File name:

Vega X - v2.1.0a.rar

Full analysis: https://app.any.run/tasks/efa94590-1937-436f-b5ce-e49dbc0ef6b8
Verdict: Malicious activity
Analysis date: June 27, 2021, 14:29:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

75D51BBBC3CDD42F762B44453BAFDF27

SHA1:

89124D6A6212BA07D88EBF271A20F1D3C5851D23

SHA256:

F7D1BAAB976ED78827A127FD85D14A3F0DF028033DE978DF857F8B42FEBCB9D8

SSDEEP:

196608:G8tQrWJ9eVE801hHJ+ktoFV/XFp2qYh21J7czVNzX+7jzO4fAH/mnCcHN2YPU:jtQyTl97oFkpBzkGWAfOCLYPU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Vega X.exe (PID: 3528)
      • Vega X.exe (PID: 2364)

    • Changes settings of System certificates

      • Vega X.exe (PID: 2364)

    • Loads dropped or rewritten executable

      • Vega X.exe (PID: 3528)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2128)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 2128)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 2128)

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 2128)

    • Reads Environment values

      • Vega X.exe (PID: 3528)
      • Vega X.exe (PID: 2364)

    • Adds / modifies Windows certificates

      • Vega X.exe (PID: 2364)

  • INFO

    • Reads internet explorer settings

      • iexplore.exe (PID: 860)

    • Changes internet zones settings

      • iexplore.exe (PID: 2212)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2212)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2212)

    • Creates files in the user directory

      • iexplore.exe (PID: 2212)
      • iexplore.exe (PID: 860)

    • Manual execution by user

      • iexplore.exe (PID: 2212)

    • Application launched itself

      • iexplore.exe (PID: 2212)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start drop and start start winrar.exe notepad.exe no specs vega x.exe iexplore.exe iexplore.exe vega x.exe

Process information

PID
CMD
Path
Indicators
Parent process
860"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2212 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2128"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Vega X - v2.1.0a.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2212"C:\Program Files\Internet Explorer\iexplore.exe" C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2364"C:\Users\admin\AppData\Local\Temp\Rar$EXa2128.7633\Vega X - v2.1.0a\Vega X.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2128.7633\Vega X - v2.1.0a\Vega X.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Vega X
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2128.7633\vega x - v2.1.0a\vega x.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3528"C:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\Vega X.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\Vega X.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Vega X
Exit code:
3489660927
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2128.773\vega x - v2.1.0a\vega x.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3752"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa2128.375\README.txtC:\Windows\system32\NOTEPAD.EXE—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
1 082
Read events
965
Write events
114
Delete events
3

Modification events

(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2128) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Vega X - v2.1.0a.rar
(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2128) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
(PID) Process:(2128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
8
Suspicious files
12
Text files
87
Unknown types
2

Dropped files

PID
Process
Filename
Type
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\README.txttext
MD5:9D246650F4456D727BDBD5BD881FB7EB
SHA256:2817E401BC6FE84B2591B8F86A19915B00749E4B744A3924819900B42E87FA69
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2128.375\README.txttext
MD5:9D246650F4456D727BDBD5BD881FB7EB
SHA256:2817E401BC6FE84B2591B8F86A19915B00749E4B744A3924819900B42E87FA69
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\EasyExploitsDLL.dllexecutable
MD5:B680C39804B99273518124EB129D5604
SHA256:6D81C929F24E6CF3AD47B2EDA6445395A86686BC675AA33E29ED89BDE597F09B
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\EasyExploits.dllexecutable
MD5:1C5FFE214040F00EC898BD3C5110E8B2
SHA256:23312041FFA8628A7F89A21BA72AF853CB90F26CF134D456656276930B26C1EC
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\CUSTOM THEMES.txttext
MD5:B91AAB49A3AC94CFE38A4308CBCE46D5
SHA256:62987ED8838CE93EFACE6CDD00109D89E3EFCA33B95AD743A47F84AA79098534
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\Scripts\AutoRob.txttext
MD5:B5B70D071D096BC2F28C04175B0C59B6
SHA256:7B251A346721DA706A23CF50A9E69AA3FE45523075D6A1D46D138A64EF9ACC9E
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\Scripts\Enable Reset Character.txttext
MD5:72AE47DEEEC8069BE19F0A0E2C1A269D
SHA256:E701732CB1F0E5774C9468E09BD8C1D635801AA1AB832CF85F3D4C2D34627420
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\Scripts\Lumber Dominator.txttext
MD5:75F3D278BD79556B847F9D2064A32589
SHA256:EBE72DD308BA7F7FC5089837A694C45DBC67906DCBB3C699D99E67AF20F8E4B3
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\Scripts\ClickTeleport.txttext
MD5:CE437BB36FC9E70D7AFE7FE0C967E518
SHA256:E41E037A673EE7A9846C75030C95B522D1A188F13F71032CF93FF23E10DAEF0D
2128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2128.773\Vega X - v2.1.0a\Scripts\MM2.luatext
MD5:933DFC531AEAC6B3F8C80CD013B9F585
SHA256:243263E0349B1690CD242666116AE6BD79E3E1271C95D8D200AE0ABFAF77E6FA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Vega X - v2.1.0a.rar