Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/12/2024, 16:08
Behavioral task
behavioral1
Sample
SilverRat.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SilverRat.exe
Resource
win10v2004-20241007-en
General
-
Target
SilverRat.exe
-
Size
45KB
-
MD5
545d64cc91e4da6339a70d54a2443c5d
-
SHA1
f03344ab824c7cf0f73dcc86aa34cab36e2e54e7
-
SHA256
04109cb3426408945bea79e8e355285fb5bf93224b5b2775a5f6ff6c1e992b5f
-
SHA512
733154a7f76840fad3ead2af149cf708807878ef3f08c62232ee3cdc0b7e6a4b4dc338103569daf9f755a6549475df15b34b7f223929348001d4086e83371681
-
SSDEEP
768:OarX4D9pmZGOXnXhEk75rVeZtxbuRULQj9SEQf9B6SbuDFvr1/xf:OarID9pVU5rVe3xCGsj9O9oQ2Fx/xf
Malware Config
Extracted
silverrat
1.0.0.0
auto-london.gl.at.ply.gg:51655
SilverMutex_kTAAZjMenK
-
certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
-
decrypted_key
-|S.S.S|-
-
discord
https://discord.com/api/webhooks/1253749007772160090/mxExcAUGlJgTCbYOk_u7JJAnNpsIhMne5e0PjqkRY2MV_40Bgpix2Ezib84aFxRmN66j
-
key
yy6zDjAUmbB09pKvo5Hhug==
-
key_x509
QnZ2VW1rTFlUa09ESXhCRkdHYURSSlBBdk5SQk5J
-
payload_url
https://g.top4top.io/p_2522c7w8u1.png
-
reconnect_delay
0
-
server_signature
RMCh38rJRIwRMYf2Sbpd9BzSePeTpscme+fLNDX9Bf6O5IR+EWvJS971m1lprJ/vpdLYQPZIImuX69267sqtVY2b3yH1lw7e7EZaXIHsGFR2uyeUjLQeAjD47DWaaKkGg8wKKEQ7AX8lBa1tYmqDorMfwQ9K2xlGjrxnS9ZotbBaz/KmFDUSwnUEWc6K5tKdqXQ5scv4Iejt9hGqjIxCo1c3AyRwr1eezKhGK66t4Y1aPVfqkIwuI23vWEPPjJYRDn5dWq5EykrPUBvH+OORD9xrQmM63F/gLb5d5/LlrOqSfkd5/yTv8YROpQfzMAYH5k10o6P4I+oBlGpJ9MwzL5Y4JBHSJyiG/m9XuEYKxe1zgffuIhU/xo30i0YC/hkKd5U8BP5k6PdZg9OLI+a8k7sa4/Sk/9Zkjx27VuOZdZs8IMP9t8mumexIqz2fvkwSO79gNHehbK8Y1feAFrlzCMoxK06XKuMRCyGOPse3sNm57TPHUBbk5yhteOGujQ9402QViU3tL9ZQR4rN71H4CBlNHaHbc0PO4+WhgxaAkr3W2/OOCyoaGrX1Kv18VFwwqB9Gqj0wG0MsA+femZUx/+SY41jQ715JwPCrD4aNkKu7xrjYnii+JjVsgNqaLVOhWv1VjL3qkCJ9kf0c7ob8qNOXaePlpZmHsWg/fgChnAk=
Signatures
-
Silverrat family
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1232 attrib.exe 4292 attrib.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation $77Runtime Broker.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SilverRat.exe -
Executes dropped EXE 1 IoCs
pid Process 1252 $77Runtime Broker.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\hgfdfd\\$77Runtime Broker.exe\"" SilverRat.exe -
pid Process 2528 powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 22 discord.com 24 discord.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 3356 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2672 schtasks.exe 2232 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 736 SilverRat.exe 736 SilverRat.exe 736 SilverRat.exe 736 SilverRat.exe 736 SilverRat.exe 736 SilverRat.exe 736 SilverRat.exe 736 SilverRat.exe 736 SilverRat.exe 736 SilverRat.exe 736 SilverRat.exe 736 SilverRat.exe 736 SilverRat.exe 736 SilverRat.exe 736 SilverRat.exe 736 SilverRat.exe 736 SilverRat.exe 736 SilverRat.exe 736 SilverRat.exe 736 SilverRat.exe 736 SilverRat.exe 736 SilverRat.exe 736 SilverRat.exe 2528 powershell.exe 2528 powershell.exe 1252 $77Runtime Broker.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeBackupPrivilege 1944 vssvc.exe Token: SeRestorePrivilege 1944 vssvc.exe Token: SeAuditPrivilege 1944 vssvc.exe Token: SeDebugPrivilege 736 SilverRat.exe Token: SeDebugPrivilege 1252 $77Runtime Broker.exe Token: SeDebugPrivilege 2528 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1252 $77Runtime Broker.