Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

Seven.exe

windows10-2004-x64

1

Seven.exe

windows10-2004-x64

10

runtimes/w...og.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Seven.zip

  • Size

    1.2MB

  • Sample

    240427-wqc7rsdg26

  • MD5

    3fc96ac01107508a972a4a38a6e0fe73

  • SHA1

    37c4fa2f92f32c7844d2a36126bc94c639c5e5bf

  • SHA256

    5b253c8c07d51d337e0b523949cf95ca4949a2c041db8179e4787e9b04e4528b

  • SHA512

    80ef91927962f5a2b15d2ce965f375c5622ab7bceb1748884c0ffeca0abc8935112f175b78a817000164b89cad5414ccfd103d544bd04c4ecf6aea13cd7c1dfc

  • SSDEEP

    24576:tV0LvirJFv4pPXWih52K+xWPaqbv5lisdk8WqoPE6bKaYCII:tV0LvIJFuXrrkSaqDLdk8HoM6r

Score
10/10
evasiontrojan

Malware Config

Targets

    • Target

      Seven.dll

    • Size

      1.0MB

    • MD5

      c8f3bcc7f47b2daa469e3f46ca0d5d3b

    • SHA1

      7213bd8ede8248aced7150f649ee6d3c1f3e2da0

    • SHA256

      3f4b670e88ee9450036a77fc2791a1824df5f54f94d772399455d30087a54e90

    • SHA512

      fc10b098e01f35957b658873fbb5116dab879e2c2b0a602eeaf7e729661945b22389788f74a05a86fd43e1f3850dd0b3c45451f13415f078868e1f3b8d6a01a2

    • SSDEEP

      24576:zAiJJnoin5oKwBWBCqjvFlisdaCWMG7aoJuQW:zn3tcoCq3LdaCRGOo

    Score
    1/10
    behavioral1

    • Target

      Seven.exe

    • Size

      139KB

    • MD5

      6503f847c3281ff85b304fc674b62580

    • SHA1

      947536e0741c085f37557b7328b067ef97cb1a61

    • SHA256

      afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f

    • SHA512

      abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174

    • SSDEEP

      3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8lto:miS4ompB9S3BZi0a1G78IVhcTct

    Score
    10/10
    evasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • UAC bypass

      evasiontrojan

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral2

    • Target

      runtimes/win/lib/netcoreapp2.0/System.Diagnostics.EventLog.dll

    • Size

      127KB

    • MD5

      9fb98981ec44d65d5a8fd867d7704dfb

    • SHA1

      7558a89c885ebad2fe4fdec28c1eb7235a751c7d

    • SHA256

      351f8619c3dafbad38ac8c89349b4c15073a944b2906b42cc7efe6353d21a985

    • SHA512

      b0226ad2487ee124953205079f7d13efdd8c4ec92a184a5687607ce78022ce5899bf079aff7a04685b5c44798483642f0996871ceebe094d8965d6ecf1833576

    • SSDEEP

      3072:GH/D1R8EYgMivs+qA8fb/+kPbPH5+LKlwnO4S5llBkQ7cEZ7A:GrQLgMivs+qdb/+kPl+4p4Sb7HZ7

    Score
    1/10
    behavioral3

MITRE ATT&CK Enterprise v15

Tasks