File name:

Vega X - v2.1.0a.rar

Full analysis: https://app.any.run/tasks/efa94590-1937-436f-b5ce-e49dbc0ef6b8
Verdict: Malicious activity
Analysis date: June 27, 2021, 14:29:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

75D51BBBC3CDD42F762B44453BAFDF27

SHA1:

89124D6A6212BA07D88EBF271A20F1D3C5851D23

SHA256:

F7D1BAAB976ED78827A127FD85D14A3F0DF028033DE978DF857F8B42FEBCB9D8

SSDEEP:

196608:G8tQrWJ9eVE801hHJ+ktoFV/XFp2qYh21J7czVNzX+7jzO4fAH/mnCcHN2YPU:jtQyTl97oFkpBzkGWAfOCLYPU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Vega X.exe (PID: 3528)
      • Vega X.exe (PID: 2364)

    • Loads dropped or rewritten executable

      • Vega X.exe (PID: 3528)

    • Changes settings of System certificates

      • Vega X.exe (PID: 2364)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2128)

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 2128)

    • Reads Environment values

      • Vega X.exe (PID: 3528)
      • Vega X.exe (PID: 2364)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 2128)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 2128)

    • Adds / modifies Windows certificates

      • Vega X.exe (PID: 2364)

  • INFO

    • Creates files in the user directory

      • iexplore.exe (PID: 860)
      • iexplore.exe (PID: 2212)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2212)

    • Application launched itself

      • iexplore.exe (PID: 2212)

    • Manual execution by user

      • iexplore.exe (PID: 2212)

    • Changes internet zones settings

      • iexplore.exe (PID: 2212)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2212)

    • Reads internet explorer settings

      • iexplore.exe (PID: 860)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start drop and start start winrar.exe notepad.exe no specs vega x.exe iexplore.exe iexplore.exe vega x.exe

Process information

PID
CMD
Path
Indicators
Parent process
860"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2212 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2128"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Vega X - v2.1.0a.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2212"C:\Program Files\Internet Explorer\iexplore.exe" C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2364"C:\Users\admin\AppData\Local\Temp\Rar$EXa2128.7633\Vega X - v2.1.0a\Vega X.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2128.7633\Vega X - v2.1.0a\Vega X.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Vega X
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2128.7633\vega x - v2.1.0a\vega x.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3528"C:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\Vega X.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\Vega X.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Vega X
Exit code:
3489660927
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2128.773\vega x - v2.1.0a\vega x.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3752"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa2128.375\README.txtC:\Windows\system32\NOTEPAD.EXE—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
1 082
Read events
965
Write events
114
Delete events
3

Modification events

(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2128) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Vega X - v2.1.0a.rar
(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2128) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
8
Suspicious files
12
Text files
87
Unknown types
2

Dropped files

PID
Process
Filename
Type
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2128.375\README.txttext
MD5:—
SHA256:—
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\README.txttext
MD5:—
SHA256:—
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\EasyExploitsDLL.dllexecutable
MD5:—
SHA256:—
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\Scripts\ClickTeleport.txttext
MD5:CE437BB36FC9E70D7AFE7FE0C967E518
SHA256:E41E037A673EE7A9846C75030C95B522D1A188F13F71032CF93FF23E10DAEF0D
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\EasyExploits.dllexecutable
MD5:1C5FFE214040F00EC898BD3C5110E8B2
SHA256:23312041FFA8628A7F89A21BA72AF853CB90F26CF134D456656276930B26C1EC
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\CUSTOM THEMES.txttext
MD5:B91AAB49A3AC94CFE38A4308CBCE46D5
SHA256:62987ED8838CE93EFACE6CDD00109D89E3EFCA33B95AD743A47F84AA79098534
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\Scripts\Dex Explorer V2.txttext
MD5:5C3866FD535E0D8753999ABAD37CC58A
SHA256:9CF75612842A8527D3E7C112690B5A0758FB996D536E0D2218CB6C63846A1FC0
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\Scripts\BrokenBonesIV.txttext
MD5:328A2D6EE854477896ECDF75E0F1FC6E
SHA256:53F93CE6CBE9EBB909AFABF70A419823AE49B1EB55DFAE77C6C65BECF0466462
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\Scripts\FPS Aimlock.luatext
MD5:F0486D7D400D17A29F3A3A0A9EF8828C
SHA256:4B16D7D4542E9C181F98CBCC60976DDE82321F60DA01FE0D452AAA42B446D7F2
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\Scripts\Advanced Prison Life UI.txttext
MD5:5616C8B8F301353EC757929976B948D0
SHA256:3248C19E0002F732503D0970277B212931176CA11105D58546CED6F78B1D3C86
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Vega X - v2.1.0a.rar