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 736 wrote to memory of 1232 736 SilverRat.exe 86 PID 736 wrote to memory of 1232 736 SilverRat.exe 86 PID 736 wrote to memory of 4292 736 SilverRat.exe 88 PID 736 wrote to memory of 4292 736 SilverRat.exe 88 PID 736 wrote to memory of 5044 736 SilverRat.exe 94 PID 736 wrote to memory of 5044 736 SilverRat.exe 94 PID 5044 wrote to memory of 3356 5044 cmd.exe 96 PID 5044 wrote to memory of 3356 5044 cmd.exe 96 PID 5044 wrote to memory of 1252 5044 cmd.exe 99 PID 5044 wrote to memory of 1252 5044 cmd.exe 99 PID 1252 wrote to memory of 3180 1252 $77Runtime Broker.exe 101 PID 1252 wrote to memory of 3180 1252 $77Runtime Broker.exe 101 PID 1252 wrote to memory of 2232 1252 $77Runtime Broker.exe 103 PID 1252 wrote to memory of 2232 1252 $77Runtime Broker.exe 103 PID 1252 wrote to memory of 2116 1252 $77Runtime Broker.exe 105 PID 1252 wrote to memory of 2116 1252 $77Runtime Broker.exe 105 PID 1252 wrote to memory of 2528 1252 $77Runtime Broker.exe 107 PID 1252 wrote to memory of 2528 1252 $77Runtime Broker.exe 107 PID 1252 wrote to memory of 2672 1252 $77Runtime Broker.exe 108 PID 1252 wrote to memory of 2672 1252 $77Runtime Broker.exe 108 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1232 attrib.exe 4292 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SilverRat.exe"C:\Users\Admin\AppData\Local\Temp\SilverRat.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\hgfdfd"2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1232
-
-
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\hgfdfd\$77Runtime Broker.exe"2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4292
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC43A.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:3356
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\hgfdfd\$77Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\hgfdfd\$77Runtime Broker.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /TN $77Runtime Broker.exe4⤵PID:3180
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /SC ONCE /TN "$77Runtime Broker.exe" /TR "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\hgfdfd\$77Runtime Broker.exe \"\$77Runtime Broker.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
PID:2232
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /TN $77Runtime Broker.exe4⤵PID:2116
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc hourly /mo 1 /tn "Runtime Broker_Task-HOURLY-01" /tr "%MyFile%" /st 00:004⤵
- Scheduled Task/Job: Scheduled Task
PID:2672
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1944
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
196B
MD50c92b4553397390e137094bcb1abdbbe
SHA189d34dad91ff2f5e76a710ed68f0cd2b7385bd8c
SHA256a65cd999ebf9b1788bc7fd91fd21bd9e587ee799acecfb2aa543deff825967d1
SHA51210fa487a45389fa248f9d68d26c3294d7164d26a9fe997708c693424f66a7d7732db6a7d6aa79943a05566bb78b2a56574a61c1d7c5635d4a372b37e43c7cc50
-
Filesize
45KB
MD5545d64cc91e4da6339a70d54a2443c5d
SHA1f03344ab824c7cf0f73dcc86aa34cab36e2e54e7
SHA25604109cb3426408945bea79e8e355285fb5bf93224b5b2775a5f6ff6c1e992b5f
SHA512733154a7f76840fad3ead2af149cf708807878ef3f08c62232ee3cdc0b7e6a4b4dc338103569daf9f755a6549475df15b34b7f223929348001d4086e83371681