4932535e1109fad42425fc977e09c9743b5aa904a7161b8600b4a989532d3974

Resubmissions

13-08-2024 23:36

240813-3lyfgawdrr 5

13-08-2024 23:33

240813-3jvxka1fkh 10

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
13-08-2024 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

byfron-01a570a3cd0a46f2/Celestial/PYZ-00.toc
Size

33KB
MD5

d0f60098f028f37884339ad0d6e70cea
SHA1

9bb4df4592575055a965e69acd21f9f46c837ac5
SHA256

ea7180e38f791a9960c2590064168bf5f56e47327634b39ab14e1ef4a74307f1
SHA512

6daaea1addec51d9260b39d1860f0bf2ae47278555a9a929a652b6bd0638aab34b08e62413c7f515127dd87eca940aec5a93911b1834378b099392aa537a094b
SSDEEP

192:gIqIPX5w8299Si+JLd5CQJm7trPhjvQkQSNhNMNqN+8HNl0Z7/ARcrCEI4QubqDs:RcaUT6cRfmIk2H58S1Iran49uV7hI

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1700	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\byfron-01a570a3cd0a46f2\Celestial\PYZ-00.toc
1⤵
- Modifies registry class
PID:5952

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads