Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3acf7fs.7z
windows7-x64
3acf7fs.7z
windows10-2004-x64
3Release/Be...er.dll
windows7-x64
1Release/Be...er.dll
windows10-2004-x64
1Release/CeleryApp.exe
windows7-x64
1Release/CeleryApp.exe
windows10-2004-x64
1Release/CeleryIn.dll
windows7-x64
1Release/CeleryIn.dll
windows10-2004-x64
1Release/Ce...ct.exe
windows7-x64
1Release/Ce...ct.exe
windows10-2004-x64
1Release/Ce...g.json
windows7-x64
3Release/Ce...g.json
windows10-2004-x64
3Release/Ce...go.ico
windows7-x64
3Release/Ce...go.ico
windows10-2004-x64
3Release/Ce...go.png
windows7-x64
3Release/Ce...go.png
windows10-2004-x64
3Release/Ce...pt.bin
windows7-x64
3Release/Ce...pt.bin
windows10-2004-x64
3Release/Costura.dll
windows7-x64
1Release/Costura.dll
windows10-2004-x64
1Release/Dragablz.dll
windows7-x64
1Release/Dragablz.dll
windows10-2004-x64
1Release/Ma...rs.dll
windows7-x64
1Release/Ma...rs.dll
windows10-2004-x64
1Release/Ma...ns.dll
windows7-x64
1Release/Ma...ns.dll
windows10-2004-x64
1Release/Mi...re.dll
windows7-x64
1Release/Mi...re.dll
windows10-2004-x64
1Release/Mi...ms.dll
windows7-x64
1Release/Mi...ms.dll
windows10-2004-x64
1Release/Mi...pf.dll
windows7-x64
1Release/Mi...pf.dll
windows10-2004-x64
1Analysis
-
max time kernel
16s -
max time network
22s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/08/2024, 23:22
Static task
static1
Behavioral task
behavioral1
Sample
acf7fs.7z
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
acf7fs.7z
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Release/BetterFolderBrowser.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
Release/BetterFolderBrowser.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Release/CeleryApp.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Release/CeleryApp.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Release/CeleryIn.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Release/CeleryIn.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Release/CeleryInject.exe
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
Release/CeleryInject.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Release/CeleryLauncher.runtimeconfig.json
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
Release/CeleryLauncher.runtimeconfig.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Release/CeleryLogo.ico
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
Release/CeleryLogo.ico
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Release/CeleryLogo.png
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
Release/CeleryLogo.png
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Release/CeleryScript.bin
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
Release/CeleryScript.bin
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Release/Costura.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
Release/Costura.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Release/Dragablz.dll
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
Release/Dragablz.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Release/MaterialDesignColors.dll
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
Release/MaterialDesignColors.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Release/MaterialDesignExtensions.dll
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
Release/MaterialDesignExtensions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Release/Microsoft.Web.WebView2.Core.dll
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
Release/Microsoft.Web.WebView2.Core.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Release/Microsoft.Web.WebView2.WinForms.dll
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
Release/Microsoft.Web.WebView2.WinForms.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Release/Microsoft.Web.WebView2.Wpf.dll
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
Release/Microsoft.Web.WebView2.Wpf.dll
Resource
win10v2004-20240802-en
General
-
Target
acf7fs.7z
-
Size
7.2MB
-
MD5
3d82083f0584cfdf9636cd9dbffa3b50
-
SHA1
dcc5cb5ab5a52f8216bcec2c6ad8e9d08a712724
-
SHA256
97d7996c657dac39497001683776ea390ba3f3f70f31da017547bbd4590701d7
-
SHA512
37a2e19f6350fb0bc2c52abdfbdf01c4914f7a1d09a041d50715e109fc4c39b3c68f92ddb0e797939810935d1ec1faffa9cf663e365ef9cc78d90c72308fc895
-
SSDEEP
196608:ROmEQvI1Ca9aAOEVwOZZQYHRhEA9fdpDW9:ROlQvdAAnwbj5dp6
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3056 AcroRd32.exe 3056 AcroRd32.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2956 2080 cmd.exe 31 PID 2080 wrote to memory of 2956 2080 cmd.exe 31 PID 2080 wrote to memory of 2956 2080 cmd.exe 31 PID 2956 wrote to memory of 2708 2956 rundll32.exe 32 PID 2956 wrote to memory of 2708 2956 rundll32.exe 32 PID 2956 wrote to memory of 2708 2956 rundll32.exe 32 PID 2708 wrote to memory of 3056 2708 rundll32.exe 34 PID 2708 wrote to memory of 3056 2708 rundll32.exe 34 PID 2708 wrote to memory of 3056 2708 rundll32.exe 34 PID 2708 wrote to memory of 3056 2708 rundll32.exe 34
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\acf7fs.7z1⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\acf7fs.7z2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\acf7fs.7z3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\acf7fs.7z"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3056
-
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2252