Analysis
-
max time kernel
152s -
max time network
147s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
04-02-2022 08:35
Static task
static1
Behavioral task
behavioral1
Sample
Vega Sky Tools.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Vega Sky Tools.exe
Resource
win10v2004-en-20220113
General
-
Target
Vega Sky Tools.exe
-
Size
407KB
-
MD5
2ad0998f87934e69a5096fc036c04a01
-
SHA1
30e95b536fdcd6953bf0cb21557bf3e7970535a9
-
SHA256
5a877117c8502edae43d30c15f39bf566b420919533e91ea44ce8e5e2b6e76c4
-
SHA512
149ef87ec93771eac235d7baf11f74a466ff59dc959be49f0862b024a5f5e5a61b20e952bdf70573220edf3ef93a1816fae0ebdbc2138ef0efe8093d9a016bb6
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
Vega Sky Tools.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Vega Sky Tools.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 1 IoCs
Processes:
Vega Sky Tools.exepid process 1656 Vega Sky Tools.exe -
Loads dropped DLL 2 IoCs
Processes:
Vega Sky Tools.exepid process 2036 Vega Sky Tools.exe 2036 Vega Sky Tools.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
Vega Sky Tools.exedescription ioc process File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE Vega Sky Tools.exe -
Drops file in Windows directory 1 IoCs
Processes:
Vega Sky Tools.exedescription ioc process File opened for modification C:\Windows\svchost.com Vega Sky Tools.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
Vega Sky Tools.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Vega Sky Tools.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Vega Sky Tools.exedescription pid process Token: SeDebugPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe Token: SeIncBasePriorityPrivilege 1656 Vega Sky Tools.exe Token: 33 1656 Vega Sky Tools.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Vega Sky Tools.exedescription pid process target process PID 2036 wrote to memory of 1656 2036 Vega Sky Tools.exe Vega Sky Tools.exe PID 2036 wrote to memory of 1656 2036 Vega Sky Tools.exe Vega Sky Tools.exe PID 2036 wrote to memory of 1656 2036 Vega Sky Tools.exe Vega Sky Tools.exe PID 2036 wrote to memory of 1656 2036 Vega Sky Tools.exe Vega Sky Tools.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vega Sky Tools.exe"C:\Users\Admin\AppData\Local\Temp\Vega Sky Tools.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\3582-490\Vega Sky Tools.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\Vega Sky Tools.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1656
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3582-490\Vega Sky Tools.exeMD5
5d14213a5987a82d0eb0459eebc806f5
SHA1ec7104bd18d6d2707bb7dfe5b50f4c21804d6b06
SHA256e47bb0910cb9bf68c08c6fad52a43bf51a0b0c2d11489aaec05570c8d7e76f83
SHA512573d66c930d069bc8f6801b04fc6755264b9c4c7b5ed07c6042a11f6dabf13181d3ec9f4dac91da7481e8b673089acb9833eb66129fe4dc705413e59967ad9fb
-
C:\Users\Admin\AppData\Local\Temp\3582-490\Vega Sky Tools.exeMD5
5d14213a5987a82d0eb0459eebc806f5
SHA1ec7104bd18d6d2707bb7dfe5b50f4c21804d6b06
SHA256e47bb0910cb9bf68c08c6fad52a43bf51a0b0c2d11489aaec05570c8d7e76f83
SHA512573d66c930d069bc8f6801b04fc6755264b9c4c7b5ed07c6042a11f6dabf13181d3ec9f4dac91da7481e8b673089acb9833eb66129fe4dc705413e59967ad9fb
-
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXEMD5
9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
\Users\Admin\AppData\Local\Temp\3582-490\Vega Sky Tools.exeMD5
5d14213a5987a82d0eb0459eebc806f5
SHA1ec7104bd18d6d2707bb7dfe5b50f4c21804d6b06
SHA256e47bb0910cb9bf68c08c6fad52a43bf51a0b0c2d11489aaec05570c8d7e76f83
SHA512573d66c930d069bc8f6801b04fc6755264b9c4c7b5ed07c6042a11f6dabf13181d3ec9f4dac91da7481e8b673089acb9833eb66129fe4dc705413e59967ad9fb
-
memory/1656-59-0x0000000002010000-0x0000000002012000-memory.dmpFilesize
8KB
-
memory/1656-58-0x000007FEF2FD0000-0x000007FEF4066000-memory.dmpFilesize
16.6MB
-
memory/1656-60-0x0000000002012000-0x0000000002014000-memory.dmpFilesize
8KB
-
memory/1656-61-0x0000000002018000-0x0000000002037000-memory.dmpFilesize
124KB
-
memory/1656-64-0x000000000203A000-0x000000000203B000-memory.dmpFilesize
4KB
-
memory/1656-63-0x0000000002037000-0x0000000002038000-memory.dmpFilesize
4KB
-
memory/2036-54-0x0000000076071000-0x0000000076073000-memory.dmpFilesize
8KB