Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
23s -
max time network
20s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
24/02/2025, 11:38
Behavioral task
behavioral1
Sample
config.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
config.exe
Resource
win10v2004-20250217-en
General
-
Target
config.exe
-
Size
41KB
-
MD5
eec97c1c972c1a4db59f48fe5f590187
-
SHA1
2e8ad75a10cac16b345f8456c6a0411feea316c5
-
SHA256
ede4efe8923397c1a2a876da4b847f78791e76b193ab0f84aa08a91fcc76ccef
-
SHA512
af5c6b9540fdd224cbd1a62051c187198d7413ee237991cbb18339cabb9c79a4c93c44419128c4748cef55fe78454132f05648b4d414900470801b6e42b671a2
-
SSDEEP
768:+j30TK6jslN1gMMmHoAQP+wpPaLxDiFPF7sm3PRUm9Po2bz1QB6St0dDl:+j30TKEsi6Xg+w01idFVfGm95P1Qofdx
Malware Config
Extracted
silverrat
1.0.0.0
lAxDBRhAFu
-
certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
-
decrypted_key
-|S.S.S|-
-
key
yy6zDjAUmbB09pKvo5Hhug==
-
key_x509
b0FGeVZNcFRMWVloVHR6Z0VESU5RdlpZUmxZbUFE
-
reconnect_delay
4
-
server_signature
t9H0tGywaq23QHywsvniYlva2DUEoHwEX4RZOKw6QYOUUUEs6+qPhkwL0ziJc2nYj2yd5E4o3kMJj8NRpRTkpZcyIg/ljsBjIY4uuTgySYNYShSJRrNgQc/XiUXjH546feRdpS3EuZPWH15iNA3U89kmdXU1BOtms28guz5MUZ/jdeGBHbjPJULpyM8EgGGdK3ajqJ+NWQxPHql47XGQFXqJ5PauE0xmpcMKt+LU7fe+NS0Yx11uv+tRwSlMmFhYU9pSYoS8zZ7Lyeaw8rcxs06oecNxLKcmbSH3H5QWo4qYq/Y7HAeBmLEHHB5t8+bCVeDMfccmct8s+aZpljSceGlri2HJsxEjZ7FYmh4+o8bhacTmqQyE99P1kSa4FAWPLn59j5s1nO91Sb/rMvcNUApgatm6ZRZjc+Ninv7rXwFncnT7eRSRvldp7PohX6bsJEJRMnfLT4YxM0TzqV9POSK0hjrRojbiRQWahccxQRKfg3TcVxNnNjCQWMOJ0YzNuQ0ZSTLPO3QA4v/0cwD5nBhPdhowAnMUb4j61HsPdaQnKXvlx377vbMOowWJFqGC1ES1rKn843GMu81HL7FJsfrpqglmmFTddG3IwkeJU7umxj41+anidgCco7Jzbii9D9e4l2DF3EuhYg+qIuiwNw4ACh3olxSGStXl952V/dY=
Signatures
-
Silverrat family
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 3624 attrib.exe 4360 attrib.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation config.exe Key value queried \REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation OFXsystemSafemode.exe -
Executes dropped EXE 1 IoCs
pid Process 5080 OFXsystemSafemode.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\systemSafemode\\OFXsystemSafemode.exe\"" config.exe -
pid Process 468 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 440 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2860 schtasks.exe 1044 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 1344 config.exe 1344 config.exe 1344 config.exe 1344 config.exe 1344 config.exe 1344 config.exe 1344 config.exe 1344 config.exe 1344 config.exe 1344 config.exe 1344 config.exe 1344 config.exe 1344 config.exe 1344 config.exe 1344 config.exe 1344 config.exe 1344 config.exe 1344 config.exe 1344 config.exe 1344 config.exe 1344 config.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1344 config.exe Token: SeDebugPrivilege 5080 OFXsystemSafemode.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1344 wrote to memory of 3624 1344 config.exe 85 PID 1344 wrote to memory of 3624 1344 config.exe 85 PID 1344 wrote to memory of 4360 1344 config.exe 87 PID 1344 wrote to memory of 4360 1344 config.exe 87 PID 1344 wrote to memory of 3912 1344 config.exe 94 PID 1344 wrote to memory of 3912 1344 config.exe 94 PID 3912 wrote to memory of 440 3912 cmd.exe 96 PID 3912 wrote to memory of 440 3912 cmd.exe 96 PID 3912 wrote to memory of 5080 3912 cmd.exe 97 PID 3912 wrote to memory of 5080 3912 cmd.exe 97 PID 5080 wrote to memory of 344 5080 OFXsystemSafemode.exe 98 PID 5080 wrote to memory of 344 5080 OFXsystemSafemode.exe 98 PID 5080 wrote to memory of 2860 5080 OFXsystemSafemode.exe 100 PID 5080 wrote to memory of 2860 5080 OFXsystemSafemode.exe 100 PID 5080 wrote to memory of 4852 5080 OFXsystemSafemode.exe 102 PID 5080 wrote to memory of 4852 5080 OFXsystemSafemode.exe 102 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 3624 attrib.exe 4360 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\config.exe"C:\Users\Admin\AppData\Local\Temp\config.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\systemSafemode"2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3624
-
-
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\systemSafemode\OFXsystemSafemode.exe"2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4360
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF54D.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:440
-
-
C:\Users\Admin\systemSafemode\OFXsystemSafemode.exe"C:\Users\Admin\systemSafemode\OFXsystemSafemode.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /TN OFXsystemSafemode.exe4⤵PID:344
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /SC ONCE /TN "OFXsystemSafemode.exe" /TR "C:\Users\Admin\systemSafemode\OFXsystemSafemode.exe \"\OFXsystemSafemode.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
PID:2860
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /TN OFXsystemSafemode.exe4⤵PID:4852
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit4⤵
- Command and Scripting Interpreter: PowerShell
PID:468
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc daily /tn "OFXsystemSafemode_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:004⤵
- Scheduled Task/Job: Scheduled Task
PID:1044
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1700
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
160B
MD577298aff63be4c620ceed47f7187405b
SHA1f98f76a747f85a0b23c0c2221283cd1a3f15351e
SHA25623f602a311009e911fb45687866e8bfc278606e99dfaa56bd76252b3e1c5bc30
SHA51239c380fcbab57f34897a231900b706e85b24bca7ac20db6888f7851de062f67872ed1b81148eaac7f25d3f89665775630521fb6471750abf33a67636b814b287
-
Filesize
41KB
MD5eec97c1c972c1a4db59f48fe5f590187
SHA12e8ad75a10cac16b345f8456c6a0411feea316c5
SHA256ede4efe8923397c1a2a876da4b847f78791e76b193ab0f84aa08a91fcc76ccef
SHA512af5c6b9540fdd224cbd1a62051c187198d7413ee237991cbb18339cabb9c79a4c93c44419128c4748cef55fe78454132f05648b4d414900470801b6e42b671a2