Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/02/2025, 16:06
Behavioral task
behavioral1
Sample
System.Runtime.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
System.Runtime.exe
Resource
win10v2004-20250217-en
General
-
Target
System.Runtime.exe
-
Size
43KB
-
MD5
8f06957fd43a38298aa9d6f4bc52c7a7
-
SHA1
01a72c623c0ce786e01fbc3c165bb1c099a2dc1a
-
SHA256
afe42ee135f9bbcc385db5751b4867e99aa4caa862bcaaf312e4355a5323145d
-
SHA512
4b0283befc959340041cfb8c03caccfe3f32971434f34f85c80eba9921bd6e26e664287ec7826492f2047309bfc86e472aa8cb740008df6cf7b61ac94a54484e
-
SSDEEP
768:ExhcfSe88qd/Ol6IoZmhPH5m7vavCJ8eEP+RULQD9PuGsz1QB6Sc/lE:ExhcfSes6tjBm5ZK+GsD9vg1Qo7/lE
Malware Config
Extracted
silverrat
1.0.0.0
if-eventually.gl.at.ply.gg:17094
lAxDBRhAFu
-
certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
-
decrypted_key
-|S.S.S|-
-
key
yy6zDjAUmbB09pKvo5Hhug==
-
key_x509
b0FGeVZNcFRMWVloVHR6Z0VESU5RdlpZUmxZbUFE
-
reconnect_delay
4
-
server_signature
t9H0tGywaq23QHywsvniYlva2DUEoHwEX4RZOKw6QYOUUUEs6+qPhkwL0ziJc2nYj2yd5E4o3kMJj8NRpRTkpZcyIg/ljsBjIY4uuTgySYNYShSJRrNgQc/XiUXjH546feRdpS3EuZPWH15iNA3U89kmdXU1BOtms28guz5MUZ/jdeGBHbjPJULpyM8EgGGdK3ajqJ+NWQxPHql47XGQFXqJ5PauE0xmpcMKt+LU7fe+NS0Yx11uv+tRwSlMmFhYU9pSYoS8zZ7Lyeaw8rcxs06oecNxLKcmbSH3H5QWo4qYq/Y7HAeBmLEHHB5t8+bCVeDMfccmct8s+aZpljSceGlri2HJsxEjZ7FYmh4+o8bhacTmqQyE99P1kSa4FAWPLn59j5s1nO91Sb/rMvcNUApgatm6ZRZjc+Ninv7rXwFncnT7eRSRvldp7PohX6bsJEJRMnfLT4YxM0TzqV9POSK0hjrRojbiRQWahccxQRKfg3TcVxNnNjCQWMOJ0YzNuQ0ZSTLPO3QA4v/0cwD5nBhPdhowAnMUb4j61HsPdaQnKXvlx377vbMOowWJFqGC1ES1rKn843GMu81HL7FJsfrpqglmmFTddG3IwkeJU7umxj41+anidgCco7Jzbii9D9e4l2DF3EuhYg+qIuiwNw4ACh3olxSGStXl952V/dY=
Signatures
-
Silverrat family
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2272 attrib.exe 1700 attrib.exe -
Executes dropped EXE 1 IoCs
pid Process 1792 $77Runtime Broker.exe -
Loads dropped DLL 1 IoCs
pid Process 1084 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\WinTask\\$77Runtime Broker.exe\"" System.Runtime.exe -
pid Process 2404 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 1832 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2136 schtasks.exe 1148 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1952 System.Runtime.exe 1952 System.Runtime.exe 1952 System.Runtime.exe 1792 $77Runtime Broker.exe 2404 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeBackupPrivilege 1164 vssvc.exe Token: SeRestorePrivilege 1164 vssvc.exe Token: SeAuditPrivilege 1164 vssvc.exe Token: SeDebugPrivilege 1952 System.Runtime.exe Token: SeDebugPrivilege 1792 $77Runtime Broker.exe Token: SeDebugPrivilege 2404 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1792 $77Runtime Broker.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1952 wrote to memory of 2272 1952 System.Runtime.exe 34 PID 1952 wrote to memory of 2272 1952 System.Runtime.exe 34 PID 1952 wrote to memory of 2272 1952 System.Runtime.exe 34 PID 1952 wrote to memory of 1700 1952 System.Runtime.exe 36 PID 1952 wrote to memory of 1700 1952 System.Runtime.exe 36 PID 1952 wrote to memory of 1700 1952 System.Runtime.exe 36 PID 1952 wrote to memory of 1084 1952 System.Runtime.exe 39 PID 1952 wrote to memory of 1084 1952 System.Runtime.exe 39 PID 1952 wrote to memory of 1084 1952 System.Runtime.exe 39 PID 1084 wrote to memory of 1832 1084 cmd.exe 41 PID 1084 wrote to