Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
18s -
max time network
21s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
22/04/2024, 18:41
Static task
static1
Behavioral task
behavioral1
Sample
CeleryX.rar
Resource
win10v2004-20240412-en
3 signatures
600 seconds
General
-
Target
CeleryX.rar
-
Size
8.7MB
-
MD5
efa6c09a3f7a0daa16533a3af4072458
-
SHA1
e214a6b1c4f933c7f3d111fe8fb77f527a6ff1fb
-
SHA256
ea0a7d2a8597c2d3c98bf48518075ffd9cca35144d9a85cf2d5c6e5b736151ba
-
SHA512
a37e4bd6d9ab22634bda28e320ba84428fcaadd7c858619b1b35687cd555d5b025bdf83d69e4d759474a6e824c93159af24973ad1ab56c52657a514b83a7b383
-
SSDEEP
196608:+f6hzozHACMAM1Cbiwo4TbluHoDvpu/t3v+ywptd+8s:Uv8uFTBMoDxy3snd7s
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 2752 OpenWith.exe 2752 OpenWith.exe 2752 OpenWith.exe 2752 OpenWith.exe 2752 OpenWith.exe 2752 OpenWith.exe 2752 OpenWith.exe 2752 OpenWith.exe 2752 OpenWith.exe 2752 OpenWith.exe 2752 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\CeleryX.rar1⤵
- Modifies registry class
PID:1568
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2752
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1232