Overview

overview

4

Static

static

1

URLScan

urlscan

1

https://celery.zip/R...

windows10-1703-x64

4

Analysis

  • max time kernel
    77s
  • max time network
    79s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05/08/2024, 07:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://celery.zip/Release.zip

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 37 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "https://celery.zip/Release.zip"
    1⤵
      PID:2216
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2924
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • NTFS ADS
      PID:4576
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3132
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4920
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:4812
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:1692
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2988
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2116
      • C:\Users\Admin\AppData\Local\Temp\Temp1_Release.zip\CeleryApp.exe
        "C:\Users\Admin\AppData\Local\Temp\Temp1_Release.zip\CeleryApp.exe"
        1⤵
          PID:1664

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\L5P12AEX\edgecompatviewlist[1].xml
          Filesize

          74KB

          MD5

          d4fc49dc14f63895d997fa4940f24378

          SHA1

          3efb1437a7c5e46034147cbbc8db017c69d02c31

          SHA256

          853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

          SHA512

          cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\W7KJ4SZ8\suggestions[1].en-US
          Filesize

          17KB

          MD5

          5a34cb996293fde2cb7a4ac89587393a

          SHA1

          3c96c993500690d1a77873cd62bc639b3a10653f

          SHA256

          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

          SHA512

          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF2FCA17A04386932F.TMP
          Filesize

          24KB

          MD5

          d3cdb7663712ddb6ef5056c72fe69e86

          SHA1

          f08bf69934fb2b9ca0aba287c96abe145a69366c

          SHA256

          3e8c2095986b262ac8fccfabda2d021fc0d3504275e83cffe1f0a333f9efbe15

          SHA512

          c0acd65db7098a55dae0730eb1dcd8aa94e95a71f39dd40b087be0b06afc5d1bb310f555781853b5a78a8803dba0fb44df44bd2bb14baeca29c7c7410dffc812

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\Release.zip.hch8fmk.partial
          Filesize

          9.1MB

          MD5

          39f94b3934c37e20ad404840281d10ce

          SHA1

          537841ac93567cd0a4ac2494197341208df76442

          SHA256

          7643f989a6b22411ac72a4c17ae5ddee007440bd794d1d3be416bb5b45b53f9b

          SHA512

          a63726c804a3772d49c2111fb18130762c9db6b3bedd8c07a064c1d33a2e0a2ca76e55351102993abe8d9d6758c217ed0eb8af4526ab86fa8ad0c8b93ad1a296

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\901MWWMO\Release[1].zip
          Filesize

          31KB

          MD5

          4278bc0c21ede1c80d6961833f4575c5

          SHA1

          68e5496e89c72c0bc6cead74466c5c1679a3ba73

          SHA256

          147178ecb8e27c51f79c3501877f115de648ef1d8b18fbf17173b5617cd7ad1f

          SHA512

          de29baa20849ca99640ece64d26eb89b2a96df7115e4f82b77f44f500d7b6ba53db511e5eb42e06e24cd37e9798ae26f69cbf780b299959a60e076edbc780729

          Download Submit

        • memory/1664-126-0x000001D1C1710000-0x000001D1C1748000-memory.dmp

          Filesize

          224KB

          Download

        • memory/1664-118-0x000001D1A59C0000-0x000001D1A6286000-memory.dmp

          Filesize

          8.8MB

          Download

        • memory/1664-125-0x000001D1C0890000-0x000001D1C0898000-memory.dmp

          Filesize

          32KB

          Download

        • memory/1664-124-0x000001D1C1460000-0x000001D1C14D4000-memory.dmp

          Filesize

          464KB

          Download

        • memory/1664-123-0x000001D1A6670000-0x000001D1A667E000-memory.dmp

          Filesize

          56KB

          Download

        • memory/1664-122-0x000001D1C13A0000-0x000001D1C1458000-memory.dmp

          Filesize

          736KB

          Download

        • memory/1664-121-0x000001D1C0A80000-0x000001D1C139E000-memory.dmp

          Filesize

          9.1MB

          Download

        • memory/1664-120-0x000001D1A7FD0000-0x000001D1A8020000-memory.dmp

          Filesize

          320KB

          Download

        • memory/1664-119-0x000001D1A6620000-0x000001D1A6660000-memory.dmp

          Filesize

          256KB

          Download

        • memory/1692-72-0x000001FECA850000-0x000001FECA950000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2924-0-0x00000281F4620000-0x00000281F4630000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2924-64-0x00000281FAEF0000-0x00000281FAEF1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2924-65-0x00000281FAF00000-0x00000281FAF01000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2924-35-0x00000281F88E0000-0x00000281F88E2000-memory.dmp

          Filesize

          8KB

          Download

        • memory/2924-16-0x00000281F4720000-0x00000281F4730000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2924-163-0x00000281F8A50000-0x00000281F8A52000-memory.dmp

          Filesize

          8KB

          Download

        • memory/2924-166-0x00000281F8910000-0x00000281F8911000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2924-170-0x00000281F1CD0000-0x00000281F1CD1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4812-53-0x000002156F200000-0x000002156F300000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/4812-61-0x000002157F5B0000-0x000002157F5B2000-memory.dmp

          Filesize

          8KB

          Download

        • memory/4812-56-0x000002157F3C0000-0x000002157F3C2000-memory.dmp

          Filesize

          8KB

          Download

        • memory/4812-59-0x000002157F3F0000-0x000002157F3F2000-memory.dmp

          Filesize

          8KB

          Download

        • memory/4920-43-0x00000248B71C0000-0x00000248B72C0000-memory.dmp

          Filesize

          1024KB

          Download