4932535e1109fad42425fc977e09c9743b5aa904a7161b8600b4a989532d3974

Resubmissions

13-08-2024 23:36

240813-3lyfgawdrr 5

13-08-2024 23:33

240813-3jvxka1fkh 10

Analysis

max time kernel
146s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
13-08-2024 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

byfron-01a570a3cd0a46f2/Celestial/Celestial.pkg
Size

9.2MB
MD5

f45c5462eb6c0eb3754045600ef6857b
SHA1

5f9fe9279cec84bbf8500f43d9b9d1ae683ac835
SHA256

967b762feabc65da844f7a173a1a7a597cdf935d20fe72939d5a63a5cc4b958a
SHA512

f90b954238240ed09d9ce91e35207d04d11f87098d7ce8b0fa7cef1d521ffea9a1d1e8a840c1bc25c777409d3edb75d3b9eac13577ba87b8cf0b5ea3ca8f291a
SSDEEP

196608:4Cc+wuLIRBA1HeT39IigwE1ncKOVVtc97rttQ1N+upx746:9cVxq1+TtIiFg0VQxh6uUl

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1856	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\byfron-01a570a3cd0a46f2\Celestial\Celestial.pkg
1⤵
- Modifies registry class
PID:1644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads