Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 07:06
Static task
static1
Behavioral task
behavioral1
Sample
Celesty.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Celesty.exe
Resource
win10v2004-20240412-en
General
-
Target
Celesty.exe
-
Size
1.7MB
-
MD5
8966d25141f5e150ff7d02ac502cce46
-
SHA1
f882485d1ffac1b75b60794824b771e4ce33d7b7
-
SHA256
8694257c04deed3937833145954c65564627f7d40cd20f8401696933a03b7e3f
-
SHA512
caedef6e8fdc042d6586816bdc87c36b3d40c22a8e4e331d46296b669ed03f2e295f4b44ed4092f43e8d0dad8cc40766982d6938d1d638fb4e4eecaddd529df3
-
SSDEEP
49152:6PxCjaDpascfyHTtgWc79pGvFog9hlQ0xM7QYeYnUgy:mCq4sokTtlPFooQzzU/
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/935223250571640882/ViB43kUXE9CCFxm2v1jxJfLyHYVNk3Y3-laU94OpWmJjw7id0TwbDJUP1by4-O7zvfZu
Signatures
-
Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions CELESTY BUILDER.EXE -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools CELESTY BUILDER.EXE -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion CELESTY BUILDER.EXE -
Executes dropped EXE 3 IoCs
pid Process 2500 CelestyBuilder.exe 2628 CELESTY BUILDER.EXE 2416 CELESTY.EXE -
Loads dropped DLL 4 IoCs
pid Process 2172 Celesty.exe 2172 Celesty.exe 2500 CelestyBuilder.exe 2500 CelestyBuilder.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 8 discord.com 9 discord.com 10 discord.com -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip4.seeip.org 5 ip4.seeip.org 6 ip-api.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 CELESTY BUILDER.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 1 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S CELESTY BUILDER.EXE -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString CELESTY BUILDER.EXE -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName CELESTY BUILDER.EXE -
Modifies registry class 57 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 CELESTY.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 CELESTY.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f44471a0359723fa74489c55595fe6b30ee0000 CELESTY.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff CELESTY.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU CELESTY.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff CELESTY.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg CELESTY.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2" CELESTY.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" CELESTY.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} CELESTY.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" CELESTY.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 CELESTY.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" CELESTY.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 CELESTY.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" CELESTY.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" CELESTY.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 CELESTY.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 CELESTY.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 CELESTY.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC} CELESTY.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders CELESTY.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 CELESTY.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg CELESTY.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16" CELESTY.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 CELESTY.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" CELESTY.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" CELESTY.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" CELESTY.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings CELESTY.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff CELESTY.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4" CELESTY.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 CELESTY.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 CELESTY.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" CELESTY.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff CELESTY.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff CELESTY.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" CELESTY.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0" CELESTY.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 CELESTY.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" CELESTY.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell CELESTY.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1" CELESTY.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff CELESTY.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1" CELESTY.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff CELESTY.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" CELESTY.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots CELESTY.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff CELESTY.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9} CELESTY.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg CELESTY.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" CELESTY.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 200000001a00eebbfe230000100090e24d373f126545916439c4925e467b00000000 CELESTY.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 CELESTY.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" CELESTY.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags CELESTY.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257" CELESTY.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell CELESTY.EXE -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 CELESTY BUILDER.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 CELESTY BUILDER.EXE -
Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2416 CELESTY.EXE 2488 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2628 CELESTY BUILDER.EXE Token: SeDebugPrivilege 2488 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2416 CELESTY.EXE 2416 CELESTY.EXE 2416 CELESTY.EXE 2416 CELESTY.EXE 2416 CELESTY.EXE 2416 CELESTY.EXE 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2416 CELESTY.EXE 2416 CELESTY.EXE 2416 CELESTY.EXE 2416 CELESTY.EXE 2416 CELESTY.EXE 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe 2488 taskmgr.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2416 CELESTY.EXE 2416 CELESTY.EXE 2416 CELESTY.EXE 2416 CELESTY.EXE 2416 CELESTY.EXE 2416 CELESTY.EXE 2416 CELESTY.EXE 2416 CELESTY.EXE 2416 CELESTY.EXE 2416 CELESTY.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2500 2172 Celesty.exe 28 PID 2172 wrote to memory of 2500 2172 Celesty.exe 28 PID 2172 wrote to memory of 2500 2172 Celesty.exe 28 PID 2172 wrote to memory of 2500 2172 Celesty.exe 28 PID 2500 wrote to memory of 2628 2500 CelestyBuilder.exe 29 PID 2500 wrote to memory of 2628 2500 CelestyBuilder.exe 29 PID 2500 wrote to memory of 2628 2500 CelestyBuilder.exe 29 PID 2500 wrote to memory of 2628 2500 CelestyBuilder.exe 29 PID 2500 wrote to memory of 2416 2500 CelestyBuilder.exe 31 PID 2500 wrote to memory of 2416 2500 CelestyBuilder.exe 31 PID 2500 wrote to memory of 2416 2500 CelestyBuilder.exe 31 PID 2500 wrote to memory of 2416 2500 CelestyBuilder.exe 31 PID 2628 wrote to memory of 2740 2628 CELESTY BUILDER.EXE 33 PID 2628 wrote to memory of 2740 2628 CELESTY BUILDER.EXE 33 PID 2628 wrote to memory of 2740 2628 CELESTY BUILDER.EXE 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\Celesty.exe"C:\Users\Admin\AppData\Local\Temp\Celesty.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Roaming\dump\CelestyBuilder.exe"C:\Users\Admin\AppData\Roaming\dump\CelestyBuilder.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\CELESTY BUILDER.EXE"C:\Users\Admin\AppData\Local\Temp\CELESTY BUILDER.EXE"3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2628 -s 17484⤵PID:2740
-
-
-
C:\Users\Admin\AppData\Local\Temp\CELESTY.EXE"C:\Users\Admin\AppData\Local\Temp\CELESTY.EXE"3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2416
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2488
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD54cc81e53b9037673b9014431e9be0e60
SHA162c57cbad6be321e65bea71bd87801fcb0bf7af9
SHA2561baf3f560a47aacd9a841939ff127fbade26095dd47867dfec38bc2f1fa4a9ad
SHA512dae96f885d20fe185302f689f844032797209b28d1295444a29fa730d01b520e7994121fe8bd2b55c0d21b395da372a9846d9dec5960edfecd40ac41690d36ff
-
Filesize
53KB
MD5098062dde5741b0b42e73060a1b95db0
SHA1803e9fd3f740cfebb06333a7e056e6b6dbdc10d1
SHA25663e2cb9d0bfc79659e24fb3b119b249691dc79c5da7c42f7e79a9dcdd8ccd611
SHA51269a18ec7f7fc8e49c2ef9f0ffc62020bd603f6874ecf6cc2c16351aaddad4a3ef37a7575c6f44065aa1cf606d2ad85275a003105cbe4527d9a9b035d6bfd678a
-
Filesize
2.7MB
MD5c3009ee63bc661d9ea75eaeb256448ca
SHA145eb01150756df432e25eed44d976442473356de
SHA2560bb88564a22bfd6d9ad6e4d8efa9077792a7b6094c2a0f865d70c43e11507352
SHA51296f5847fbeef95df1309e97a4bc3d786a5f5c19b87e804f12d88b4473a0b50291c40407a3d95a2d5d78031f03be76da47f1846a73c7802ddae46a38ac4634e67
-
Filesize
2.8MB
MD5d604d3ac515faf6ad32e8e57c170d389
SHA102069909d405b33af28da67ad232013307a198b2
SHA2565d3955502a6b63e394eea67aad6c83dfa80d08484d9f11956e77ec5b47c6f8b8
SHA512bb1d77a7430204eef2ecb3cdfb7d2b2b5f80f9f5fefee6cbff2fc69538523177e8010d9dc4b353f4adc4c6bdba2c398ceac90ce43a1302b2cdf5149dd7680817