Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
22/11/2023, 15:05
Behavioral task
behavioral1
Sample
Celestial.exe
Resource
win7-20231025-en
windows7-x64
4 signatures
150 seconds
General
-
Target
Celestial.exe
-
Size
264KB
-
MD5
d448a2df6f29c91c23b0d482fdb6ca49
-
SHA1
e533756132da1916cb3b6217edc066e72497bca3
-
SHA256
6ef6ef99e387801bbcb19f3295f0fa626fd2a0515a8f1947bce5d1f43fa6f968
-
SHA512
b1154c2cefb95e3e43738ac7a589c05482f126d7c325575a4540a100fac2691bd6bbeeb6105b8205132ae48fdbc68da4087a8d728e2529451ea342ae791ce6cf
-
SSDEEP
6144:DloZM+rIkd8g+EtXHkv/iD4rBKjuMzvEHlwOffuA1b8e1mDimV8vpFNEvt:hoZtL+EP8rBKjuMzvEHlwOffuUVm2vpX
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/3044-0-0x0000000000EC0000-0x0000000000F08000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 3044 Celestial.exe Token: SeIncreaseQuotaPrivilege 2664 wmic.exe Token: SeSecurityPrivilege 2664 wmic.exe Token: SeTakeOwnershipPrivilege 2664 wmic.exe Token: SeLoadDriverPrivilege 2664 wmic.exe Token: SeSystemProfilePrivilege 2664 wmic.exe Token: SeSystemtimePrivilege 2664 wmic.exe Token: SeProfSingleProcessPrivilege 2664 wmic.exe Token: SeIncBasePriorityPrivilege 2664 wmic.exe Token: SeCreatePagefilePrivilege 2664 wmic.exe Token: SeBackupPrivilege 2664 wmic.exe Token: SeRestorePrivilege 2664 wmic.exe Token: SeShutdownPrivilege 2664 wmic.exe Token: SeDebugPrivilege 2664 wmic.exe Token: SeSystemEnvironmentPrivilege 2664 wmic.exe Token: SeRemoteShutdownPrivilege 2664 wmic.exe Token: SeUndockPrivilege 2664 wmic.exe Token: SeManageVolumePrivilege 2664 wmic.exe Token: 33 2664 wmic.exe Token: 34 2664 wmic.exe Token: 35 2664 wmic.exe Token: SeIncreaseQuotaPrivilege 2664 wmic.exe Token: SeSecurityPrivilege 2664 wmic.exe Token: SeTakeOwnershipPrivilege 2664 wmic.exe Token: SeLoadDriverPrivilege 2664 wmic.exe Token: SeSystemProfilePrivilege 2664 wmic.exe Token: SeSystemtimePrivilege 2664 wmic.exe Token: SeProfSingleProcessPrivilege 2664 wmic.exe Token: SeIncBasePriorityPrivilege 2664 wmic.exe Token: SeCreatePagefilePrivilege 2664 wmic.exe Token: SeBackupPrivilege 2664 wmic.exe Token: SeRestorePrivilege 2664 wmic.exe Token: SeShutdownPrivilege 2664 wmic.exe Token: SeDebugPrivilege 2664 wmic.exe Token: SeSystemEnvironmentPrivilege 2664 wmic.exe Token: SeRemoteShutdownPrivilege 2664 wmic.exe Token: SeUndockPrivilege 2664 wmic.exe Token: SeManageVolumePrivilege 2664 wmic.exe Token: 33 2664 wmic.exe Token: 34 2664 wmic.exe Token: 35 2664 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2664 3044 Celestial.exe 28 PID 3044 wrote to memory of 2664 3044 Celestial.exe 28 PID 3044 wrote to memory of 2664 3044 Celestial.exe 28