Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
24/02/2025, 11:38
Behavioral task
behavioral1
Sample
config.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
config.exe
Resource
win10v2004-20250217-en
General
-
Target
config.exe
-
Size
41KB
-
MD5
eec97c1c972c1a4db59f48fe5f590187
-
SHA1
2e8ad75a10cac16b345f8456c6a0411feea316c5
-
SHA256
ede4efe8923397c1a2a876da4b847f78791e76b193ab0f84aa08a91fcc76ccef
-
SHA512
af5c6b9540fdd224cbd1a62051c187198d7413ee237991cbb18339cabb9c79a4c93c44419128c4748cef55fe78454132f05648b4d414900470801b6e42b671a2
-
SSDEEP
768:+j30TK6jslN1gMMmHoAQP+wpPaLxDiFPF7sm3PRUm9Po2bz1QB6St0dDl:+j30TKEsi6Xg+w01idFVfGm95P1Qofdx
Malware Config
Extracted
silverrat
1.0.0.0
lAxDBRhAFu
-
certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
-
decrypted_key
-|S.S.S|-
-
key
yy6zDjAUmbB09pKvo5Hhug==
-
key_x509
b0FGeVZNcFRMWVloVHR6Z0VESU5RdlpZUmxZbUFE
-
reconnect_delay
4
-
server_signature
t9H0tGywaq23QHywsvniYlva2DUEoHwEX4RZOKw6QYOUUUEs6+qPhkwL0ziJc2nYj2yd5E4o3kMJj8NRpRTkpZcyIg/ljsBjIY4uuTgySYNYShSJRrNgQc/XiUXjH546feRdpS3EuZPWH15iNA3U89kmdXU1BOtms28guz5MUZ/jdeGBHbjPJULpyM8EgGGdK3ajqJ+NWQxPHql47XGQFXqJ5PauE0xmpcMKt+LU7fe+NS0Yx11uv+tRwSlMmFhYU9pSYoS8zZ7Lyeaw8rcxs06oecNxLKcmbSH3H5QWo4qYq/Y7HAeBmLEHHB5t8+bCVeDMfccmct8s+aZpljSceGlri2HJsxEjZ7FYmh4+o8bhacTmqQyE99P1kSa4FAWPLn59j5s1nO91Sb/rMvcNUApgatm6ZRZjc+Ninv7rXwFncnT7eRSRvldp7PohX6bsJEJRMnfLT4YxM0TzqV9POSK0hjrRojbiRQWahccxQRKfg3TcVxNnNjCQWMOJ0YzNuQ0ZSTLPO3QA4v/0cwD5nBhPdhowAnMUb4j61HsPdaQnKXvlx377vbMOowWJFqGC1ES1rKn843GMu81HL7FJsfrpqglmmFTddG3IwkeJU7umxj41+anidgCco7Jzbii9D9e4l2DF3EuhYg+qIuiwNw4ACh3olxSGStXl952V/dY=
Signatures
-
Silverrat family
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1992 attrib.exe 2292 attrib.exe -
Executes dropped EXE 1 IoCs
pid Process 2140 OFXsystemSafemode.exe -
Loads dropped DLL 1 IoCs
pid Process 2896 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\systemSafemode\\OFXsystemSafemode.exe\"" config.exe -
pid Process 2872 powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 4 pastebin.com 5 pastebin.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 2828 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3044 schtasks.exe 2696 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1712 config.exe 1712 config.exe 1712 config.exe 2140 OFXsystemSafemode.exe 2872 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1712 config.exe Token: SeDebugPrivilege 2140 OFXsystemSafemode.exe Token: SeDebugPrivilege 2872 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2140 OFXsystemSafemode.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2292 1712 config.exe 31 PID 1712 wrote to memory of 2292 1712 config.exe 31 PID 1712 wrote to memory of 2292 1712 config.exe 31 PID 1712 wrote to memory of 1992 1712 config.exe 33 PID 1712 wrote to memory of 1992 1712 config.exe 33 PID 1712 wrote to memory of 1992 1712 config.exe 33 PID 1712 wrote to memory of 2896 1712 config.exe 35 PID 1712 wrote to memory of 2896 1712 config.exe 35 PID 1712 wrote to memory of 2896 1712 config.exe 35 PID 2896 wrote to memory of 2828 2896 cmd.exe 37 PID 2896 wrote to memory of 2828 2896 cmd.exe 37 