URL:

fresh.sytes.net

Full analysis: https://app.any.run/tasks/8a4596f3-4c28-45de-9636-6d297d79a986
Verdict: Malicious activity
Analysis date: January 25, 2024, 10:25:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

8B0378DEF7B2F27A76664B78DF18BD70

SHA1:

F3DF2D689553092A05DE9DD98D9C1FB94C58E486

SHA256:

51C1B5C59E549CD833A8D9A1E7FC14CCDC5B097E55C929C8297FCF8DD267E4A2

SSDEEP:

3:vZWcRLAR:hb+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2568"C:\Program Files\Internet Explorer\iexplore.exe" "fresh.sytes.net"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2584"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2568 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
18 205
Read events
18 123
Write events
76
Delete events
6

Modification events

(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2568) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
30
Text files
33
Unknown types
1

Dropped files

PID
Process
Filename
Type
2568iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2568iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Ader
MD5:C5D869C9A97124B53ECA1040000D1FC8
SHA256:042FD7CE7BEE02E9EBE6D88923ECCE7B5896804F28008ED515AE5727D9134BFB
2568iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:362ABE888B37DA9036DDC1B83F363555
SHA256:DCDA9CDF8DDC30824F30D3F4F2EB52E99A8754605AA3DF506EC6EBCA4FC4871C
2568iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[2].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2568iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:0D9F8C4CB508A1E40277D5CC3CACBE4E
SHA256:84FE057FD4BFFA26ADE28FFB5ECB21FA9C40A3D8A44B78592EC015008838DD77
2568iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\urlblockindex[1].binbinary
MD5:FA518E3DFAE8CA3A0E495460FD60C791
SHA256:775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
2584iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:819D2F6D228F94BFEBAC03EDBFA4BC64
SHA256:E8B016B694A9C3224B6A405CF52010C03B7BC6C8948ECC8A3D9AAA39A18F6D47
2584iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:AC89A852C2AAA3D389B2D2DD312AD367
SHA256:0B720E19270C672F9B6E0EC40B468AC49376807DE08A814573FE038779534F45
2584iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\U12YP19J.htmhtml
MD5:75D73E37B9B35B200267A45771739FFA
SHA256:39BAAC76431659C4BE170F34E18483236090286C7A8C1AADA72862447E3ABB63
2584iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:3BDFE99F546FF90EBB759A35AA8FDBC9
SHA256:F0C84353020617431FF6F88ADE778E2639E266363EB3F0447D20212C80699C5B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
32
DNS requests
16
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2584
iexplore.exe
GET
200
187.188.48.167:80
http://fresh.sytes.net/
unknown
html
3.12 Kb
unknown
2568
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d5d480e07c288d98
unknown
—
—
unknown
2568
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1012f9097c4a32e9
unknown
—
—
unknown
2568
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
312 b
unknown
2568
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
1080
svchost.exe
GET
200
23.53.40.43:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?624d1ab720bef5f8
unknown
compressed
65.2 Kb
unknown
2584
iexplore.exe
GET
200
187.188.48.167:80
http://fresh.sytes.net/css/chunk-vendors.02ae5598.css
unknown
text
65.3 Kb
unknown
1080
svchost.exe
GET
304
23.53.40.43:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1dd404ff67a3d8ee
unknown
compressed
65.2 Kb
unknown
2584
iexplore.exe
GET
200
187.188.48.167:80
http://fresh.sytes.net/css/app.68e9308e.css
unknown
text
386 Kb
unknown
2584
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2584
iexplore.exe
187.188.48.167:80
fresh.sytes.net
TOTAL PLAY TELECOMUNICACIONES SA DE CV
MX
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2568
iexplore.exe
104.126.37.184:443
www.bing.com
Akamai International B.V.
DE
unknown
2568
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2568
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2568
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
EDGECAST
US
whitelisted
1080
svchost.exe
23.53.40.43:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2584
iexplore.exe
172.64.140.13:443
use.fontawesome.com
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
fresh.sytes.net
  • 187.188.48.167
unknown
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.184
  • 104.126.37.179
  • 104.126.37.177
  • 104.126.37.130
  • 104.126.37.128
  • 104.126.37.186
  • 104.126.37.123
  • 104.126.37.178
  • 104.126.37.162
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
  • 23.53.40.43
  • 23.53.40.18
  • 23.53.40.11
  • 23.53.40.9
  • 23.53.40.82
  • 23.53.40.80
  • 23.53.40.16
  • 23.53.40.19
  • 23.53.40.27
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
fonts.googleapis.com
  • 216.58.206.42
whitelisted
use.fontawesome.com
  • 172.64.140.13
  • 172.64.141.13
whitelisted
ocsp.pki.goog
  • 142.250.185.131
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.sytes.net Domain
2584
iexplore.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS HTTP Request to a *.sytes.net Domain
2584
iexplore.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS HTTP Request to a *.sytes.net Domain
2584
iexplore.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS HTTP Request to a *.sytes.net Domain
2584
iexplore.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS HTTP Request to a *.sytes.net Domain
2584
iexplore.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS HTTP Request to a *.sytes.net Domain
2584
iexplore.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS HTTP Request to a *.sytes.net Domain
2584
iexplore.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS HTTP Request to a *.sytes.net Domain
2584
iexplore.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS HTTP Request to a *.sytes.net Domain
2584
iexplore.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS HTTP Request to a *.sytes.net Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
fresh.sytes.net