hxxps://updates[.]t2[.]inty[.]io/sys-update_v2[.]zip

Analysis

max time kernel
360s
max time network
364s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://updates.t2.inty.io/sys-update_v2.zip

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D202C051-B5F6-11EE-A1FE-F6BE0C79E4FA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411740092"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2460	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2460	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2460	iexplore.exe
2460	iexplore.exe
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2680	2460	iexplore.exe	28
PID 2460 wrote to memory of 2680	2460	iexplore.exe	28
PID 2460 wrote to memory of 2680	2460	iexplore.exe	28
PID 2460 wrote to memory of 2680	2460	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://updates.t2.inty.io/sys-update_v2.zip
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
42940a196435b32ce707edafa914cbd8

SHA1
23fd8e7b9a22d7f48505413cb15ca453a14f3f2a

SHA256
68fc78ebe39d87491591145c9394c88cda4dc68c60cb9874b8f1b1b4c3bdbf6a

SHA512
855fab9875a6d56a56614c1c11ba71386c42ac0d78f7f6f3326943bd7a6072622e40498922ef0d450f6441338d95debe509354b53bca363d31db8238fdba628f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83410f3c2743db7699f88c2047cee688

SHA1
9a2cde7f7b7aa45cc43df93f811738c31f765529

SHA256
1ba66e8ecdb95733ef3421c3d8eef9b154d050928ddaa1650d4e9166fd319aee

SHA512
1507b23829579f825b7cbef630a81506c347865143eafd6f78aead7996e01c86269542bc6eb34d796d92ada1d4d4276246f3b98c02b74cc7dd353c68fdacb033

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87578dba8a39c6113ed46230ae20ee65

SHA1
2b5e4785c553d0df1e3da26bf4a2efb7ea7a39a0

SHA256
a8e7bd6e6f73668d77be93708c107db87aab247751a021960b15f5cb6cf8306a

SHA512
eba55ef33a278b8d9421db151ec096074430d9e896a14f1302e1676ee791ac934182df25406f7ae1ea01ea0d67cbcb8b45ddd6f6123be71172f15b387c054b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af314e3663cdd0a8ad533da3e0760e60

SHA1
1355ac747ae2cf218ee660e04587bfabd3606c0f

SHA256
f01fcb7a6a7976409b5a17a94ea86c8245c86a9d8f89a8397c2ab3219fa65d3b

SHA512
d41cda75c9a0026d31c451d4fcc8f572a2412259146f133980750cd9dfbd0a22409664b3a8c3f0727b29b84f564f85a969de513bbdbd695405cefb940c409254

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd9af7d3d0e1b52d87523028bdf3fb36

SHA1
9359cc3d4eaa0bd20fe2a33cfbb210ae4bbf710b

SHA256
7b5840e4b483d4be259ad4edac52445881648ef1ce382f069113323a0783170e

SHA512
47f7d06c993c6bed1c1d466cfd0632efd95fca8d22425af7fb869c4e520eaa5a4735bbb63e1ee6f6d88fbb9840b414e7754d129dc4d7d04082052b7cf0fd74e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e07431da51198a0968f71240f47672a

SHA1
abfa6167a92f08132e2dfb159e87be1787c6f54d

SHA256
28b86353f36990c734ae531b52fc2daf4d724f24413c116d0ecf25b4912fcfdc

SHA512
1c047068b0c01125e5191c53aa125cf2d8fda957daf4a5fd08021c9b349d62c8fdd35e2466bc60ec0f33f6d4df665bc1b9b0f4c114dbaa6d78ae779f6856c10b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5056780b2ae01c6b18fd370cb5c89a20

SHA1
c5538576b39d82990cefcac9df2aef590d34445b

SHA256
38e359e24e1a8736f8492d0ce63d74b1d3ecc26177fdb231b0578d5579e11512

SHA512
b973a5ca1c3017ff8a66080e192893557defb079446c4d74d1a7536a60b00e336c8d4626e29d100d7de475e79752003ed78dcd9b1a5f679b49793121e385572d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a35241494d05a868bf83e50c1b39a685

SHA1
ed206b7204ca7c4398fc1a08c2b5351aa66b16da

SHA256
fa2a35f8eeb20ff089dc4f33e8ac234bd5011476782890d283c53bd8891876ef

SHA512
330e6d2c79b106538ea5e5cd1a9488517353966844273f40b0de86af26643f07a9e7829e9498c7d4a5599720625bf6f723cca22b5e49ceb2373ac21645b2f81a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe502c5ef960089cc52e1ba59776b2c3

SHA1
77fa686674d9a9515953ef7cbd5025877cfeacdc

SHA256
2732b08ccc250a217e0cdf95d264818df76ec2e91d5c990cf669e1c41902f730

SHA512
8560fcb30f14ff95e46c1d88ee8e137780129e43a336e502812ae69adab262eece2d36563d0936f0b8980260002663387f00c5e54f66591193410b67ba3a6565

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf9569f8fd492bf51ee2df0fcdc58d7f

SHA1
b5987f89e8c9572dea263a7ea864bb5d25a369ee

SHA256
dc37bd19663572e6007d836080d2f00b62f22cb1fcc7554b63604fd203e098d5

SHA512
28772e06fe20a431a49f3af40b593921ac7311b1691791f66c7d1a51ef604ca136eac3e22a3fa7116d540f8f5f80751527d3c0530a05361ea0cfd4778dee5695

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a1973324ef450253f310a81d1d79ee4a

SHA1
2c034d516aefb996c6139f74453863cefcd3cd02

SHA256
9ebb144ca57fc2dc4b60dc98a2508881fd8092ab83e36db0e7d0913c022bd26b

SHA512
10cca51e7e5d2e032e81b8dbcd7b0b53478c333e8494ca0cb367ba0e36a4fb65692e989ab8b6c0b2a8c6bba576cd30fb6407efcfa2b59688e645b90601b8074f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5247.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5298.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit