Overview

overview

8

Static

static

3

Seven.exe

windows10-2004-x64

1

Seven.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Seven.zip

  • Size

    1.2MB

  • Sample

    240425-czv96adf65

  • MD5

    32fa20fc14bd98fcd44bc0e07ae6b1f8

  • SHA1

    e05dd66f18f52d114b8126e53ce11ab5a64345a5

  • SHA256

    d9ee5786440e4630d903d4986aeefb6aa77ce4e9cfbb5311ca72d05d8b737622

  • SHA512

    0878efd814d44b373fc16dbca3a2dded5b94eb0946c5dcfc45dca80316c77f9213a1a276d6c89b98192ca3b55aaaadef38df243a9310256102fa2ab1aef5d03c

  • SSDEEP

    24576:w9sDWbxm7LCz/C+idsqjR3Tew5meUMhH/nYQ8v9Tlz:+ZJGZsqpH5meUMJ0NR

Score
8/10
evasion

Malware Config

Targets

    • Target

      Seven.dll

    • Size

      1.1MB

    • MD5

      592728a71fb01a246d4bdb8c34fe328f

    • SHA1

      2015095a0d1d53e5959a040de124fea2dd16bcc9

    • SHA256

      33d432dc586aaa64e6d3a09ef64c53c70bc23c5158c7a3a55fa1360e60d9fc85

    • SHA512

      ef0e7b25359a5603efd6076825b022a0b37b96fc3365f916db16ecf17a37db910aaca88cc233579ba0b940466bc237f2ef30d8d5d5ceea63d20b70750304e1d0

    • SSDEEP

      24576:DWwA3QdwQ6hYcM37CQitMqjV3lou54S4C/dt9Y++TR:Ds3G9obnMqDB54S4CV2

    Score
    1/10
    behavioral1

    • Target

      Seven.exe

    • Size

      139KB

    • MD5

      350273e0d2e8a9ba5e37b791016112a0

    • SHA1

      5bfb616dd46f67d1dcbbff55ca5917ffc1ec8b71

    • SHA256

      27297bf8139bea755e9297e7e1489d827d1ee09a8e1d94a3ef96a2edb2de61ba

    • SHA512

      b1e768524b4e840bd5f4163205122dd1725583245d8bfd5cbd89eb21a5fb9d33aff1b7b0ca42132b7dae469e025068ae663b3b02ad59927a558dc340141ec91b

    • SSDEEP

      3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8ltw:miS4ompB9S3BZi0a1G78IVhcTct

    Score
    8/10
    evasion

    • Modifies Windows Firewall

      evasion

    • Drops desktop.ini file(s)

    behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks