Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10MonoExploits.rar
windows7-x64
3MonoExploits.rar
windows10-2004-x64
3Mono/CeleryIn.dll
windows7-x64
1Mono/CeleryIn.dll
windows10-2004-x64
1Mono/CeleryInject.exe
windows7-x64
1Mono/CeleryInject.exe
windows10-2004-x64
1Mono/Guna.UI2.dll
windows7-x64
1Mono/Guna.UI2.dll
windows10-2004-x64
1Mono/Monac...o.html
windows7-x64
1Mono/Monac...o.html
windows10-2004-x64
1Mono/Monaco/base.txt
windows7-x64
1Mono/Monaco/base.txt
windows10-2004-x64
1Mono/Monac...nc.txt
windows7-x64
1Mono/Monac...nc.txt
windows10-2004-x64
1Mono/Monac...lf.txt
windows7-x64
1Mono/Monac...lf.txt
windows10-2004-x64
1Mono/Monac...ns.txt
windows7-x64
1Mono/Monac...ns.txt
windows10-2004-x64
1Mono/Monac...lv.txt
windows7-x64
1Mono/Monac...lv.txt
windows10-2004-x64
1Mono/Monac...ain.js
windows7-x64
3Mono/Monac...ain.js
windows10-2004-x64
3Mono/Monac...bat.js
windows7-x64
3Mono/Monac...bat.js
windows10-2004-x64
3Mono/Monac...fee.js
windows7-x64
3Mono/Monac...fee.js
windows10-2004-x64
3Mono/Monac...cpp.js
windows7-x64
3Mono/Monac...cpp.js
windows10-2004-x64
3Mono/Monac...arp.js
windows7-x64
3Mono/Monac...arp.js
windows10-2004-x64
3Mono/Monac...csp.js
windows7-x64
3Mono/Monac...csp.js
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 15:05
Behavioral task
behavioral1
Sample
MonoExploits.rar
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
MonoExploits.rar
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
Mono/CeleryIn.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
Mono/CeleryIn.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Mono/CeleryInject.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
Mono/CeleryInject.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Mono/Guna.UI2.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
Mono/Guna.UI2.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
Mono/Monaco/Monaco.html
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Mono/Monaco/Monaco.html
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
Mono/Monaco/base.txt
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
Mono/Monaco/base.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
Mono/Monaco/classfunc.txt
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
Mono/Monaco/classfunc.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
Mono/Monaco/globalf.txt
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
Mono/Monaco/globalf.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
Mono/Monaco/globalns.txt
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
Mono/Monaco/globalns.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
Mono/Monaco/globalv.txt
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
Mono/Monaco/globalv.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
Mono/Monaco/vs/base/worker/workerMain.js
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
Mono/Monaco/vs/base/worker/workerMain.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
Mono/Monaco/vs/basic-languages/bat/bat.js
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
Mono/Monaco/vs/basic-languages/bat/bat.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
Mono/Monaco/vs/basic-languages/coffee/coffee.js
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
Mono/Monaco/vs/basic-languages/coffee/coffee.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
Mono/Monaco/vs/basic-languages/cpp/cpp.js
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
Mono/Monaco/vs/basic-languages/cpp/cpp.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
Mono/Monaco/vs/basic-languages/csharp/csharp.js
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
Mono/Monaco/vs/basic-languages/csharp/csharp.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
Mono/Monaco/vs/basic-languages/csp/csp.js
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
Mono/Monaco/vs/basic-languages/csp/csp.js
Resource
win10v2004-20240709-en
General
-
Target
Mono/CeleryInject.exe
-
Size
3.4MB
-
MD5
ff3728a63db84bd000176d56e5672d0f
-
SHA1
ddac6646d16d6efe73d9cf8b8c7a8cb3d8ab55ae
-
SHA256
375f3b4bdff6a9d9ac581456d0ed49b56e72443cc09bac1010596b74b8945d02
-
SHA512
8824507a41a59ec649d51f012c6ec777237edc42b764c47c9fdff6e7e3722adf0283ff118ad69018cd27911572feb1db280a5feecea2936780e6dddfa5df3eb3
-
SSDEEP
49152:B5EU2GVV1EcBHbhI9ZFlDGjiolwOp3fvGA:UsX1JUu
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe 2528 CeleryInject.exe