Overview
overview
7Static
static
3SetupVega_x64.exe
windows10-2004-x64
7SetupVega_x64.exe
windows11-21h2-x64
7$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3Vega.exe
windows10-2004-x64
1Vega.exe
windows11-21h2-x64
1VegaTeam.exe
windows10-2004-x64
1VegaTeam.exe
windows11-21h2-x64
1badgetempl...1.docx
windows10-2004-x64
6badgetempl...1.docx
windows11-21h2-x64
6badgetempl...2.docx
windows10-2004-x64
6badgetempl...2.docx
windows11-21h2-x64
6convert.exe
windows10-2004-x64
3convert.exe
windows11-21h2-x64
3libmysql.dll
windows10-2004-x64
1libmysql.dll
windows11-21h2-x64
1pgnviewer/vega.html
windows10-2004-x64
4pgnviewer/vega.html
windows11-21h2-x64
4plugin/arpo.exe
windows10-2004-x64
3plugin/arpo.exe
windows11-21h2-x64
3plugin/javafo.jar
windows10-2004-x64
1plugin/javafo.jar
windows11-21h2-x64
1plugin/javafo1.jar
windows10-2004-x64
1plugin/javafo1.jar
windows11-21h2-x64
1Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/05/2026, 12:23
Static task
static1
Behavioral task
behavioral1
Sample
SetupVega_x64.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
SetupVega_x64.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20250610-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
Vega.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Vega.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
VegaTeam.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
VegaTeam.exe
Resource
win11-20250502-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
badgetemplate/WordMaster/Master1.docx
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
badgetemplate/WordMaster/Master1.docx
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
badgetemplate/WordMaster/Master2.docx
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
badgetemplate/WordMaster/Master2.docx
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
convert.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
convert.exe
Resource
win11-20250610-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
libmysql.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
libmysql.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
pgnviewer/vega.html
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
pgnviewer/vega.html
Resource
win11-20250619-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
plugin/arpo.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
plugin/arpo.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
plugin/javafo.jar
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
plugin/javafo.jar
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
plugin/javafo1.jar
Resource
win10v2004-20250619-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
plugin/javafo1.jar
Resource
win11-20260130-en
windows11-21h2-x64
General
- Target badgetemplate/WordMaster/Master2.docx
- Size 22KB
- Sample260508-pkg57scv3p
- SHA256 39437e1f73ebda05019e9f98e06be19d1564169c9ada296dd5a42227bd39633c
- MD5 0cd45e57f44b3537f44ecca068f6afe0
- SHA1 9a7bd36405e2ec2b9205f0f1ea82c26dbb146b8f
- SHA512 7d7a7f7215af2f50c8cefde5c91cf49fe001e6a8ccf05aac91e105cf46c33dd3622ae5ac36df48167ea986919e869f7c5f0ebc7639c3acc92e5bd8c11fcfe235
- SSDEEP 384:3/3XKKZwO7EbSLQQzDvUhG6Le8zSKgCH/m5J6cc/1hp1YYjjs/:3vKKZbWeQSUs6y8z9gCH/m5zc/1CYjg/
- TLSH T174B2E0ABE71E3514D095C53DA03536A6FA420CD37A15A3FC3886375C93A0D550FBE56C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Users\Admin\Documents\My Data Sources\DESKTOP.INI WINWORD.EXE File opened for modification C:\Users\Admin\Documents\My Data Sources\DESKTOP.INI WINWORD.EXE - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE - Modifies registry class 40 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 6800310000000000a85c876814004d59444154417e310000500009000400efbea85c8768a85c87682e000000ea450200000007000000000000000000000000000000ff65a4004d00790020004400610074006100200053006f0075007200630065007300000018000000 WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\NodeSlot = "1" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 8400310000000000a85c87681100444f43554d457e3100006c0009000400efbe3e5c1c02a85c87682e0000006ee101000000010000000000000000004200000000003ac9a60044006f00630075006d0065006e0074007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370037003000000018000000 WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000003e5cd60d100041646d696e003c0009000400efbe3e5c1c02a85c82682e00000065e1010000000100000000000000000000000000000052375800410064006d0069006e00000014000000 WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000003e5c1c021100557365727300640009000400efbe874f7748a85c82682e000000c70500000000010000000000000000003a000000000017d4760055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = ffffffff WINWORD.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1388 WINWORD.EXE 1388 WINWORD.EXE - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1388 WINWORD.EXE 1388 WINWORD.EXE 1388 WINWORD.EXE 1388 WINWORD.EXE 1388 WINWORD.EXE 1388 WINWORD.EXE 1388 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\badgetemplate\WordMaster\Master2.docx" /o ""1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1388
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Documents\My Data Sources\+Connect to New Data Source.odc
- Size 190B
- SHA256 3a13080059292811e5ac3f9e8b04b2c8eea95d6a5538116ad751d11c834e6056
- MD5 16a8a9a2b0a8b65faf28e1007db6733f
- SHA1 6f3f3fa4219fccee5abafeb4ca0f61dbd2b8e8b8
- SHA512 e0e5ec737cbafa7ae51c6e24dacd8c961de4ad2becff4d189ef11f763af872063d0f2e80b96db3da02f94a37cb59653ccb5f66713b6d00734c958b7cd451eac9
- TLSH T170C012B721420C0F6370B5715882B1C843567910A1085C84C0AAB4BF6DE5B85CE93356
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Documents\My Data Sources\+NewSQLServerConnection.odc
- Size 196B
- SHA256 43b12e68fb3b5bcc4099d796fa670a62b116a894437454a20050661def9d8816
- MD5 149e8c684b9ea9887dd2e7e596e7187c
- SHA1 99029c30bafea463b991acef6a7eeedb12f84d8d
- SHA512 ee738b6663c81d5872765fe03aba7b49240026951c9dabd72e08848a0d5c86bbb44bc8a246032edc494ca207adfa042b41fcbdb83a63c4e1f09bccb1a0f3b180
- TLSH T12BD012B721421C0E6370B5719893B1C403567910A2185C44D0A674AF6DD5B85CB93355
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Documents\My Data Sources\FOLDER.ICO
- Size 4KB
- SHA256 3114451f95c7fb8d7d884a19c724f6c7ff906b6d9bec1bf7c6300d2cca4f43a6
- MD5 a6ddccfdad18d5ca7aaeb168b6d02253
- SHA1 36e666090d5a0bded46937566f397bff4d8b13e8
- SHA512 55ecdc79a64ac40329c7742a26bb043d8f5735d631fd9cf5e78620d647641b9cc1aedd97209b7590fe2fdd157e79672fb15148d4b4f0ab4c6f6a51343222bbd8
- SSDEEP 48:rFry58nP0pB/ewjcYzrd67pn8MZEXry58nP0pB/ewjcYzrd67sEo4fvL4FVLbIy+:rFOQGJ6V8MZKOQGJ6k4/IpI
- TLSH T143A17D42623C84C2EAA694329907CBB85A847D0F6FD518B375A13E1BFD313B871356E8
- MD5 SHA1 SHA512 SSDEEP TLSH