Overview

overview

10

Static

static

3

Seven.exe

windows10-2004-x64

1

Seven.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Seven.zip

  • Size

    1.1MB

  • Sample

    240428-hh3wkaae2t

  • MD5

    7fec716db78e23913a99573d2148f646

  • SHA1

    0fd82a28e1c7ab1a15676048e14ea2b8f33fc830

  • SHA256

    870f13d017be42e5fa49a7f5d30f59616aa3daca850fa4d91c036e165136902e

  • SHA512

    924f7247e1d258e86c53bc6643e37bc1f24b89ff1cea50d833d3966bc3da4a1eea18f55eaace1d11a64f597cfac60a4486a1ffd65b00ffac94d66099aed6d74a

  • SSDEEP

    24576:ryGYsLLGPTTKqUkiP5wV4vMWFWqhXxlcUdAw2GmJx+lyh6Uds+lQRA/9:ryGYsLsTKlv+4vMwWqZZdAw2Gmz+s6RK

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      Seven.dll

    • Size

      1.0MB

    • MD5

      a7a5141767a0fe23709153cc0f7bc1d9

    • SHA1

      5391c74653de7aec6c0e00d342da9ef607e07081

    • SHA256

      f9fac8cfaeeb0800506c812133c52d6e4db2c1de50aa1ca4738f0acd48d8a8e1

    • SHA512

      444c039841f5d404b06c9a85c814313b283bd6729577603a5ebe019c7a4054b6df1325010268cec3403b84ac14a5c49e26c4ed6837633d4c7ccd8b826b066801

    • SSDEEP

      24576:TAiJ82QUait5iVavuW1wqjXtlOUd6QyemnxYRehE0L2AtC3Z:u2Xj0avuQwqnjd6QyemxYwEbp

    Score
    1/10
    behavioral1

    • Target

      Seven.exe

    • Size

      139KB

    • MD5

      6503f847c3281ff85b304fc674b62580

    • SHA1

      947536e0741c085f37557b7328b067ef97cb1a61

    • SHA256

      afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f

    • SHA512

      abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174

    • SSDEEP

      3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8lto:miS4ompB9S3BZi0a1G78IVhcTct

    Score
    10/10
    evasionpersistencespywarestealertrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • UAC bypass

      evasiontrojan

    • Blocks application from running via registry modification

      Adds application to list of disallowed applications.

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Disables cmd.exe use via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Registers COM server for autorun

      persistence

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

6
T1112

Impair Defenses

3
T1562

Disable or Modify Tools

3
T1562.001

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks