analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.contact-db.com/

Full analysis: https://app.any.run/tasks/c6a9e643-b04f-42a8-9d58-ccd460ba0a90
Verdict: Malicious activity
Analysis date: February 19, 2019, 13:13:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

9AA0C481CFFF3538C4733241419E7406

SHA1:

F16C72427BFB42E15DB1A0E097667B5B4490B2BC

SHA256:

CE790C4DAE552F5C41DE180435BD0EDA8E855CAD8AFD85EB90D6B9DBE782FF68

SSDEEP:

3:N8DSLoLR:2OLot

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 2868)
  • INFO

    • Reads CPU info

      • firefox.exe (PID: 2868)
      • firefox.exe (PID: 2360)
      • firefox.exe (PID: 2864)
      • firefox.exe (PID: 3644)
    • Application launched itself

      • firefox.exe (PID: 2868)
    • Creates files in the user directory

      • firefox.exe (PID: 2868)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
4
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start firefox.exe firefox.exe firefox.exe firefox.exe

Process information

PID
CMD
Path
Indicators
Parent process
2868"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.contact-db.com/C:\Program Files\Mozilla Firefox\firefox.exe
explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
61.0.2
2360"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2868.0.546080884\413739282" -childID 1 -isForBrowser -prefsHandle 1360 -prefsLen 8310 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2868 "\\.\pipe\gecko-crash-server-pipe.2868" 1484 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
61.0.2
2864"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2868.6.812698062\1980912987" -childID 2 -isForBrowser -prefsHandle 2348 -prefsLen 11442 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2868 "\\.\pipe\gecko-crash-server-pipe.2868" 2128 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
61.0.2
3644"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2868.12.1193435502\768024621" -childID 3 -isForBrowser -prefsHandle 3180 -prefsLen 12017 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2868 "\\.\pipe\gecko-crash-server-pipe.2868" 3192 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
61.0.2
Total events
523
Read events
521
Write events
2
Delete events
0

Modification events

(PID) Process:(2868) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2868) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
Executable files
1
Suspicious files
52
Text files
17
Unknown types
44

Dropped files

PID
Process
Filename
Type
2868firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm
MD5:
SHA256:
2868firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp
MD5:
SHA256:
2868firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js
MD5:
SHA256:
2868firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm
MD5:
SHA256:
2868firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db-journal
MD5:
SHA256:
2868firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:E97401788D48C64B8C54F0F948D7D823
SHA256:D61937268581B2934B36E45F06CCBB4ED19D6363181F3BF8FC8C9723650F6C75
2868firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\entries\B2BEAD60EA90E3FFBC756CDE0C204755FA3C8CAEder
MD5:16E9A807F0E77752E889356ACABBA662
SHA256:7EE25302860B9294D7FF7AF4C07907162A0B956096088B07791876F5EED86833
2868firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\doomed\15875binary
MD5:2B47F318FDCFABF9B88818D1F266B6CA
SHA256:552E9205F11D8BED37E6D3C068CD7393893CACAE4F21D922E895FB26B3191A54
2868firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:707C12070C52E55C2A996AC15E219B95
SHA256:6C5410C655C8EFC48D123ABE708C8940A4218072C0DAF85E03AB45DA6D2CE6B9
2868firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.dbsqlite
MD5:9FFA5C90252FC9B964F521ED0A9E5635
SHA256:DA77D6E84B0EF4B64334C44CF67F9B46D73649D95ABAC1F12A4FEE16D3251981
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
29
DNS requests
61
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2868
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2868
firefox.exe
POST
200
2.16.106.50:80
http://ocsp.comodoca.com/
unknown
der
471 b
whitelisted
2868
firefox.exe
POST
200
2.16.106.50:80
http://ocsp.comodoca.com/
unknown
der
471 b
whitelisted
2868
firefox.exe
POST
200
2.21.242.245:80
http://ocsp.int-x3.letsencrypt.org/
NL
der
527 b
whitelisted
2868
firefox.exe
POST
200
216.58.207.35:80
http://ocsp.pki.goog/GTSGIAG3
US
der
463 b
whitelisted
2868
firefox.exe
POST
200
216.58.207.35:80
http://ocsp.pki.goog/GTSGIAG3
US
der
463 b
whitelisted
2868
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2868
firefox.exe
POST
200
216.58.207.35:80
http://ocsp.pki.goog/GTSGIAG3
US
der
463 b
whitelisted
2868
firefox.exe
POST
200
216.58.207.35:80
http://ocsp.pki.goog/GTSGIAG3
US
der
463 b
whitelisted
2868
firefox.exe
POST
200
216.58.207.35:80
http://ocsp.pki.goog/GTSGIAG3
US
der
463 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2868
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2868
firefox.exe
2.16.186.50:80
detectportal.firefox.com
Akamai International B.V.
whitelisted
2868
firefox.exe
2.16.106.50:80
ocsp.comodoca.com
Akamai International B.V.
whitelisted
2868
firefox.exe
172.217.18.10:443
fonts.googleapis.com
Google Inc.
US
whitelisted
2868
firefox.exe
52.34.107.172:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
2868
firefox.exe
52.27.184.151:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
2868
firefox.exe
209.197.3.15:443
maxcdn.bootstrapcdn.com
Highwinds Network Group, Inc.
US
whitelisted
2868
firefox.exe
2.21.242.245:80
ocsp.int-x3.letsencrypt.org
Akamai International B.V.
NL
whitelisted
2868
firefox.exe
35.202.21.90:443
www.contact-db.com
Google Inc.
US
whitelisted
2868
firefox.exe
172.217.21.234:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 2.16.186.50
  • 2.16.186.112
whitelisted
www.contact-db.com
  • 35.202.21.90
malicious
custom-proxy.leadpages.net
  • 35.202.21.90
malicious
a1089.dscd.akamai.net
  • 2.16.186.112
  • 2.16.186.50
whitelisted
search.services.mozilla.com
  • 52.27.184.151
  • 52.89.32.107
  • 34.216.89.123
whitelisted
search.r53-2.services.mozilla.com
  • 34.216.89.123
  • 52.89.32.107
  • 52.27.184.151
whitelisted
ocsp.int-x3.letsencrypt.org
  • 2.21.242.245
  • 2.21.242.204
whitelisted
a771.dscq.akamai.net
  • 2.21.242.204
  • 2.21.242.245
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
cs9.wac.phicdn.net
  • 93.184.220.29
whitelisted

Threats

No threats detected
No debug info