PID 2896 wrote to memory of 2828 2896 cmd.exe 37 PID 2896 wrote to memory of 2140 2896 cmd.exe 38 PID 2896 wrote to memory of 2140 2896 cmd.exe 38 PID 2896 wrote to memory of 2140 2896 cmd.exe 38 PID 2140 wrote to memory of 2792 2140 OFXsystemSafemode.exe 39 PID 2140 wrote to memory of 2792 2140 OFXsystemSafemode.exe 39 PID 2140 wrote to memory of 2792 2140 OFXsystemSafemode.exe 39 PID 2140 wrote to memory of 3044 2140 OFXsystemSafemode.exe 41 PID 2140 wrote to memory of 3044 2140 OFXsystemSafemode.exe 41 PID 2140 wrote to memory of 3044 2140 OFXsystemSafemode.exe 41 PID 2140 wrote to memory of 2472 2140 OFXsystemSafemode.exe 43 PID 2140 wrote to memory of 2472 2140 OFXsystemSafemode.exe 43 PID 2140 wrote to memory of 2472 2140 OFXsystemSafemode.exe 43 PID 2140 wrote to memory of 2872 2140 OFXsystemSafemode.exe 45 PID 2140 wrote to memory of 2872 2140 OFXsystemSafemode.exe 45 PID 2140 wrote to memory of 2872 2140 OFXsystemSafemode.exe 45 PID 2140 wrote to memory of 2696 2140 OFXsystemSafemode.exe 47 PID 2140 wrote to memory of 2696 2140 OFXsystemSafemode.exe 47 PID 2140 wrote to memory of 2696 2140 OFXsystemSafemode.exe 47 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1992 attrib.exe 2292 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\config.exe"C:\Users\Admin\AppData\Local\Temp\config.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\systemSafemode"2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2292
-
-
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\systemSafemode\OFXsystemSafemode.exe"2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1992
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1BCA.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2828
-
-
C:\Users\Admin\systemSafemode\OFXsystemSafemode.exe"C:\Users\Admin\systemSafemode\OFXsystemSafemode.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\system32\schtasks.exe"schtasks.exe" /query /TN OFXsystemSafemode.exe4⤵PID:2792
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /SC ONCE /TN "OFXsystemSafemode.exe" /TR "C:\Users\Admin\systemSafemode\OFXsystemSafemode.exe \"\OFXsystemSafemode.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
PID:3044
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /query /TN OFXsystemSafemode.exe4⤵PID:2472
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc daily /tn "OFXsystemSafemode_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:004⤵
- Scheduled Task/Job: Scheduled Task
PID:2696
-
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160B
MD5cb732028d7ac1d3ba5697ffdc211de97
SHA136f07471c08451fb3cac98e98c3ad47d2c41ec6f
SHA2569d0e19b7a14f51f437fc18d1378006cb2352f851476e8f59fdcda969dd2c954d
SHA512429c3b9dfc1796c5b6916d04b56eaf18a30f370f7eb1f9dcb1494d591e5b505d63739626c9be8f86056caf8157863ca904fcf1c3a692dfefecdd270271f0038f
-
Filesize
41KB
MD5eec97c1c972c1a4db59f48fe5f590187
SHA12e8ad75a10cac16b345f8456c6a0411feea316c5
SHA256ede4efe8923397c1a2a876da4b847f78791e76b193ab0f84aa08a91fcc76ccef
SHA512af5c6b9540fdd224cbd1a62051c187198d7413ee237991cbb18339cabb9c79a4c93c44419128c4748cef55fe78454132f05648b4d414900470801b6e42b671a2