e6171ffbc8e0cd50e6136464a37763fd748502030b62519867e4f9e994a83bc4

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6d645b00bde814fd35edb3c07d72a80.exe
Size

125KB
MD5

d6d645b00bde814fd35edb3c07d72a80
SHA1

764781724b5af6d9f14cf4d0463271ea05358ce8
SHA256

e6171ffbc8e0cd50e6136464a37763fd748502030b62519867e4f9e994a83bc4
SHA512

227b00b51f90f3f196676fd010c3801062e07b110fd2aeb182e32c0000242dd7672fd4e49242b998706ddec084c13ba66588bcea521f021096eeaf6fb0840a2f
SSDEEP

3072:EJgwBIxhn+dz7diTqkGqcZBUPs7dHNnu3lAzyDJkluJfBd8l:EuwWx8fScnUPey1BtB

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
860	Vteqya.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\18RH6WMFH2 = "C:\\Windows\\Vteqya.exe"	Vteqya.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	d6d645b00bde814fd35edb3c07d72a80.exe
File opened for modification	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	d6d645b00bde814fd35edb3c07d72a80.exe
File created	C:\Windows\Vteqya.exe	d6d645b00bde814fd35edb3c07d72a80.exe
File opened for modification	C:\Windows\Vteqya.exe	d6d645b00bde814fd35edb3c07d72a80.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	Vteqya.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International	Vteqya.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe
860	Vteqya.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
860	Vteqya.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 860	2156	d6d645b00bde814fd35edb3c07d72a80.exe	28
PID 2156 wrote to memory of 860	2156	d6d645b00bde814fd35edb3c07d72a80.exe	28
PID 2156 wrote to memory of 860	2156	d6d645b00bde814fd35edb3c07d72a80.exe	28
PID 2156 wrote to memory of 860	2156	d6d645b00bde814fd35edb3c07d72a80.exe	28

C:\Users\Admin\AppData\Local\Temp\d6d645b00bde814fd35edb3c07d72a80.exe
"C:\Users\Admin\AppData\Local\Temp\d6d645b00bde814fd35edb3c07d72a80.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\Vteqya.exe
  C:\Windows\Vteqya.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job

Filesize
344B

MD5
99aabc739008f11b7011274a43330c3a

SHA1
2383086a12ac0d1bed573dc7bbd5ef7574d95721

SHA256
ccfe7171912c2b6227b5e877e16740f6212f844f3f4f276d6fc3abe0a8bc6c21

SHA512
6b82993b0f7bd6e648244fb137a0623dbc473d61076414e42e2cfcb40058ab70ce6107dd18ebf786557f0b8dafcad35c8ce8568298cd70c05530716ca6c21703

Download Submit
C:\Windows\Vteqya.exe

Filesize
125KB

MD5
d6d645b00bde814fd35edb3c07d72a80

SHA1
764781724b5af6d9f14cf4d0463271ea05358ce8

SHA256
e6171ffbc8e0cd50e6136464a37763fd748502030b62519867e4f9e994a83bc4

SHA512
227b00b51f90f3f196676fd010c3801062e07b110fd2aeb182e32c0000242dd7672fd4e49242b998706ddec084c13ba66588bcea521f021096eeaf6fb0840a2f

Download Submit
memory/860-46437-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/860-10-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/860-46439-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/860-46440-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/860-46441-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/860-46442-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/860-46444-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/860-46445-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/860-46449-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2156-1-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2156-36991-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2156-0-0x0000000000250000-0x0000000000263000-memory.dmp

Filesize
76KB

Download
memory/2156-46438-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download