Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
23/02/2025, 17:06
Behavioral task
behavioral1
Sample
SeroXenBoost.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SeroXenBoost.exe
Resource
win10v2004-20250217-en
General
-
Target
SeroXenBoost.exe
-
Size
44KB
-
MD5
8005773f97e8f5c44e2f12eab0141cc5
-
SHA1
c751dde5b44d985eebaeb9dc027867a9049d4d07
-
SHA256
0902f1d84a1c4ae0bd2c0dbb029240487332655a0d7ea5106013b7a2590b519b
-
SHA512
2e6b9cff1f281e4a3ce14c879349caf1794b465de48af9bd9e6fee28c75119546872a948b381d248ad46baae6b52a046a9df7ec865fb24df77cd05d9a2639e05
-
SSDEEP
768:9V2VRlzVhpvH2VNZZKkVnnn9tF6WRUT0dT9ws+be/1B6SNSlvrz/BB+l:9VGmfHtFBGAZ9gW1omSlH/f+l
Malware Config
Extracted
silverrat
1.0.0.0
172.221.202.55:4421
SilverMutex_dQhpoXJDyX
-
certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
-
decrypted_key
-|S.S.S|-
-
discord
https://discord.com/api/webhooks/1343008288949669961/TCucLQwwnBXuvu4Z6dJ60IcurXSQYorW9CafoG4F4z55ALbW4u2zJa__1PNCU81Kuh4g
-
key
yy6zDjAUmbB09pKvo5Hhug==
-
key_x509
UnJEUnNyTmxjY1FPVFJaUlNYaVl4VWxWREpmS0xj
-
payload_url
https://g.top4top.io/p_2522c7w8u1.png
-
reconnect_delay
4
-
server_signature
hUjI9BXw1YK1HLOSZwyUPLac+uyqxzMnoFlcvRmPjkUek1J1SQhyBv+Qln0vYJNkumI5Syoffxowg+Y7te+u+fNE9A2ASLoNO9zTGmLhkJVIDGuLRDyflwsZbrUsE3fbJ1heVmaXz/716OkGcBnojvADZLg7YKvwUxMZv3u2PkoNZGYTwZHNmgh979EmlKLg4Zc5W32srvWyjSvR48cixZ/2ySicpga4UhSNib7Mxwbk0dDMV8JauE5cf+ZNFhf2LzlUhL4VwU8vKg04wsndcUylrx89+7p/sD/Ea4BcTz44LRRd5Uw+aYjl9qYdZWLW2yq4gCgVWvCPOwNqNi8KV4Wt38Y0jndnyWJNxK7A7/kYsuMIT0Kq2WileN1wuXR3dnBSldVFoNt7ZfPqYa+VGK9kOg8drtF4AzkipOIazCj4Cl82FJ/ePtCSPzExNvUZcH7g/MzLSxyhURind2e33m5wH8PD4Flbmle/yOyipGrtadwKaGhLZjPyUjnOh5gyoHeM6dTEkWwSfz04N9jFUgRYgVQaXAh7w9SSPx0kHphtjZC85+/8h7mOz4Ed9vPN8aWFtR1pi40EaFfP74HPuHLaQC4hAvmYuet2MiJGsMop5DP/qF58u6YMfLgWjYog9eXZiL1uwg0u8Psa+WZwWrnpmIna6ZGkw8RbeD4RH3I=
Signatures
-
Silverrat family
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 4008 attrib.exe 2444 attrib.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation SeroXenBoost.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation $77xdwd.dll.exe -
Executes dropped EXE 1 IoCs
pid Process 2012 $77xdwd.dll.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\$77xdwd.dll.exe\"" SeroXenBoost.exe -
pid Process 2896 powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 16 discord.com 17 discord.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 2220 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2672 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 4812 SeroXenBoost.exe 2896 powershell.exe 2896 powershell.exe 2012 $77xdwd.dll.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4812 SeroXenBoost.exe Token: SeDebugPrivilege 2012 $77xdwd.dll.exe Token: SeDebugPrivilege 2896 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2012 $77xdwd.dll.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4812 wrote to memory of 4008 4812 SeroXenBoost.exe 86 PID 4812 wrote to memory of 4008 4812 SeroXenBoost.exe 86 PID 4812 wrote to memory of 2444 4812 SeroXenBoost.exe 88 PID 4812 wrote to memory of 2444 4812 SeroXenBoost.exe 88 PID 4812 wrote to memory of 2476 4812 SeroXenBoost.exe 92 PID 4812 wrote to memory of 2476 4812 SeroXenBoost.exe 92 PID 2476 wrote to memory of 2220 2476 cmd.exe 94 PID 2476 wrote to memory of 2220 2476 cmd.exe 94 PID 2476 wrote to memory of 2012 2476 cmd.exe 95 PID 2476 wrote to memory of 2012 2476 cmd.exe 95 PID 2012 wrote to memory of 4048 2012 $77xdwd.dll.exe 96 PID 2012 wrote to memory of 4048 2012 $77xdwd.dll.exe 96 PID 2012 wrote to memory of 2672 2012 $77xdwd.dll.exe 98 PID 2012 wrote to memory of 2672 2012 $77xdwd.dll.exe 98 PID 2012 wrote to memory of 4660 2012 $77xdwd.dll.exe 100 PID 2012 wrote to memory of 4660 2012 $77xdwd.dll.exe 100 PID 2012 wrote to memory of 2896 2012 $77xdwd.dll.exe 102 PID 2012 wrote to memory of 2896 2012 $77xdwd.dll.exe 102 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 4008 attrib.exe 2444 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SeroXenBoost.exe"C:\Users\Admin\AppData\Local\Temp\SeroXenBoost.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Windows"2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4008
-
-
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Windows\$77xdwd.dll.exe"2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2444
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1E31.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2220
-
-
C:\Users\Admin\AppData\Roaming\Windows\$77xdwd.dll.exe"C:\Users\Admin\AppData\Roaming\Windows\$77xdwd.dll.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /TN $77xdwd.dll.exe4⤵PID:4048
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /SC ONCE /TN "$77xdwd.dll.exe" /TR "C:\Users\Admin\AppData\Roaming\Windows\$77xdwd.dll.exe \"\$77xdwd.dll.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
PID:2672
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /TN $77xdwd.dll.exe4⤵PID:4660
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
163B
MD584d20c14b4494dda93c15d0387efefd0
SHA18442b724a2ac1a6cb904d14467ddf010b5951047
SHA256e85a52d5c8907e866764a5b1d2e007007bb4a1f1e4b73174e6db22c67978ac08
SHA5121450558f8fb1defdfefc025f0657b0c7f486e387ad1ef016be036994951f24cca2d6e268eeb3ecc567bfce83ef356955a23bc736f8a2eb6237889c3dd9bcf992
-
Filesize
44KB
MD58005773f97e8f5c44e2f12eab0141cc5
SHA1c751dde5b44d985eebaeb9dc027867a9049d4d07
SHA2560902f1d84a1c4ae0bd2c0dbb029240487332655a0d7ea5106013b7a2590b519b
SHA5122e6b9cff1f281e4a3ce14c879349caf1794b465de48af9bd9e6fee28c75119546872a948b381d248ad46baae6b52a046a9df7ec865fb24df77cd05d9a2639e05