URL: | http://plar.pl |
Full analysis: | https://app.any.run/tasks/83906e25-7ad9-40d5-9154-894c86e742f7 |
Verdict: | Malicious activity |
Analysis date: | October 05, 2022, 07:17:57 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | D6D8E03BA1ABD4575232B3ED715F1D77 |
SHA1: | 202607F92F62EF1CDAEB9E10723FF423EB2DD921 |
SHA256: | D104A30929694061A6A1DCE28819FC8A6274796A15251363B145B0070E8C67E5 |
SSDEEP: | 3:N1KOJ+fn:COJo |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1160 | "C:\Program Files\Internet Explorer\iexplore.exe" "http://plar.pl" | C:\Program Files\Internet Explorer\iexplore.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
2504 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1160 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3420 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1160 CREDAT:2888975 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
(PID) Process: | (1160) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 1 | |||
(PID) Process: | (1160) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPLastLaunchLowDateTime |
Value: | |||
(PID) Process: | (1160) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 30988426 | |||
(PID) Process: | (1160) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateLowDateTime |
Value: | |||
(PID) Process: | (1160) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 30988426 | |||
(PID) Process: | (1160) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (1160) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (1160) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (1160) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
(PID) Process: | (1160) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2504 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\EHPLLYM8.htm | html | |
MD5:3C6644402B1175D808D551F0C9562D44 | SHA256:179F215B9E060D2F48D067B9C4029AD315A08B92A23B11CF9806997D5FC38D5F | |||
2504 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\A.style.css.pagespeed.cf.xr04o5kErx[1].css | text | |
MD5:C6BD38A39904AF1001E8EEACD6E3D794 | SHA256:9B88466E44E00AA708ECC5AC9F59E7D2060205109DF55E4A1131D4468DD79A2C | |||
2504 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\1BanerPLotniczy[1].jpg | image | |
MD5:13D19BCA23D34E8C2F376706BCEAA7A7 | SHA256:90909FC141C58928DBF4D7EE82B518FA81C040EDA6AD514484727BE4D9E24E85 | |||
2504 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\liquidm[1].jpg | image | |
MD5:09F39B258D50D0D92F44C544E936C1B2 | SHA256:0E8D4FE9A856B0A600240AA48F1882EACA3FE2091CE37BF5B638F5DD69FBE675 | |||
2504 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\xwilco-logo-odwolane.png.pagespeed.ic.qflsFMtpbH[1].png | image | |
MD5:A9F96C14CB696C76A69C0279A76C5CAF | SHA256:142288D97DC12262F183871AF5889BC21DE650B992DC1602EED3C0BEE70B43B1 | |||
2504 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\A.menu.css.pagespeed.cf.j6EjzK8x6_[1].css | text | |
MD5:8FA123CCAF31EBF23408D3A7ADE43BB1 | SHA256:3FEC3A4D326FCA8A93981B2BA8C1C44AE4C963DA839FF67BB78F28923CE58F22 | |||
2504 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\xae_1.jpg.pagespeed.ic.G4zWGmuurL[1].jpg | image | |
MD5:1B8CD61A6BAEACB4C4E82A7D93067DF2 | SHA256:4655294B32384C0BF6B422DC4F13367B27917697329284F8D8098E012ECDDD01 | |||
2504 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\A.lightbox.css.pagespeed.cf.TVKJoyQP8A[1].css | text | |