memory of 1832 1084 cmd.exe 41 PID 1084 wrote to memory of 1832 1084 cmd.exe 41 PID 1084 wrote to memory of 1792 1084 cmd.exe 42 PID 1084 wrote to memory of 1792 1084 cmd.exe 42 PID 1084 wrote to memory of 1792 1084 cmd.exe 42 PID 1792 wrote to memory of 2940 1792 $77Runtime Broker.exe 44 PID 1792 wrote to memory of 2940 1792 $77Runtime Broker.exe 44 PID 1792 wrote to memory of 2940 1792 $77Runtime Broker.exe 44 PID 1792 wrote to memory of 2136 1792 $77Runtime Broker.exe 46 PID 1792 wrote to memory of 2136 1792 $77Runtime Broker.exe 46 PID 1792 wrote to memory of 2136 1792 $77Runtime Broker.exe 46 PID 1792 wrote to memory of 2572 1792 $77Runtime Broker.exe 48 PID 1792 wrote to memory of 2572 1792 $77Runtime Broker.exe 48 PID 1792 wrote to memory of 2572 1792 $77Runtime Broker.exe 48 PID 1792 wrote to memory of 2404 1792 $77Runtime Broker.exe 50 PID 1792 wrote to memory of 2404 1792 $77Runtime Broker.exe 50 PID 1792 wrote to memory of 2404 1792 $77Runtime Broker.exe 50 PID 1792 wrote to memory of 1148 1792 $77Runtime Broker.exe 52 PID 1792 wrote to memory of 1148 1792 $77Runtime Broker.exe 52 PID 1792 wrote to memory of 1148 1792 $77Runtime Broker.exe 52 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2272 attrib.exe 1700 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\System.Runtime.exe"C:\Users\Admin\AppData\Local\Temp\System.Runtime.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WinTask"2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2272
-
-
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WinTask\$77Runtime Broker.exe"2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1700
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpFCF5.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1832
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WinTask\$77Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WinTask\$77Runtime Broker.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\system32\schtasks.exe"schtasks.exe" /query /TN $77Runtime Broker.exe4⤵PID:2940
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /SC ONCE /TN "$77Runtime Broker.exe" /TR "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WinTask\$77Runtime Broker.exe \"\$77Runtime Broker.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
PID:2136
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /query /TN $77Runtime Broker.exe4⤵PID:2572
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2404
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc hourly /mo 1 /tn "Runtime Broker_Task-HOURLY-01" /tr "%MyFile%" /st 00:004⤵
- Scheduled Task/Job: Scheduled Task
PID:1148
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1164
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197B
MD5d8146630a3aee8916b9cdd3ea8e2d974
SHA15d0aec6d77fc517590effaff97cde8badc75804f
SHA2561f1f3f78f6d76e836275f74cdd3378bc8be9abacf42f01fc17d32ab34e5e9cd9
SHA51208c7da1c55bca595c698ee71d49ea2eb1db3069e7079f12a6ded779eb967ebb3e3df8ba7cbd20b617c079aa80bf7245d4a0646f6a2828980356a9d09365c1062
-
Filesize
43KB
MD58f06957fd43a38298aa9d6f4bc52c7a7
SHA101a72c623c0ce786e01fbc3c165bb1c099a2dc1a
SHA256afe42ee135f9bbcc385db5751b4867e99aa4caa862bcaaf312e4355a5323145d
SHA5124b0283befc959340041cfb8c03caccfe3f32971434f34f85c80eba9921bd6e26e664287ec7826492f2047309bfc86e472aa8cb740008df6cf7b61ac94a54484e