Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
23/02/2025, 15:28
Behavioral task
behavioral1
Sample
SeroXen.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
SeroXen.exe
Resource
win10v2004-20250217-en
General
-
Target
SeroXen.exe
-
Size
44KB
-
MD5
7ec1d25ce5cd0afe104ee2e4389e4cf6
-
SHA1
fa31da5f424f7c106ff0701aab70f789cd4e445b
-
SHA256
fd8f6f8301f87bba9241fd4777c6b25ad9a1b1268c00e8893175074a7392bc6c
-
SHA512
78c196c0aba6afc8426edfe013b889bca62e172d597b39e887dcd14aaa99bdcce8be65d4055722d34328c341b1c4b14107d0b8d5a6ff9e7f0afa5b29326675b1
-
SSDEEP
768:wl4dBTRz9hp3HWVWs9kjmbuapBax6GRUT0Ab9wswz1QB6Su7lvrJ/BB+H:wlkTyluaax/GAk9e1Qol7lV/f+H
Malware Config
Extracted
silverrat
1.0.0.0
172.221.202.55:3321
SeroXen_OiKhOEOQVR
-
certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
-
decrypted_key
-|S.S.S|-
-
discord
https://discord.com/api/webhooks/1342686015311052902/PdErahk1LZkZhFWQDFrDTqA-2xQd7YhQGp43_V5ZuKJ-WS5Qrg7uXCnQmg8l14PxhzHB
-
key
yy6zDjAUmbB09pKvo5Hhug==
-
key_x509
b0FGeVZNcFRMWVloVHR6Z0VESU5RdlpZUmxZbUFE
-
payload_url
https://g.top4top.io/p_2522c7w8u1.png
-
reconnect_delay
4
-
server_signature
t9H0tGywaq23QHywsvniYlva2DUEoHwEX4RZOKw6QYOUUUEs6+qPhkwL0ziJc2nYj2yd5E4o3kMJj8NRpRTkpZcyIg/ljsBjIY4uuTgySYNYShSJRrNgQc/XiUXjH546feRdpS3EuZPWH15iNA3U89kmdXU1BOtms28guz5MUZ/jdeGBHbjPJULpyM8EgGGdK3ajqJ+NWQxPHql47XGQFXqJ5PauE0xmpcMKt+LU7fe+NS0Yx11uv+tRwSlMmFhYU9pSYoS8zZ7Lyeaw8rcxs06oecNxLKcmbSH3H5QWo4qYq/Y7HAeBmLEHHB5t8+bCVeDMfccmct8s+aZpljSceGlri2HJsxEjZ7FYmh4+o8bhacTmqQyE99P1kSa4FAWPLn59j5s1nO91Sb/rMvcNUApgatm6ZRZjc+Ninv7rXwFncnT7eRSRvldp7PohX6bsJEJRMnfLT4YxM0TzqV9POSK0hjrRojbiRQWahccxQRKfg3TcVxNnNjCQWMOJ0YzNuQ0ZSTLPO3QA4v/0cwD5nBhPdhowAnMUb4j61HsPdaQnKXvlx377vbMOowWJFqGC1ES1rKn843GMu81HL7FJsfrpqglmmFTddG3IwkeJU7umxj41+anidgCco7Jzbii9D9e4l2DF3EuhYg+qIuiwNw4ACh3olxSGStXl952V/dY=
Signatures
-
Silverrat family
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1204 attrib.exe 1000 attrib.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation SeroXen.exe Key value queried \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation $77xdwd.dll.exe -
Executes dropped EXE 1 IoCs
pid Process 4752 $77xdwd.dll.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\Windows\\$77xdwd.dll.exe\"" SeroXen.exe -
pid Process 1716 powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 11 discord.com 12 discord.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 3756 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4712 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4308 SeroXen.exe 4308 SeroXen.exe 4308 SeroXen.exe 4308 SeroXen.exe 4308 SeroXen.exe 4308 SeroXen.exe 4308 SeroXen.exe 4308 SeroXen.exe 4308 SeroXen.exe 4308 SeroXen.exe 4308 SeroXen.exe 4308 SeroXen.exe 4308 SeroXen.exe 4308 SeroXen.exe 4308 SeroXen.exe 4308 SeroXen.exe 4308 SeroXen.exe 4308 SeroXen.exe 4308 SeroXen.exe 4308 SeroXen.exe 4308 SeroXen.exe 1716 powershell.exe 1716 powershell.exe 4752 $77xdwd.dll.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4308 SeroXen.exe Token: SeDebugPrivilege 4752 $77xdwd.dll.exe Token: SeDebugPrivilege 1716 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4752 $77xdwd.dll.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4308 wrote to memory of 1204 4308 SeroXen.exe 86 PID 4308 wrote to memory of 1204 4308 SeroXen.exe 86 PID 4308 wrote to memory of 1000 4308 SeroXen.exe 88 PID 4308 wrote to memory of 1000 4308 SeroXen.exe 88 PID 4308 wrote to memory of 2908 4308 SeroXen.exe 93 PID 4308 wrote to memory of 2908 4308 SeroXen.exe 93 PID 2908 wrote to memory of 3756 2908 cmd.exe 95 PID 2908 wrote to memory of 3756 2908 cmd.exe 95 PID 2908 wrote to memory of 4752 2908 cmd.exe 96 PID 2908 wrote to memory of 4752 2908 cmd.exe 96 PID 4752 wrote to memory of 3204 4752 $77xdwd.dll.exe 97 PID 4752 wrote to memory of 3204 4752 $77xdwd.dll.exe 97 PID 4752 wrote to memory of 4712 4752 $77xdwd.dll.exe 99 PID 4752 wrote to memory of 4712 4752 $77xdwd.dll.exe 99 PID 4752 wrote to memory of 3532 4752 $77xdwd.dll.exe 101 PID 4752 wrote to memory of 3532 4752 $77xdwd.dll.exe 101 PID 4752 wrote to memory of 1716 4752 $77xdwd.dll.exe 103 PID 4752 wrote to memory of 1716 4752 $77xdwd.dll.exe 103 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1204 attrib.exe 1000 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SeroXen.exe"C:\Users\Admin\AppData\Local\Temp\SeroXen.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\Windows"2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1204
-
-
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\Windows\$77xdwd.dll.exe"2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCF66.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:3756
-
-
C:\Users\Admin\Windows\$77xdwd.dll.exe"C:\Users\Admin\Windows\$77xdwd.dll.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /TN $77xdwd.dll.exe4⤵PID:3204
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /SC ONCE /TN "$77xdwd.dll.exe" /TR "C:\Users\Admin\Windows\$77xdwd.dll.exe \"\$77xdwd.dll.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
PID:4712
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /TN $77xdwd.dll.exe4⤵PID:3532
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
147B
MD583bd0c81d042aea6b8f046870211fb4f
SHA180a2aac607c3f11c5356ac48f7c8d545d44a1712
SHA2567a8f00c5618b42edcc02039364e3898782e5ba614c55f50c57fd71be3ada0d8a
SHA5124502a8a85b0af726f97084065283e3ebaf5f92d80d934f7698b882dffce2f07d81814b3ab4a6f46e10fd87375bb4a769e68a60c5d787d940f8114c4afa086b0f
-
Filesize
44KB
MD57ec1d25ce5cd0afe104ee2e4389e4cf6
SHA1fa31da5f424f7c106ff0701aab70f789cd4e445b
SHA256fd8f6f8301f87bba9241fd4777c6b25ad9a1b1268c00e8893175074a7392bc6c
SHA51278c196c0aba6afc8426edfe013b889bca62e172d597b39e887dcd14aaa99bdcce8be65d4055722d34328c341b1c4b14107d0b8d5a6ff9e7f0afa5b29326675b1