Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
154s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
24/12/2023, 23:33
Behavioral task
behavioral1
Sample
celex.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
celex.exe
Resource
win10-20231220-en
Behavioral task
behavioral3
Sample
celex.exe
Resource
win10v2004-20231215-en
General
-
Target
celex.exe
-
Size
4.0MB
-
MD5
3d05f35dd57d171ef57a37fd9e8498fc
-
SHA1
c18418fe05ab38c0005ecbc0ed6ba10caca174c8
-
SHA256
070a26b9b519330da249104467525be63b1b23015d23c86b306d31465e79a024
-
SHA512
65dbc4c75dffcce863c351206cf43312c58cd1273f226c404df4da69cecabb407bfb277f4d1bbbab5952c730407a3d79f2d926b2aa77a6df7abc318c55868737
-
SSDEEP
98304:eEdeDPCpwDjPCTp9/ekFJkybBBHzmbLcwo8XGz:roPCSfaDmkFJk6BBypo8XGz
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ celex.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion celex.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion celex.exe -
resource yara_rule behavioral4/memory/1420-0-0x00007FF665290000-0x00007FF665D20000-memory.dmp themida behavioral4/memory/1420-2-0x00007FF665290000-0x00007FF665D20000-memory.dmp themida behavioral4/memory/1420-3-0x00007FF665290000-0x00007FF665D20000-memory.dmp themida behavioral4/memory/1420-4-0x00007FF665290000-0x00007FF665D20000-memory.dmp themida behavioral4/memory/1420-5-0x00007FF665290000-0x00007FF665D20000-memory.dmp themida behavioral4/memory/1420-6-0x00007FF665290000-0x00007FF665D20000-memory.dmp themida behavioral4/memory/1420-8-0x00007FF665290000-0x00007FF665D20000-memory.dmp themida behavioral4/memory/1420-7-0x00007FF665290000-0x00007FF665D20000-memory.dmp themida behavioral4/memory/1420-15-0x00007FF665290000-0x00007FF665D20000-memory.dmp themida behavioral4/memory/1420-17-0x00007FF665290000-0x00007FF665D20000-memory.dmp themida behavioral4/memory/1420-18-0x00007FF665290000-0x00007FF665D20000-memory.dmp themida behavioral4/memory/1420-19-0x00007FF665290000-0x00007FF665D20000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA celex.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1420 celex.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1420 wrote to memory of 2952 1420 celex.exe 81 PID 1420 wrote to memory of 2952 1420 celex.exe 81 PID 2952 wrote to memory of 3760 2952 cmd.exe 82 PID 2952 wrote to memory of 3760 2952 cmd.exe 82 PID 2952 wrote to memory of 4796 2952 cmd.exe 84 PID 2952 wrote to memory of 4796 2952 cmd.exe 84 PID 2952 wrote to memory of 2884 2952 cmd.exe 83 PID 2952 wrote to memory of 2884 2952 cmd.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\celex.exe"C:\Users\Admin\AppData\Local\Temp\celex.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\celex.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\celex.exe" MD53⤵PID:3760
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:2884
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:4796
-
-