MD5:4D5289A3240FF00DAF5CF7478CF67957 | SHA256:BE3D78250F0D473D6D49891BFBA6B8DBF25CFC8C65F60A84FCDBB445C3E4E8D3 | |||
2504 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\mapy2016[1].jpg | image | |
MD5:247F1221F2CE020D41468E3C61C79988 | SHA256:CB62CA76D9B920D0D044CB9F33CA1819B550521F2DA628F1E06D02F0158834FF | |||
2504 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\vario23[1].jpg | image | |
MD5:EEEC5CAF1A28187608755FCA44A34441 | SHA256:0F5FD52306852C8AD97F4AFF51E977ACE3A2E415D507353D14A73F3AEC48B272 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2504 | iexplore.exe | GET | — | 85.128.153.116:80 | http://www.plar.pl/NewsImg/xxxaero3.jpg,,Mic._imNf9Rc_v.webp,Mic.wOzaE5zsAZ.webp.pagespeed.ic.VS075P1rA3.webp | PL | — | — | unknown |
2504 | iexplore.exe | GET | — | 85.128.153.116:80 | http://www.plar.pl/NewsImg/xwilco-logo-odwolane.png.pagespeed.ic.qflsFMtpbH.png | PL | — | — | unknown |
2504 | iexplore.exe | GET | 301 | 85.128.153.116:80 | http://plar.pl/ | PL | — | — | unknown |
2504 | iexplore.exe | GET | — | 85.128.153.116:80 | http://www.plar.pl/NewsImg/xwilco-logo.png.pagespeed.ic.dHGmCIYEq9.png | PL | — | — | unknown |
2504 | iexplore.exe | GET | — | 85.128.153.116:80 | http://www.plar.pl/js/lightbox.js | PL | — | — | unknown |
2504 | iexplore.exe | GET | — | 85.128.153.116:80 | http://www.plar.pl/templates/samolot_2/A.menu.css.pagespeed.cf.j6EjzK8x6_.css | PL | — | — | unknown |
2504 | iexplore.exe | GET | — | 85.128.153.116:80 | http://www.plar.pl/css/A.lightbox.css.pagespeed.cf.TVKJoyQP8A.css | PL | — | — | unknown |
2504 | iexplore.exe | GET | 200 | 85.128.153.116:80 | http://www.plar.pl/js/prototype.js | PL | image | 1.35 Kb | unknown |
2504 | iexplore.exe | GET | 200 | 85.128.153.116:80 | http://www.plar.pl/ | PL | html | 9.02 Kb | unknown |
2504 | iexplore.exe | GET | 200 | 85.128.153.116:80 | http://www.plar.pl/templates/samolot_2/A.style.css.pagespeed.cf.xr04o5kErx.css | PL | text | 4.12 Kb | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2504 | iexplore.exe | 41.63.96.0:80 | ctldl.windowsupdate.com | LLNW | ZA | suspicious |
2504 | iexplore.exe | 185.210.124.142:80 | www.e-kiosk.pl | MAIN Sp. z o.o. | PL | suspicious |
2504 | iexplore.exe | 142.250.186.78:443 | www.youtube.com | GOOGLE | US | whitelisted |
2504 | iexplore.exe | 142.250.186.98:443 | pagead2.googlesyndication.com | GOOGLE | US | suspicious |
2504 | iexplore.exe | 172.217.16.206:443 | www.youtube.com | GOOGLE | US | whitelisted |
2504 | iexplore.exe | 85.128.153.116:80 | plar.pl | Nazwa.pl Sp.z.o.o. | PL | unknown |
2504 | iexplore.exe | 142.250.186.131:80 | ocsp.pki.goog | GOOGLE | US | whitelisted |
2504 | iexplore.exe | 66.102.1.154:443 | stats.g.doubleclick.net | GOOGLE | US | whitelisted |
2504 | iexplore.exe | 142.250.186.130:443 | googleads.g.doubleclick.net | GOOGLE | US | whitelisted |
2504 | iexplore.exe | 142.250.186.162:443 | adservice.google.com | GOOGLE | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
plar.pl |
| unknown |
www.plar.pl |
| unknown |
pagead2.googlesyndication.com |
| whitelisted |
www.e-kiosk.pl |
| suspicious |
ctldl.windowsupdate.com |
| whitelisted |
www.youtube.com |
| whitelisted |
www.google-analytics.com |
| whitelisted |
ocsp.pki.goog |
| whitelisted |
stats.g.doubleclick.net |
| whitelisted |
googleads.g.doubleclick.net |
| whitelisted |