Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/11/2024, 22:30
Behavioral task
behavioral1
Sample
SilverClient.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SilverClient.exe
Resource
win10v2004-20241007-en
General
-
Target
SilverClient.exe
-
Size
43KB
-
MD5
79d47169908067917d7b01838e512d4e
-
SHA1
f9e4dbfad432da6bf68b72e60fed8b39b0465fdd
-
SHA256
7be0033e27b08c8e5f43200259ce3bfd1129b653789664c175342fb3fcb9405a
-
SHA512
f72a331379d8d595843b4515d96286871e4cfdc3c866c1cc0a6779a1e6b0b127cd2eea2615ab78f754b1c0fb0c51ed33ee02975945539f532ce597e5f68a875e
-
SSDEEP
768:9uIQbKCHbymqTYV6O1i/MiZHFPsenEsJCSZbYvlGGooooizJjVRUT0v9SFHXhXBu:UIEKCtIO1nGFPsenEFWJjVGAv9OBoY/Y
Malware Config
Extracted
silverrat
1.0.0.0
following-geometry.gl.at.ply.gg:11493
SilverMutex_VEYRwaRvUo
-
certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
-
decrypted_key
-|S.S.S|-
-
key
yy6zDjAUmbB09pKvo5Hhug==
-
key_x509
U0tZRVJueVNXY2NSek1admhOVFlpc0JFcFJHbWVN
-
reconnect_delay
4
-
server_signature
6ye4pxF52YX+bV+EOMA/wWVAc0D/XOR0xgKLnRG8/vP8KVrSyKDJa2vThc3yczy8At3Kp7Mo/wfOVOX2XeIjyJvm3cewwK+/+ZQEfOT2wP4KN2ilxtTamLCTSLS+JudpUi3sY61JfDLjmFM1XQaJBhoOI7DB0UA13bmohsQ56tSzdbZrDUCfgvMGsGxnmcw/7oS+zcH73GH3sLqkZ+iYSNeNX6iy1BJYoD3NgoSflV3780CzCbFutTqV8Zu7H34nTKRzQ99axDzsVn+jjvzz2adi/k69C8f2yhzA8hLwKTf1CLf2zIsGIBM6mrzP7DeDGd2ae7BhYpmkZxPor0AVDdbdJxM4dEosayHnzyBKKCoQDmr2buUXA5b4wymmwioVpTzZD9zt6dwVtwAJXEiG+vo8AvKGsp/pGofXDgoSez2wkayb7XsYqnpaq2eVIS/FBpsIEd2lPAe+OZ1df+zOv5np+ekGE1/0R1NrCrD4a/e81ZtaqmjM3oyEto2/BkzgVXt0m2c+2dk0CAiBhkIFJbQNrb+E3dUcEaGIPeVwSaY8LgliG1SKiRXkjiLcx8s4Dpj3hRxeAvgUmXUxiElCcl0IlnUDbhKYXMRplHtILLJMUyJwvqX+ld3QU/6fzEXtep6rZ+b3rDC7vh/7sVIqkpMRiBGaf0y+nI32ontx+bU=
Signatures
-
Silverrat family
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2300 attrib.exe 1748 attrib.exe -
Executes dropped EXE 1 IoCs
pid Process 2684 $77Ponispro.exe -
Loads dropped DLL 1 IoCs
pid Process 3048 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\system64\\$77Ponispro.exe\"" SilverClient.exe -
pid Process 2536 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 2712 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2720 schtasks.exe 2548 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2860 SilverClient.exe 2860 SilverClient.exe 2684 $77Ponispro.exe 2536 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2860 SilverClient.exe Token: SeDebugPrivilege 2684 $77Ponispro.exe Token: SeDebugPrivilege 2536 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2684 $77Ponispro.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2860 wrote to memory of 2300 2860 SilverClient.exe 28 PID 2860 wrote to memory of 2300 2860 SilverClient.exe 28 PID 2860 wrote to memory of 2300 2860 SilverClient.exe 28 PID 2860 wrote to memory of 1748 2860 SilverClient.exe 30 PID 2860 wrote to memory of 1748 2860 SilverClient.exe 30 PID 2860 wrote to memory of 1748 2860 SilverClient.exe 30 PID 2860 wrote to memory of 3048 2860 SilverClient.exe 34 PID 2860 wrote to memory of 3048 2860 SilverClient.exe 34 PID 2860 wrote to memory of 3048 2860 SilverClient.exe 34 PID 3048 wrote