Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1040s -
max time network
1046s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
27/02/2025, 16:06
Behavioral task
behavioral1
Sample
System.Runtime.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
System.Runtime.exe
Resource
win10v2004-20250217-en
General
-
Target
System.Runtime.exe
-
Size
43KB
-
MD5
8f06957fd43a38298aa9d6f4bc52c7a7
-
SHA1
01a72c623c0ce786e01fbc3c165bb1c099a2dc1a
-
SHA256
afe42ee135f9bbcc385db5751b4867e99aa4caa862bcaaf312e4355a5323145d
-
SHA512
4b0283befc959340041cfb8c03caccfe3f32971434f34f85c80eba9921bd6e26e664287ec7826492f2047309bfc86e472aa8cb740008df6cf7b61ac94a54484e
-
SSDEEP
768:ExhcfSe88qd/Ol6IoZmhPH5m7vavCJ8eEP+RULQD9PuGsz1QB6Sc/lE:ExhcfSes6tjBm5ZK+GsD9vg1Qo7/lE
Malware Config
Extracted
silverrat
1.0.0.0
if-eventually.gl.at.ply.gg:17094
lAxDBRhAFu
-
certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
-
decrypted_key
-|S.S.S|-
-
key
yy6zDjAUmbB09pKvo5Hhug==
-
key_x509
b0FGeVZNcFRMWVloVHR6Z0VESU5RdlpZUmxZbUFE
-
reconnect_delay
4
-
server_signature
t9H0tGywaq23QHywsvniYlva2DUEoHwEX4RZOKw6QYOUUUEs6+qPhkwL0ziJc2nYj2yd5E4o3kMJj8NRpRTkpZcyIg/ljsBjIY4uuTgySYNYShSJRrNgQc/XiUXjH546feRdpS3EuZPWH15iNA3U89kmdXU1BOtms28guz5MUZ/jdeGBHbjPJULpyM8EgGGdK3ajqJ+NWQxPHql47XGQFXqJ5PauE0xmpcMKt+LU7fe+NS0Yx11uv+tRwSlMmFhYU9pSYoS8zZ7Lyeaw8rcxs06oecNxLKcmbSH3H5QWo4qYq/Y7HAeBmLEHHB5t8+bCVeDMfccmct8s+aZpljSceGlri2HJsxEjZ7FYmh4+o8bhacTmqQyE99P1kSa4FAWPLn59j5s1nO91Sb/rMvcNUApgatm6ZRZjc+Ninv7rXwFncnT7eRSRvldp7PohX6bsJEJRMnfLT4YxM0TzqV9POSK0hjrRojbiRQWahccxQRKfg3TcVxNnNjCQWMOJ0YzNuQ0ZSTLPO3QA4v/0cwD5nBhPdhowAnMUb4j61HsPdaQnKXvlx377vbMOowWJFqGC1ES1rKn843GMu81HL7FJsfrpqglmmFTddG3IwkeJU7umxj41+anidgCco7Jzbii9D9e4l2DF3EuhYg+qIuiwNw4ACh3olxSGStXl952V/dY=
Signatures
-
Silverrat family
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1200 attrib.exe 4028 attrib.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation System.Runtime.exe Key value queried \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation $77Runtime Broker.exe -
Executes dropped EXE 1 IoCs
pid Process 4364 $77Runtime Broker.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\WinTask\\$77Runtime Broker.exe\"" System.Runtime.exe -
pid Process 2020 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 3420 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1692 schtasks.exe 2292 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2544 System.Runtime.exe 2544 System.Runtime.exe 2544 System.Runtime.exe 2544 System.Runtime.exe 2544 System.Runtime.exe 2544 System.Runtime.exe 2544 System.Runtime.exe 2544 System.Runtime.exe 2544 System.Runtime.exe 2544 System.Runtime.exe 2544 System.Runtime.exe 2544 System.Runtime.exe 2544 System.Runtime.exe 2544 System.Runtime.exe 2544 System.Runtime.exe 2544 System.Runtime.exe 2544 System.Runtime.exe 2544 System.Runtime.exe 2544 System.Runtime.exe 2544 System.Runtime.exe 2544 System.Runtime.exe 2544 System.Runtime.exe 2544 System.Runtime.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 2020 powershell.exe 2020 powershell.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 2020 powershell.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe 4364 $77Runtime Broker.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4364 $77Runtime Broker.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeBackupPrivilege 5044 vssvc.exe Token: SeRestorePrivilege 5044 vssvc.exe Token: SeAuditPrivilege 5044 vssvc.exe Token: SeDebugPrivilege 2544 System.Runtime.exe Token: SeDebugPrivilege 4364 $77Runtime Broker.exe Token: SeDebugPrivilege 2020 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4364 $77Runtime Broker.