URL: | http://www.lidl-ro.club |
Full analysis: | https://app.any.run/tasks/ae687e5d-df13-4bb3-b0fe-055aa7737768 |
Verdict: | Malicious activity |
Analysis date: | March 07, 2020, 10:49:22 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 6212380DFDF410ED6179DF641DE4052A |
SHA1: | 2F1ECA47478E27489EC7D5F315FBB26BF2419EA8 |
SHA256: | E900A724DC4EFA7FA83E6158A322CDCAF78158A148E92C6FFB57CDE4AA260BE8 |
SSDEEP: | 3:N1KJS4CGM:Cc4g |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3808 | "C:\Program Files\Internet Explorer\iexplore.exe" "http://www.lidl-ro.club" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3484 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3808 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
3484 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\731[1].png | image | |
MD5:E29E47FE04637748ACBF8D235E81B9E1 | SHA256:3EB425F78E52BF63441CABE9C9DACC2206CE32444163ED160EC3EBF01A9D5D27 | |||
3484 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\img4[1].jpg | image | |
MD5:1C2995097D68EF5EA07F8ECCE79A01F2 | SHA256:14AA71C1D09300F709F6AE75838C77E8A07E2A6F49051A41999893CC7543F347 | |||
3484 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\img3[1].jpg | image | |
MD5:3A443005B8F49BEF142F87B3D79BCEDA | SHA256:C2D31C2A2386A1589ECDEAB5B083E48FB9770CBB5F5C71C220AE42D9C4C5113E | |||
3484 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\2[1].png | image | |
MD5:35E74E97FD55A193F902B0712B7CFCA2 | SHA256:5F237EB12EE9EB0B0DEF8C30902C412CFFF54FC614157A67CBBB0831C2A50036 | |||
3484 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\img1[1].jpg | image | |
MD5:5EF2B87C2CBE6430115E6FBA75FFBF2E | SHA256:5F07C5473797C00F0CFA8D83580DC1D37CCB38C8C333DF02FF674856700ECC82 | |||
3484 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\6[1].png | image | |
MD5:76E606CE866C8D1037232F0BD5D336B0 | SHA256:C1E4CAEA5174A9D257554739EBDB72AE167D5AA52D066F349D400C9C3ECE9293 | |||
3484 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\8QU1CQCK.htm | html | |
MD5:93201D26724338D220957726EDCA4553 | SHA256:015F7EE786730D5B15AC136C6D6F427C7AA4871B2B699DDEF81EA56D5565CD5B | |||
3484 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\img6[1].jpg | image | |
MD5:C166245D00808FF7E6EA46CD2833ECDD | SHA256:AE28E6D743BCA410AC38C20A6BA564917D386738D4D3CA1CD8E6F372566C10CD | |||
3484 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\love[1].png | image | |
MD5:97841761BA815677181D86545F115A86 | SHA256:81ABD8853AB51956DCBBB8325AD74E3673F0079632A1C483339290D5BC313FBE | |||
3484 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\img2[1].jpg | image | |
MD5:5833A16C5848B8EFFA07750CD81589D5 | SHA256:C7778948E8EE39F66FA37343CCA3CB716089B95EE1D6C4247EED8903E24165AE |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3484 | iexplore.exe | GET | 200 | 52.219.96.83:80 | http://www.lidl-ro.club/ | US | html | 37.7 Kb | shared |
3484 | iexplore.exe | GET | 200 | 52.219.96.83:80 | http://www.lidl-ro.club/images/love.png | US | image | 301 b | shared |
3484 | iexplore.exe | GET | — | 209.197.3.15:80 | http://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css | US | — | — | whitelisted |
3484 | iexplore.exe | GET | 200 | 52.219.96.83:80 | http://www.lidl-ro.club/images/img1.jpg | US | image | 1.73 Kb | shared |
3484 | iexplore.exe | GET | 200 | 52.219.96.83:80 | http://www.lidl-ro.club/images/img2.jpg | US | image | 1.95 Kb | shared |
3484 | iexplore.exe | GET | 200 | 52.219.96.83:80 | http://www.lidl-ro.club/images/btn.png | US | image | 265 b | shared |
3484 | iexplore.exe | GET | 200 | 52.219.96.83:80 | http://www.lidl-ro.club/images/img7.jpg | US | image | 1.49 Kb | shared |
3484 | iexplore.exe | GET | 307 | 67.202.94.93:80 | http://whos.amung.us/widget/marolidl11/ | US | — | — | whitelisted |
3484 | iexplore.exe | GET | 200 | 52.219.96.83:80 | http://www.lidl-ro.club/images/1.png | US | image | 68.6 Kb | shared |
3484 | iexplore.exe | GET | 200 | 52.219.96.83:80 | http://www.lidl-ro.club/images/img8.jpg | US | image | 1.21 Kb | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3484 | iexplore.exe | 67.202.94.93:80 | whos.amung.us | Steadfast | US | malicious |
3484 | iexplore.exe | 52.219.96.83:80 | www.lidl-ro.club | — | US | suspicious |
3484 | iexplore.exe | 172.217.23.138:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
3484 | iexplore.exe | 104.24.105.25:443 | taratur.com | Cloudflare Inc | US | shared |
3484 | iexplore.exe | 209.197.3.15:80 | maxcdn.bootstrapcdn.com | Highwinds Network Group, Inc. | US | whitelisted |
3484 | iexplore.exe | 172.217.22.42:443 | ajax.googleapis.com | Google Inc. | US | whitelisted |
3484 | iexplore.exe | 185.225.208.133:80 | widgets.amung.us | — | — | suspicious |
3484 | iexplore.exe | 172.217.22.104:443 | www.googletagmanager.com | Google Inc. | US | whitelisted |
3484 | iexplore.exe | 216.58.207.35:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
3484 | iexplore.exe | 172.217.21.227:80 | ocsp.pki.goog | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
www.lidl-ro.club |
| shared |
maxcdn.bootstrapcdn.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
taratur.com |
| unknown |
ajax.googleapis.com |
| whitelisted |
whos.amung.us |
| whitelisted |
www.googletagmanager.com |
| whitelisted |
widgets.amung.us |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |