File name:

Vega X - v2.1.0a.rar

Full analysis: https://app.any.run/tasks/efa94590-1937-436f-b5ce-e49dbc0ef6b8
Verdict: Malicious activity
Analysis date: June 27, 2021, 14:29:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

75D51BBBC3CDD42F762B44453BAFDF27

SHA1:

89124D6A6212BA07D88EBF271A20F1D3C5851D23

SHA256:

F7D1BAAB976ED78827A127FD85D14A3F0DF028033DE978DF857F8B42FEBCB9D8

SSDEEP:

196608:G8tQrWJ9eVE801hHJ+ktoFV/XFp2qYh21J7czVNzX+7jzO4fAH/mnCcHN2YPU:jtQyTl97oFkpBzkGWAfOCLYPU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Vega X.exe (PID: 3528)
      • Vega X.exe (PID: 2364)

    • Loads dropped or rewritten executable

      • Vega X.exe (PID: 3528)

    • Changes settings of System certificates

      • Vega X.exe (PID: 2364)

  • SUSPICIOUS

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 2128)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2128)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 2128)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 2128)

    • Reads Environment values

      • Vega X.exe (PID: 3528)
      • Vega X.exe (PID: 2364)

    • Adds / modifies Windows certificates

      • Vega X.exe (PID: 2364)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2212)

    • Manual execution by user

      • iexplore.exe (PID: 2212)

    • Creates files in the user directory

      • iexplore.exe (PID: 860)
      • iexplore.exe (PID: 2212)

    • Changes internet zones settings

      • iexplore.exe (PID: 2212)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2212)

    • Reads internet explorer settings

      • iexplore.exe (PID: 860)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2212)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start drop and start start winrar.exe notepad.exe no specs vega x.exe iexplore.exe iexplore.exe vega x.exe

Process information

PID
CMD
Path
Indicators
Parent process
860"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2212 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2128"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Vega X - v2.1.0a.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2212"C:\Program Files\Internet Explorer\iexplore.exe" C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2364"C:\Users\admin\AppData\Local\Temp\Rar$EXa2128.7633\Vega X - v2.1.0a\Vega X.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2128.7633\Vega X - v2.1.0a\Vega X.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Vega X
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2128.7633\vega x - v2.1.0a\vega x.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3528"C:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\Vega X.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\Vega X.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Vega X
Exit code:
3489660927
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2128.773\vega x - v2.1.0a\vega x.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3752"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa2128.375\README.txtC:\Windows\system32\NOTEPAD.EXE—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
1 082
Read events
965
Write events
114
Delete events
3

Modification events

(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2128) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Vega X - v2.1.0a.rar
(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2128) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
8
Suspicious files
12
Text files
87
Unknown types
2

Dropped files

PID
Process
Filename
Type
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2128.375\README.txttext
MD5:—
SHA256:—
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\README.txttext
MD5:—
SHA256:—
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\Scripts\Advanced Prison Life UI.txttext
MD5:5616C8B8F301353EC757929976B948D0
SHA256:3248C19E0002F732503D0970277B212931176CA11105D58546CED6F78B1D3C86
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\EasyExploits.dllexecutable
MD5:1C5FFE214040F00EC898BD3C5110E8B2
SHA256:23312041FFA8628A7F89A21BA72AF853CB90F26CF134D456656276930B26C1EC
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\Scripts\AutoRob.txttext
MD5:B5B70D071D096BC2F28C04175B0C59B6
SHA256:7B251A346721DA706A23CF50A9E69AA3FE45523075D6A1D46D138A64EF9ACC9E
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\EasyExploitsDLL.dllexecutable
MD5:—
SHA256:—
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\FastColoredTextBox.dllexecutable
MD5:8610F4D3CDC6CC50022FEDDCED9FDAEB
SHA256:AC926C92CCFC3789A5AE571CC4415EB1897D500A79604D8495241C19ACDF01B9
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\Scripts\Lumber Dominator.txttext
MD5:75F3D278BD79556B847F9D2064A32589
SHA256:EBE72DD308BA7F7FC5089837A694C45DBC67906DCBB3C699D99E67AF20F8E4B3
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\Scripts\Enable Reset Character.txttext
MD5:72AE47DEEEC8069BE19F0A0E2C1A269D
SHA256:E701732CB1F0E5774C9468E09BD8C1D635801AA1AB832CF85F3D4C2D34627420
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\Scripts\Infinite Donuts.luatext
MD5:CBE17D1B91DFE324C90E40FA9935E676
SHA256:6CE4A2A0473AF45B7FAC8637BC4FC667691557AEE2AC2C5F7BC327EE3C4065A4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Vega X - v2.1.0a.rar