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2544 wrote to memory of 1200 2544 System.Runtime.exe 93 PID 2544 wrote to memory of 1200 2544 System.Runtime.exe 93 PID 2544 wrote to memory of 4028 2544 System.Runtime.exe 95 PID 2544 wrote to memory of 4028 2544 System.Runtime.exe 95 PID 2544 wrote to memory of 5076 2544 System.Runtime.exe 105 PID 2544 wrote to memory of 5076 2544 System.Runtime.exe 105 PID 5076 wrote to memory of 3420 5076 cmd.exe 107 PID 5076 wrote to memory of 3420 5076 cmd.exe 107 PID 5076 wrote to memory of 4364 5076 cmd.exe 108 PID 5076 wrote to memory of 4364 5076 cmd.exe 108 PID 4364 wrote to memory of 5072 4364 $77Runtime Broker.exe 110 PID 4364 wrote to memory of 5072 4364 $77Runtime Broker.exe 110 PID 4364 wrote to memory of 2292 4364 $77Runtime Broker.exe 112 PID 4364 wrote to memory of 2292 4364 $77Runtime Broker.exe 112 PID 4364 wrote to memory of 4964 4364 $77Runtime Broker.exe 114 PID 4364 wrote to memory of 4964 4364 $77Runtime Broker.exe 114 PID 4364 wrote to memory of 2020 4364 $77Runtime Broker.exe 116 PID 4364 wrote to memory of 2020 4364 $77Runtime Broker.exe 116 PID 4364 wrote to memory of 1692 4364 $77Runtime Broker.exe 117 PID 4364 wrote to memory of 1692 4364 $77Runtime Broker.exe 117 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1200 attrib.exe 4028 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\System.Runtime.exe"C:\Users\Admin\AppData\Local\Temp\System.Runtime.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WinTask"2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1200
-
-
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WinTask\$77Runtime Broker.exe"2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4028
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBCB8.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:3420
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WinTask\$77Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WinTask\$77Runtime Broker.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /TN $77Runtime Broker.exe4⤵PID:5072
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /SC ONCE /TN "$77Runtime Broker.exe" /TR "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WinTask\$77Runtime Broker.exe \"\$77Runtime Broker.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
PID:2292
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /TN $77Runtime Broker.exe4⤵PID:4964
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc hourly /mo 1 /tn "Runtime Broker_Task-HOURLY-01" /tr "%MyFile%" /st 00:004⤵
- Scheduled Task/Job: Scheduled Task
PID:1692
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5044
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
197B
MD51caf1c28ee80c7346d11a1bdd874d7dc
SHA16049c4c2ee0c224ce02d8e82a1bbc8c57e0961f6
SHA256cc7cdd77562f8fa3e1adf6aedc268d6a0f53d05889ff26d2517de739774b5137
SHA512aafe3e6f55ab330c209edcf3cf9b1dad24b392bf539a660d7778605c2cbf629a9f6994c194807a0f1a102a2932898424caafa18a8a234df9d8810f3cff6d8ca5
-
Filesize
43KB
MD58f06957fd43a38298aa9d6f4bc52c7a7
SHA101a72c623c0ce786e01fbc3c165bb1c099a2dc1a
SHA256afe42ee135f9bbcc385db5751b4867e99aa4caa862bcaaf312e4355a5323145d
SHA5124b0283befc959340041cfb8c03caccfe3f32971434f34f85c80eba9921bd6e26e664287ec7826492f2047309bfc86e472aa8cb740008df6cf7b61ac94a54484e