Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2024, 22:30

General

  • Target

    SilverClient.exe

  • Size

    43KB

  • MD5

    79d47169908067917d7b01838e512d4e

  • SHA1

    f9e4dbfad432da6bf68b72e60fed8b39b0465fdd

  • SHA256

    7be0033e27b08c8e5f43200259ce3bfd1129b653789664c175342fb3fcb9405a

  • SHA512

    f72a331379d8d595843b4515d96286871e4cfdc3c866c1cc0a6779a1e6b0b127cd2eea2615ab78f754b1c0fb0c51ed33ee02975945539f532ce597e5f68a875e

  • SSDEEP

    768:9uIQbKCHbymqTYV6O1i/MiZHFPsenEsJCSZbYvlGGooooizJjVRUT0v9SFHXhXBu:UIEKCtIO1nGFPsenEFWJjVGAv9OBoY/Y

Malware Config

Extracted

Family

silverrat

Version

1.0.0.0

C2

following-geometry.gl.at.ply.gg:11493

Mutex

SilverMutex_VEYRwaRvUo

Attributes
  • certificate

    MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==

  • decrypted_key

    -|S.S.S|-

  • key

    yy6zDjAUmbB09pKvo5Hhug==

  • key_x509

    U0tZRVJueVNXY2NSek1admhOVFlpc0JFcFJHbWVN

  • reconnect_delay

    4

  • server_signature

    6ye4pxF52YX+bV+EOMA/wWVAc0D/XOR0xgKLnRG8/vP8KVrSyKDJa2vThc3yczy8At3Kp7Mo/wfOVOX2XeIjyJvm3cewwK+/+ZQEfOT2wP4KN2ilxtTamLCTSLS+JudpUi3sY61JfDLjmFM1XQaJBhoOI7DB0UA13bmohsQ56tSzdbZrDUCfgvMGsGxnmcw/7oS+zcH73GH3sLqkZ+iYSNeNX6iy1BJYoD3NgoSflV3780CzCbFutTqV8Zu7H34nTKRzQ99axDzsVn+jjvzz2adi/k69C8f2yhzA8hLwKTf1CLf2zIsGIBM6mrzP7DeDGd2ae7BhYpmkZxPor0AVDdbdJxM4dEosayHnzyBKKCoQDmr2buUXA5b4wymmwioVpTzZD9zt6dwVtwAJXEiG+vo8AvKGsp/pGofXDgoSez2wkayb7XsYqnpaq2eVIS/FBpsIEd2lPAe+OZ1df+zOv5np+ekGE1/0R1NrCrD4a/e81ZtaqmjM3oyEto2/BkzgVXt0m2c+2dk0CAiBhkIFJbQNrb+E3dUcEaGIPeVwSaY8LgliG1SKiRXkjiLcx8s4Dpj3hRxeAvgUmXUxiElCcl0IlnUDbhKYXMRplHtILLJMUyJwvqX+ld3QU/6fzEXtep6rZ+b3rDC7vh/7sVIqkpMRiBGaf0y+nI32ontx+bU=

Signatures

  • SilverRat

    SilverRat is trojan written in C#.

  • Silverrat family
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SilverClient.exe
    "C:\Users\Admin\AppData\Local\Temp\SilverClient.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Windows\System32\attrib.exe
      "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\system64"
      2⤵
      • Sets file to hidden
      • Views/modifies file attributes
      PID:2300
    • C:\Windows\System32\attrib.exe
      "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\system64\$77Ponispro.exe"
      2⤵
      • Sets file to hidden
      • Views/modifies file attributes
      PID:1748
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpE051.tmp.bat""
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3048
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:2712
      • C:\Users\Admin\AppData\Roaming\system64\$77Ponispro.exe
        "C:\Users\Admin\AppData\Roaming\system64\$77Ponispro.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2684
        • C:\Windows\system32\schtasks.exe
          "schtasks.exe" /query /TN $77Ponispro.exe
          4⤵
            PID:2644
          • C:\Windows\system32\schtasks.exe
            "schtasks.exe" /Create /SC ONCE /TN "$77Ponispro.exe" /TR "C:\Users\Admin\AppData\Roaming\system64\$77Ponispro.exe \"\$77Ponispro.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2720
          • C:\Windows\system32\schtasks.exe
            "schtasks.exe" /query /TN $77Ponispro.exe
            4⤵
              PID:2620
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2536
            • C:\Windows\System32\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /create /sc hourly /mo 1 /tn "Ponispro_Task-HOURLY-01" /tr "%MyFile%" /st 00:00
              4⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2548

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmpE051.tmp.bat

        Filesize

        164B

        MD5

        80cf73bd7a058cc04cc6001836e6c6ee

        SHA1

        13a05102df1dcbbb5f2b5084a4d8a6e89f644be0

        SHA256

        71b6dd33557fe171da5dd9d6d9bd9d8721ef363e719bcf22e79be09f2b78c2e4

        SHA512

        bf8b0379987e613b1c853f516add0d8076b2630121a92ff48a5869d0893e401a46c85887f6a718ea85538ed119aa1b398e4de436e54587c7e04d5af1983dd22d

      • \Users\Admin\AppData\Roaming\system64\$77Ponispro.exe

        Filesize

        43KB

        MD5

        79d47169908067917d7b01838e512d4e

        SHA1

        f9e4dbfad432da6bf68b72e60fed8b39b0465fdd

        SHA256

        7be0033e27b08c8e5f43200259ce3bfd1129b653789664c175342fb3fcb9405a

        SHA512

        f72a331379d8d595843b4515d96286871e4cfdc3c866c1cc0a6779a1e6b0b127cd2eea2615ab78f754b1c0fb0c51ed33ee02975945539f532ce597e5f68a875e

      • memory/2536-24-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

        Filesize

        2.9MB

      • memory/2536-25-0x0000000002870000-0x0000000002878000-memory.dmp

        Filesize

        32KB

      • memory/2684-19-0x000000013FC00000-0x000000013FC10000-memory.dmp

        Filesize

        64KB

      • memory/2860-0-0x000007FEF56D3000-0x000007FEF56D4000-memory.dmp

        Filesize

        4KB

      • memory/2860-1-0x000000013FD60000-0x000000013FD70000-memory.dmp

        Filesize

        64KB

      • memory/2860-2-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

        Filesize

        9.9MB

      • memory/2860-3-0x000007FEF56D3000-0x000007FEF56D4000-memory.dmp

        Filesize

        4KB

      • memory/2860-4-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

        Filesize

        9.9MB

      • memory/2860-14-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

        Filesize

        9.9MB