to memory of 2712 3048 cmd.exe 36 PID 3048 wrote to memory of 2712 3048 cmd.exe 36 PID 3048 wrote to memory of 2712 3048 cmd.exe 36 PID 3048 wrote to memory of 2684 3048 cmd.exe 37 PID 3048 wrote to memory of 2684 3048 cmd.exe 37 PID 3048 wrote to memory of 2684 3048 cmd.exe 37 PID 2684 wrote to memory of 2644 2684 $77Ponispro.exe 38 PID 2684 wrote to memory of 2644 2684 $77Ponispro.exe 38 PID 2684 wrote to memory of 2644 2684 $77Ponispro.exe 38 PID 2684 wrote to memory of 2720 2684 $77Ponispro.exe 40 PID 2684 wrote to memory of 2720 2684 $77Ponispro.exe 40 PID 2684 wrote to memory of 2720 2684 $77Ponispro.exe 40 PID 2684 wrote to memory of 2620 2684 $77Ponispro.exe 42 PID 2684 wrote to memory of 2620 2684 $77Ponispro.exe 42 PID 2684 wrote to memory of 2620 2684 $77Ponispro.exe 42 PID 2684 wrote to memory of 2536 2684 $77Ponispro.exe 44 PID 2684 wrote to memory of 2536 2684 $77Ponispro.exe 44 PID 2684 wrote to memory of 2536 2684 $77Ponispro.exe 44 PID 2684 wrote to memory of 2548 2684 $77Ponispro.exe 46 PID 2684 wrote to memory of 2548 2684 $77Ponispro.exe 46 PID 2684 wrote to memory of 2548 2684 $77Ponispro.exe 46 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1748 attrib.exe 2300 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SilverClient.exe"C:\Users\Admin\AppData\Local\Temp\SilverClient.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\system64"2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2300
-
-
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\system64\$77Ponispro.exe"2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1748
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpE051.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2712
-
-
C:\Users\Admin\AppData\Roaming\system64\$77Ponispro.exe"C:\Users\Admin\AppData\Roaming\system64\$77Ponispro.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\system32\schtasks.exe"schtasks.exe" /query /TN $77Ponispro.exe4⤵PID:2644
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /SC ONCE /TN "$77Ponispro.exe" /TR "C:\Users\Admin\AppData\Roaming\system64\$77Ponispro.exe \"\$77Ponispro.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
PID:2720
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /query /TN $77Ponispro.exe4⤵PID:2620
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc hourly /mo 1 /tn "Ponispro_Task-HOURLY-01" /tr "%MyFile%" /st 00:004⤵
- Scheduled Task/Job: Scheduled Task
PID:2548
-
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164B
MD580cf73bd7a058cc04cc6001836e6c6ee
SHA113a05102df1dcbbb5f2b5084a4d8a6e89f644be0
SHA25671b6dd33557fe171da5dd9d6d9bd9d8721ef363e719bcf22e79be09f2b78c2e4
SHA512bf8b0379987e613b1c853f516add0d8076b2630121a92ff48a5869d0893e401a46c85887f6a718ea85538ed119aa1b398e4de436e54587c7e04d5af1983dd22d
-
Filesize
43KB
MD579d47169908067917d7b01838e512d4e
SHA1f9e4dbfad432da6bf68b72e60fed8b39b0465fdd
SHA2567be0033e27b08c8e5f43200259ce3bfd1129b653789664c175342fb3fcb9405a
SHA512f72a331379d8d595843b4515d96286871e4cfdc3c866c1cc0a6779a1e6b0b127cd2eea2615ab78f754b1c0fb0c51ed33ee02975945539f532ce597e5f68a875e