Analysis
-
max time kernel
179s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
04-02-2022 08:35
Static task
static1
Behavioral task
behavioral1
Sample
Vega Sky Tools.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Vega Sky Tools.exe
Resource
win10v2004-en-20220113
General
-
Target
Vega Sky Tools.exe
-
Size
407KB
-
MD5
2ad0998f87934e69a5096fc036c04a01
-
SHA1
30e95b536fdcd6953bf0cb21557bf3e7970535a9
-
SHA256
5a877117c8502edae43d30c15f39bf566b420919533e91ea44ce8e5e2b6e76c4
-
SHA512
149ef87ec93771eac235d7baf11f74a466ff59dc959be49f0862b024a5f5e5a61b20e952bdf70573220edf3ef93a1816fae0ebdbc2138ef0efe8093d9a016bb6
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
Vega Sky Tools.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Vega Sky Tools.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 1 IoCs
Processes:
Vega Sky Tools.exepid process 4032 Vega Sky Tools.exe -
Sets service image path in registry 2 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Vega Sky Tools.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation Vega Sky Tools.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
Vega Sky Tools.exedescription ioc process File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\COOKIE~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\msedge.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\PWAHEL~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MICROS~4.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MI391D~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\MSEDGE~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MICROS~2.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13153~1.55\MICROS~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MIA062~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Install\{A9F77~1\EDGEMI~1.TMP\setup.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\MSEDGE~2.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\ELEVAT~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MICROS~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MI9C33~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\MSEDGE~3.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe Vega Sky Tools.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\NOTIFI~1.EXE Vega Sky Tools.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE Vega Sky Tools.exe -
Drops file in Windows directory 7 IoCs
Processes:
svchost.exeVega Sky Tools.exedescription ioc process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\svchost.com Vega Sky Tools.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe -
Modifies registry class 1 IoCs
Processes:
Vega Sky Tools.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Vega Sky Tools.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exedescription pid process Token: SeShutdownPrivilege 3104 svchost.exe Token: SeCreatePagefilePrivilege 3104 svchost.exe Token: SeShutdownPrivilege 3104 svchost.exe Token: SeCreatePagefilePrivilege 3104 svchost.exe Token: SeShutdownPrivilege 3104 svchost.exe Token: SeCreatePagefilePrivilege 3104 svchost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Vega Sky Tools.exeVega Sky Tools.exedescription pid process target process PID 4072 wrote to memory of 4032 4072 Vega Sky Tools.exe Vega Sky Tools.exe PID 4072 wrote to memory of 4032 4072 Vega Sky Tools.exe Vega Sky Tools.exe PID 4032 wrote to memory of 1688 4032 Vega Sky Tools.exe fondue.exe PID 4032 wrote to memory of 1688 4032 Vega Sky Tools.exe fondue.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vega Sky Tools.exe"C:\Users\Admin\AppData\Local\Temp\Vega Sky Tools.exe"1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\3582-490\Vega Sky Tools.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\Vega Sky Tools.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\system32\fondue.exe"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll3⤵PID:1688
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 509580387c73e55081e304f0becf032b exYODoUCP0ikMCSb/vNmBw.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:4180
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3104
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3582-490\Vega Sky Tools.exeMD5
5d14213a5987a82d0eb0459eebc806f5
SHA1ec7104bd18d6d2707bb7dfe5b50f4c21804d6b06
SHA256e47bb0910cb9bf68c08c6fad52a43bf51a0b0c2d11489aaec05570c8d7e76f83
SHA512573d66c930d069bc8f6801b04fc6755264b9c4c7b5ed07c6042a11f6dabf13181d3ec9f4dac91da7481e8b673089acb9833eb66129fe4dc705413e59967ad9fb
-
C:\Users\Admin\AppData\Local\Temp\3582-490\Vega Sky Tools.exeMD5
5d14213a5987a82d0eb0459eebc806f5
SHA1ec7104bd18d6d2707bb7dfe5b50f4c21804d6b06
SHA256e47bb0910cb9bf68c08c6fad52a43bf51a0b0c2d11489aaec05570c8d7e76f83
SHA512573d66c930d069bc8f6801b04fc6755264b9c4c7b5ed07c6042a11f6dabf13181d3ec9f4dac91da7481e8b673089acb9833eb66129fe4dc705413e59967ad9fb
-
memory/3104-175-0x00000195B5B30000-0x00000195B5B40000-memory.dmpFilesize
64KB
-
memory/3104-176-0x00000195B5B90000-0x00000195B5BA0000-memory.dmpFilesize
64KB
-
memory/3104-177-0x00000195B8890000-0x00000195B8894000-memory.dmpFilesize
16KB