Overview
overview
8Static
static
8Win32.Pega...15.xls
windows10_x64
1Win32.Pega...15.xls
windows10_x64
1Win32.Pega...?).doc
windows10_x64
1Win32.Pega...15.doc
windows10_x64
1Win32.Pega...min.js
windows10_x64
1Win32.Pega...min.js
windows10_x64
1Win32.Pega...ain.js
windows10_x64
1Win32.Pega...ble.js
windows10_x64
1Win32.Pega...min.js
windows10_x64
1Win32.Pega...min.js
windows10_x64
1Win32.Pega...min.js
windows10_x64
1Win32.Pega...x.html
windows10_x64
1Win32.Pega...vg.xml
windows10_x64
Win32.Pega...min.js
windows10_x64
1Win32.Pega...hp.vbs
windows10_x64
1Win32.Pega...hp.vbs
windows10_x64
1Win32.Pega...hp.vbs
windows10_x64
1Win32.Pega...php.js
windows10_x64
1Win32.Pega...ol.exe
windows10_x64
1Win32.Pega...gs.bat
windows10_x64
1Win32.Pega...ct.bat
windows10_x64
1Win32.Pega...es.bat
windows10_x64
1Win32.Pega...re.bat
windows10_x64
1Win32.Pega...er.bat
windows10_x64
1Win32.Pega...er.bat
windows10_x64
1Win32.Pega...hp.ps1
windows10_x64
Win32.Pega...RS.BAT
windows10_x64
1Win32.Pega...ck.exe
windows10_x64
1Win32.Pega...pp.vbs
windows10_x64
1Win32.Pega...pp.vbs
windows10_x64
1Win32.Pega...pp.vbs
windows10_x64
1Win32.Pega...pp.vbs
windows10_x64
1Analysis
-
max time kernel
304s -
max time network
1002s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
23-07-2021 09:33
Behavioral task
behavioral1
Sample
Win32.Pegasus/cvs_banks/????????? (500) 30 06 2015.xls
Resource
win10v20210408
Behavioral task
behavioral2
Sample
Win32.Pegasus/cvs_banks/????????? (485) 24 08 2015.xls
Resource
win10v20210410
Behavioral task
behavioral3
Sample
Win32.Pegasus/cvs_banks/?????? ?? ?????? ?. ???????? ?? 13.02.2013 (?? ??????? ????????).doc
Resource
win10v20210410
Behavioral task
behavioral4
Sample
Win32.Pegasus/cvs_banks/?? ?????? ?? 17.11.2015.doc
Resource
win10v20210408
Behavioral task
behavioral5
Sample
Win32.Pegasus/Pegasus/web-adminpart/res/pnotify.custom.min.js
Resource
win10v20210410
Behavioral task
behavioral6
Sample
Win32.Pegasus/Pegasus/web-adminpart/res/messi.min.js
Resource
win10v20210408
Behavioral task
behavioral7
Sample
Win32.Pegasus/Pegasus/web-adminpart/res/main.js
Resource
win10v20210410
Behavioral task
behavioral8
Sample
Win32.Pegasus/Pegasus/web-adminpart/res/jquery.jeditable.js
Resource
win10v20210408
Behavioral task
behavioral9
Sample
Win32.Pegasus/Pegasus/web-adminpart/res/jquery.form.min.js
Resource
win10v20210410
Behavioral task
behavioral10
Sample
Win32.Pegasus/Pegasus/web-adminpart/res/jquery-ui.min.js
Resource
win10v20210410
Behavioral task
behavioral11
Sample
Win32.Pegasus/Pegasus/web-adminpart/res/jquery-1.11.2.min.js
Resource
win10v20210408
Behavioral task
behavioral12
Sample
Win32.Pegasus/Pegasus/web-adminpart/res/index.html
Resource
win10v20210410
Behavioral task
behavioral13
Sample
Win32.Pegasus/Pegasus/web-adminpart/res/glyphicons-halflings-regular.svg.xml
Resource
win10v20210408
Behavioral task
behavioral14
Sample
Win32.Pegasus/Pegasus/web-adminpart/res/bootstrap.min.js
Resource
win10v20210410
Behavioral task
behavioral15
Sample
Win32.Pegasus/Pegasus/web-adminpart/inc/mod_auth.php.vbs
Resource
win10v20210408
Behavioral task
behavioral16
Sample
Win32.Pegasus/Pegasus/web-adminpart/inc/mod_ajax_mjobs.php.vbs
Resource
win10v20210410
Behavioral task
behavioral17
Sample
Win32.Pegasus/Pegasus/web-adminpart/inc/mod_ajax_mcreds.php.vbs
Resource
win10v20210410
Behavioral task
behavioral18
Sample
Win32.Pegasus/Pegasus/web-adminpart/inc/ip2location.class.php.js
Resource
win10v20210408
Behavioral task
behavioral19
Sample
Win32.Pegasus/Pegasus/tools/signtool.exe
Resource
win10v20210410
Behavioral task
behavioral20
Sample
Win32.Pegasus/Pegasus/tools/recrypt_strings.bat
Resource
win10v20210408
Behavioral task
behavioral21
Sample
Win32.Pegasus/Pegasus/tools/rebuild_project.bat
Resource
win10v20210410
Behavioral task
behavioral22
Sample
Win32.Pegasus/Pegasus/tools/rebuild_modules.bat
Resource
win10v20210408
Behavioral task
behavioral23
Sample
Win32.Pegasus/Pegasus/tools/rebuild_core.bat
Resource
win10v20210410
Behavioral task
behavioral24
Sample
Win32.Pegasus/Pegasus/tools/prebuild_installer.bat
Resource
win10v20210410
Behavioral task
behavioral25
Sample
Win32.Pegasus/Pegasus/tools/postbuild_installer.bat
Resource
win10v20210408
Behavioral task
behavioral26
Sample
Win32.Pegasus/Pegasus/tools/make_binpack.php.ps1
Resource
win10v20210410
Behavioral task
behavioral27
Sample
Win32.Pegasus/Pegasus/tools/MAKE_INSTALLERS.BAT
Resource
win10v20210408
Behavioral task
behavioral28
Sample
Win32.Pegasus/Pegasus/tools/LZ4_pack.exe
Resource
win10v20210410
Behavioral task
behavioral29
Sample
Win32.Pegasus/Pegasus/shared/CommStructures.cpp.vbs
Resource
win10v20210408
Behavioral task
behavioral30
Sample
Win32.Pegasus/Pegasus/mod_NetworkConnectivity/transport_Generic.cpp.vbs
Resource
win10v20210410
Behavioral task
behavioral31
Sample
Win32.Pegasus/Pegasus/mod_KBRI/kbriTargetAccManager.cpp.vbs
Resource
win10v20210410
Behavioral task
behavioral32
Sample
Win32.Pegasus/Pegasus/mod_KBRI/kbriList.cpp.vbs
Resource
win10v20210408
General
-
Target
Win32.Pegasus/Pegasus/web-adminpart/res/index.html
-
Size
6KB
-
MD5
b2bca01c0889dc77378fc6dce84f6923
-
SHA1
fbcb68071316ab6d4da5b662a17c952f24d12fd8
-
SHA256
00b2eca7d1302e6f12877bc6237f2eacdd876394ad875573ca518dae802f6127
-
SHA512
604f96513870454cff37f523a8f0b9358f33aee001d8437f84bb198b80ca3d3767cacdddb595762c56438f343d6987eea3548dbc63cfc9c19438ede34f4eace8
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2411833893" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000363c6415b53014aa7dc66efac31064000000000020000000000106600000001000020000000e5d1cfa994d8bdecb18533566ea8b258f1cf1f812f6fb603d269c7509b636a43000000000e800000000200002000000098b9cea53f14af088ec65e0ba19f2eee9b63b80d1602621cb2b6c2f8f4d806fd20000000c4ba6949afac309c180e489be99b20c2888c9a26be9d715fab3ac3cd58c00ffc40000000d353247fdd79d55d566348bac3c57bbcacf4997b0a3a6355386bc1205af1dee6031f657bd1fd1099c7281029faad84837b0d935a4ad824519e4f5436729c6af8 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "333797651" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2399020314" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000363c6415b53014aa7dc66efac31064000000000020000000000106600000001000020000000bdfb9b445b6c27cdddb6210a7ef1afbcc4d5e1ca18d9f98ff962b9bcb6242ed0000000000e8000000002000020000000b517a399412785b8ce7db10d1c24f9cdfe6a05881167d4cb77acd0e86abbc83e2000000032a141eac00c85c7a332b802a678cd7764318d6d0864b2e123a6684af5cf431b4000000083cc6bfe87047ec2ea6ee1b1e8a8503c77f8bcf10c8eec4eb2028fda254f077e00fb6e418edc384b95b7046b0e9593838b737f02bf71b465a82042a4dd869e93 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2399020314" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "333846237" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30900133" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 803c8c90a57fd701 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BA653575-EB98-11EB-A11C-5E750A496B7A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30900133" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30900133" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b09a7b90a57fd701 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "333814245" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 492 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 492 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 492 iexplore.exe 492 iexplore.exe 1636 IEXPLORE.EXE 1636 IEXPLORE.EXE 1636 IEXPLORE.EXE 1636 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 492 wrote to memory of 1636 492 iexplore.exe IEXPLORE.EXE PID 492 wrote to memory of 1636 492 iexplore.exe IEXPLORE.EXE PID 492 wrote to memory of 1636 492 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Win32.Pegasus\Pegasus\web-adminpart\res\index.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:492 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
cd54147c202c58ba558d363be8280eb4
SHA15f8bfcd8e9d9c3aa615657452fe803400391f3c7
SHA25679dc4932101b6cb5e93bf0ff468e72dd7d3625d3c3e67c5717f0ee283f37a710
SHA512afe4b2c8a4fad89e3135d263c663c559f341b17b85e5de2210923274c3596c83dee5a93914d3e45ef3de15d3bf0cdd71186188423df7c0eca49bbb28fde2e0a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
b84a088f30e902d1386b0b45f906c414
SHA196bc7634b3a63f7532189cab5f876aae1818909c
SHA25695c8bcc5e018a7b117dda7765ee46d06a0753ad4db2226ccf3faec0ecae1bb4d
SHA512f99a79867bb395244e3071183670975340f8fe3b5022051f362e83134f633a4dc9f090f87232f1c2ee4fdcb80d7f884772005e7ec4d15247c2a056fe231abdb1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\6GHTJQDS.cookieMD5
180d9a623714448f273af61104cf8945
SHA1dba9aed43715700af623a7608b2cdabf272537c6
SHA256a501a2fdccf3f7623d2dacf9b3af233131d2badee5d73aea1883071bd35cae5a
SHA512cd3b83478a2b54427df87a50dcc65d41fdccbb7dcb7a06b212e5388d17ccdd39af08dd3e06e6b30144788d41bb6b87e73abf1d5e5fa40311f740e8b31ac6bef3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\BJMUWUSC.cookieMD5
ec30720b1b52135278891fc02bc23133
SHA14abf1bec00fd60bf412258f7ecf68e060c14ed76
SHA256b42ad2549554b5c19eeb72fc226a451d9b76feb9666ae90980ee8bebd6f37f8f
SHA51271915156fb09ad40226a967502ddaa5711b21802f545af9c03995f046498a78f6287f28790f4c4b8f58d076dcd52e57f3d05b9b481627c5044d56b07cc3491dc
-
memory/492-114-0x00007FF9860D0000-0x00007FF98613B000-memory.dmpFilesize
428KB
-
memory/1636-115-0x0000000000000000-mapping.dmp