Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/11/2024, 21:28
Behavioral task
behavioral1
Sample
753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe
Resource
win10v2004-20241007-en
General
-
Target
753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe
-
Size
45KB
-
MD5
7be4b0b2f700401c020e936fcbb55f52
-
SHA1
9fdc76da221ea52120cf79b6491a55a40c019de3
-
SHA256
753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f
-
SHA512
30e2d2d591370a82c20f5886f7d0c799a4f11b1c9de0de0c354787afb57b4a3f7351d182334ddcd971b37f5fcec3dc262e5810eb24f3014595d9da82d4f9219d
-
SSDEEP
768:fWHoI5XPDHzT8d7tGjOr1IS72G5JBCASbBRUT0h9SGQ889LWrB6SSe7vrQ/HNHy:fW5k7tGU1vljSVGAh9189LWroFe7M/Hc
Malware Config
Extracted
silverrat
1.0.0.0
109.120.138.220:9999
SilverMutex_eFDAYafReG
-
certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
-
decrypted_key
-|S.S.S|-
-
discord
https://discord.com/api/webhooks/1306009594367180840/Zg6W2rH_yPNkl7Hn5Z-GWjtm8W94xN_PzceHo8g5RjjoNr4vkRdq1c70arvb91az-VPT
-
key
yy6zDjAUmbB09pKvo5Hhug==
-
key_x509
QVR3SE5ZVndSU29kUlRqb0RrYVFEenVZQ3pacUJF
-
payload_url
https://g.top4top.io/p_2522c7w8u1.png
-
reconnect_delay
4
-
server_signature
P13mw1TfF17KfEkZosv3hjMem4BUhNlwGffDwrGSq2igVGjYQxFRk0SVVNlVHRYlkc3swZfNYBqBpYDRx3jbbwInZgzia0q+QEZ4c5brroCjtkfRy4vWjZvJKn1b7ftiSN9YCV1cdJQiZFXrqHG/NT5e0cPkdDBDlEi74XDFKURBw0+yR2q3hle0L6fFZmcVpLru7EBCvLTiyok9BBVszRV5HvaDOzO/0GpMRG0FXcCEodHmiGSuwk+UiwJcjo1IzN6dTcfMj9WuP0P+WRoGp2mr1irG1o/M+ad1sKbUNp2miwVDQWzbXqdSs6Cmn5mGlwue8UtI7YQQYHBb53zKbkfR7vnBCzOjyYVC7cHrCVXl3MwXzrbFuQJiwOYs2RcDRnFpNPBDGbznH2q2Hh8sEE8gUr2tFC0z8pAtsS6/0pNWfstDQhSx5qz/1rXya+69qAgHHHcrEjlSWikaQyRe1dsgCAGanksuvMuEaEupkZK4SnjV1L8WEz09uDlsCYVwguYSUslm/gzt8wLfyhy5t1gLhC9nvJ3KbTc3bse66wc+mZ5Gh5a7ehrsCluFwISpl3CcrBwhZ9qIBX9EEI16YBH+/aXqEwfQ9uG0cE85gft9oAf9ezgJmTW3WpPShRRVoKW2ufzM72FQG/GXnWIN4maCNuSVakbZkjzvIMTmGpU=
Signatures
-
Silverrat family
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 3436 attrib.exe 5000 attrib.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation $77helppanel.exe -
Executes dropped EXE 1 IoCs
pid Process 4712 $77helppanel.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\ServiceProfiles\\$77helppanel.exe\"" 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe -
pid Process 4404 powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 20 discord.com 21 discord.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 2720 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1396 schtasks.exe 2008 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 4404 powershell.exe 4404 powershell.exe 4712 $77helppanel.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe Token: SeDebugPrivilege 4712 $77helppanel.exe Token: SeDebugPrivilege 4404 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4712 $77helppanel.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1028 wrote to memory of 3436 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 87 PID 1028 wrote to memory of 3436 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 87 PID 1028 wrote to memory of 5000 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 89 PID 1028 wrote to memory of 5000 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 89 PID 1028 wrote to memory of 2240 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 103 PID 1028 wrote to memory of 2240 1028 753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe 103 PID 2240 wrote to memory of 2720 2240 cmd.exe 105 PID 2240 wrote to memory of 2720 2240 cmd.exe 105 PID 2240 wrote to memory of 4712 2240 cmd.exe 106 PID 2240 wrote to memory of 4712 2240 cmd.exe 106 PID 4712 wrote to memory of 2952 4712 $77helppanel.exe 109 PID 4712 wrote to memory of 2952 4712 $77helppanel.exe 109 PID 4712 wrote to memory of 1396 4712 $77helppanel.exe 111 PID 4712 wrote to memory of 1396 4712 $77helppanel.exe 111 PID 4712 wrote to memory of 1056 4712 $77helppanel.exe 113 PID 4712 wrote to memory of 1056 4712 $77helppanel.exe 113 PID 4712 wrote to memory of 4404 4712 $77helppanel.exe 115 PID 4712 wrote to memory of 4404 4712 $77helppanel.exe 115 PID 4712 wrote to memory of 2008 4712 $77helppanel.exe 116 PID 4712 wrote to memory of 2008 4712 $77helppanel.exe 116 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 3436 attrib.exe 5000 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe"C:\Users\Admin\AppData\Local\Temp\753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ServiceProfiles"2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3436
-
-
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ServiceProfiles\$77helppanel.exe"2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:5000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCC49.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2720
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ServiceProfiles\$77helppanel.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ServiceProfiles\$77helppanel.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /TN $77helppanel.exe4⤵PID:2952
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /SC ONCE /TN "$77helppanel.exe" /TR "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ServiceProfiles\$77helppanel.exe \"\$77helppanel.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
PID:1396
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /TN $77helppanel.exe4⤵PID:1056
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4404
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc daily /tn "helppanel_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:004⤵
- Scheduled Task/Job: Scheduled Task
PID:2008
-
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
200B
MD5ec0d92ab69b9e55ed969a776408de7e9
SHA1858c2811e5369547a9cb4e136dbb2c5de3167d93
SHA256c4fffe9d2a17f440198a89a59d3c1d99e0ff87c666af1abda7eff46894df699a
SHA512ec41ed3c883dc345f8ed91f68cdcf18239f055ff79dc616e4d9cf34b9b5e290fe6e540203b1594d275e104d3d3a0ea79647cd191ab9e3b605136b872ced15e08
-
Filesize
45KB
MD57be4b0b2f700401c020e936fcbb55f52
SHA19fdc76da221ea52120cf79b6491a55a40c019de3
SHA256753dc24d28740f01aef352fdb7e63b77c5c2eabc1acd6ce31f35be16f0ddad7f
SHA51230e2d2d591370a82c20f5886f7d0c799a4f11b1c9de0de0c354787afb57b4a3f7351d182334ddcd971b37f5fcec3dc262e5810eb24f3014595d9da82d4f9219d