| URL: | play.kakao.com |
| Full analysis: | https://app.any.run/tasks/750b9b82-e973-411c-a48f-bf8cb52ef15d |
| Verdict: | Malicious activity |
| Analysis date: | October 30, 2023, 03:11:44 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | 96E284C4BE2A345F20E81BE9D92D7CA4 |
| SHA1: | 2184DC2C2CCD0C60767ADFA59B85E101D28A4B56 |
| SHA256: | FCAEEE4B043FA3C56934AFC9370D86097E0797DE425A8B9A9E3B3A6719374510 |
| SSDEEP: | 3:8EfTn:VfTn |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 792 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1192.23.1323769784\1187280327" -childID 20 -isForBrowser -prefsHandle 4020 -prefMapHandle 4040 -prefsLen 31682 -prefMapSize 244195 -jsInitHandle 860 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f511e6c8-adbd-4365-93e9-c769e508942a} 1192 "\\.\pipe\gecko-crash-server-pipe.1192" 4016 14eaf110 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 940 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1192.10.1530548762\1027641949" -childID 9 -isForBrowser -prefsHandle 2328 -prefMapHandle 4140 -prefsLen 31324 -prefMapSize 244195 -jsInitHandle 860 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b13990e-06c3-4e20-b435-07e104f6170c} 1192 "\\.\pipe\gecko-crash-server-pipe.1192" 1860 1b661840 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1016 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1192.22.837200509\1169291564" -childID 19 -isForBrowser -prefsHandle 7472 -prefMapHandle 1528 -prefsLen 31682 -prefMapSize 244195 -jsInitHandle 860 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9db70ec1-43c1-4788-af80-1338fb8b7ae2} 1192 "\\.\pipe\gecko-crash-server-pipe.1192" 7984 11632110 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1192 | "C:\Program Files\Mozilla Firefox\firefox.exe" play.kakao.com | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1432 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1192.14.1598372356\386149924" -childID 11 -isForBrowser -prefsHandle 7960 -prefMapHandle 4132 -prefsLen 31324 -prefMapSize 244195 -jsInitHandle 860 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e39c825-a55a-40e1-a09b-f518369cf266} 1192 "\\.\pipe\gecko-crash-server-pipe.1192" 7944 1a93b9b0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1632 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1192.8.1238625929\1807100380" -childID 7 -isForBrowser -prefsHandle 8456 -prefMapHandle 8464 -prefsLen 31054 -prefMapSize 244195 -jsInitHandle 860 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a9b9303-a836-4c45-83a3-f1f15a9286a3} 1192 "\\.\pipe\gecko-crash-server-pipe.1192" 8444 16aad110 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1796 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1192.2.1922628499\113570756" -childID 1 -isForBrowser -prefsHandle 2060 -prefMapHandle 2056 -prefsLen 24491 -prefMapSize 244195 -jsInitHandle 860 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7363a917-ddc4-4745-9f92-d8d463f01a77} 1192 "\\.\pipe\gecko-crash-server-pipe.1192" 2072 128976d0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2268 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1192.12.1475985531\253108633" -parentBuildID 20230710165010 -prefsHandle 7780 -prefMapHandle 3456 -prefsLen 36705 -prefMapSize 244195 -appDir "C:\Program Files\Mozilla Firefox\browser" - {af17d785-da5d-40e8-9d2b-7af3f11a9fc4} 1192 "\\.\pipe\gecko-crash-server-pipe.1192" 7752 1aa3d9e0 rdd | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2280 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1192.13.1321415192\798758571" -parentBuildID 20230710165010 -sandboxingKind 1 -prefsHandle 7768 -prefMapHandle 7772 -prefsLen 36705 -prefMapSize 244195 -appDir "C:\Program Files\Mozilla Firefox\browser" - {be099dda-d65e-454b-8307-83e8b025f9e3} 1192 "\\.\pipe\gecko-crash-server-pipe.1192" 7736 18e74c90 utility | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2392 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1192.1.870153382\1386805645" -parentBuildID 20230710165010 -prefsHandle 1392 -prefMapHandle 1364 -prefsLen 28600 -prefMapSize 244195 -appDir "C:\Program Files\Mozilla Firefox\browser" - {66c8cfbb-d6a5-41ef-a2d4-02156ccd3874} 1192 "\\.\pipe\gecko-crash-server-pipe.1192" 1416 ef1c010 socket | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| (PID) Process: | (3976) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Launcher |
Value: 2166C0A101000000 | |||
| (PID) Process: | (1192) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Browser |
Value: 044CC1A101000000 | |||
| (PID) Process: | (1192) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry |
Value: 0 | |||
| (PID) Process: | (1192) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
| (PID) Process: | (1192) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Theme |
Value: 1 | |||
| (PID) Process: | (1192) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Enabled |
Value: 1 | |||
| (PID) Process: | (1192) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableTelemetry |
Value: 1 | |||
| (PID) Process: | (1192) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent |
Value: 0 | |||
| (PID) Process: | (1192) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|SetDefaultBrowserUserChoice |
Value: 1 | |||
| (PID) Process: | (1192) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|AppLastRunTime |
Value: D14E5F3C23B0D901 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1192 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.bin | binary | |
MD5:B7A3C61D0C144CC5E166B1E769CA8F8C | SHA256:7FADCB77FFACA6B9E9F15C6F1CD3AAD4C20DCD90FA92429A627A3A7110CA2644 | |||
| 1192 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\protections.sqlite-journal | binary | |
MD5:A80F0B09540EB00CD365A0DEBA24B853 | SHA256:F324C4D31C86E635AB51789317952F7EBA6DF7220BD40CC74A24F5E75EB0A559 | |||
| 1192 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
| 1192 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 1192 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage.sqlite-journal | binary | |
MD5:5B4CAAB834B2DF3994F1C66CC1F41ECD | SHA256:BC0E74AE9D0F20C319D819F7DF18B52BE6E8CAD9C0B99807090CF15889DAB937 | |||
| 1192 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js | text | |
MD5:60E0DE9E05EC76C749D80F0D15A81B21 | SHA256:08252FA62CCCCD316474E20CC7317A6B5C932B2C972234318E8CCDA39EC2EF48 | |||
| 1192 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 1192 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite | — | |
MD5:— | SHA256:— | |||
| 1192 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
| 1192 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1192 | firefox.exe | GET | 302 | 211.249.221.105:80 | http://kakao.com/ | unknown | — | — | unknown |
1192 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | unknown | text | 90 b | unknown |
1192 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | text | 8 b | unknown |
1192 | firefox.exe | POST | 200 | 184.24.77.54:80 | http://r3.o.lencr.org/ | unknown | binary | 503 b | unknown |
1192 | firefox.exe | POST | 200 | 18.245.65.219:80 | http://ocsp.r2m02.amazontrust.com/ | unknown | der | 471 b | unknown |
1192 | firefox.exe | POST | 200 | 184.24.77.54:80 | http://r3.o.lencr.org/ | unknown | der | 503 b | unknown |
1192 | firefox.exe | POST | 200 | 184.24.77.54:80 | http://r3.o.lencr.org/ | unknown | binary | 503 b | unknown |
1192 | firefox.exe | POST | 200 | 184.24.77.54:80 | http://r3.o.lencr.org/ | unknown | der | 503 b | unknown |
1192 | firefox.exe | POST | 200 | 184.24.77.54:80 | http://r3.o.lencr.org/ | unknown | binary | 503 b | unknown |
1192 | firefox.exe | POST | 200 | 172.217.20.67:80 | http://ocsp.pki.goog/gts1c3 | unknown | binary | 471 b | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1192 | firefox.exe | 211.231.101.168:80 | play.kakao.com | Kakao Corp | KR | unknown |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1192 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | GOOGLE | US | whitelisted |
1192 | firefox.exe | 34.117.237.239:443 | contile.services.mozilla.com | GOOGLE-CLOUD-PLATFORM | US | unknown |
1192 | firefox.exe | 34.197.137.200:443 | spocs.getpocket.com | AMAZON-AES | US | unknown |
1192 | firefox.exe | 34.149.100.209:443 | firefox.settings.services.mozilla.com | GOOGLE | US | unknown |
1192 | firefox.exe | 184.24.77.54:80 | r3.o.lencr.org | Akamai International B.V. | DE | unknown |
1192 | firefox.exe | 142.250.187.106:443 | safebrowsing.googleapis.com | GOOGLE | US | whitelisted |
1192 | firefox.exe | 18.245.65.219:80 | ocsp.r2m02.amazontrust.com | — | US | unknown |
1192 | firefox.exe | 34.117.65.55:443 | push.services.mozilla.com | GOOGLE-CLOUD-PLATFORM | US | unknown |
Domain | IP | Reputation |
|---|---|---|
play.kakao.com |
| unknown |
detectportal.firefox.com |
| whitelisted |
play-kakao-iy6fljvv.kgslb.com |
| unknown |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
example.org |
| whitelisted |
ipv4only.arpa |
| unknown |
contile.services.mozilla.com |
| whitelisted |
spocs.getpocket.com |
| shared |
proxyserverecs-1736642167.us-east-1.elb.amazonaws.com |
| shared |
firefox.settings.services.mozilla.com |
| whitelisted |