
152.199.20.92:443
www.minecraft.net
MCI Communications Services, Inc. d/b/a Verizon Business
US
unknown
3868
firefox.exe
216.58.207.74:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
3868
firefox.exe
52.43.91.152:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
3868
firefox.exe
2.18.233.62:443
c.s-microsoft.com
Akamai International B.V.
—
whitelisted

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 2.16.106.152
  • 2.16.106.209
whitelisted
a1089.dscd.akamai.net
  • 2.16.106.209
  • 2.16.106.152
whitelisted
location.services.mozilla.com
  • 52.210.139.31
  • 108.128.247.43
  • 52.50.56.62
whitelisted
locprod1-elb-eu-west-1.prod.mozaws.net
  • 52.50.56.62
  • 108.128.247.43
  • 52.210.139.31
whitelisted
minecraft.net
  • 52.222.145.22
  • 52.222.145.33
  • 52.222.145.57
  • 52.222.145.86
whitelisted
push.services.mozilla.com
  • 35.163.127.188
whitelisted
autopush.prod.mozaws.net
  • 35.163.127.188
whitelisted
snippets.cdn.mozilla.net
  • 52.222.156.180
whitelisted
tiles.services.mozilla.com
  • 52.43.91.152
  • 34.213.89.114
  • 34.210.151.118
  • 34.209.86.85
  • 35.166.166.56
  • 34.208.138.0
  • 54.186.163.246
  • 54.186.90.148
whitelisted
tiles.r53-2.services.mozilla.com
  • 54.186.90.148
  • 54.186.163.246
  • 34.208.138.0
  • 35.166.166.56
  • 34.209.86.85
  • 34.210.151.118
  • 34.213.89.114
  • 52.43.91.152
whitelisted

Threats

Found threats are available for the paid subscriptions
8 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://minecraft.net/download