Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 18:07
Static task
static1
Behavioral task
behavioral1
Sample
Seven.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral2
Sample
Seven.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
runtimes/win/lib/netcoreapp2.0/System.Diagnostics.EventLog.dll
Resource
win10v2004-20240426-en
General
-
Target
Seven.exe
-
Size
139KB
-
MD5
6503f847c3281ff85b304fc674b62580
-
SHA1
947536e0741c085f37557b7328b067ef97cb1a61
-
SHA256
afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
-
SHA512
abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
-
SSDEEP
3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8lto:miS4ompB9S3BZi0a1G78IVhcTct
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Seven.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe -
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe -
Deletes itself 1 IoCs
pid Process 3036 SevenCopy.exe -
Executes dropped EXE 2 IoCs
pid Process 3036 SevenCopy.exe 344 SevenCopy.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Seven.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe -
Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Documents\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Music\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini SevenCopy.exe -
Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\System32\SevenCopy.exe cmd.exe File created C:\Windows\System32\Seven.dll cmd.exe File opened for modification C:\Windows\System32\Seven.dll cmd.exe File created C:\Windows\System32\Seven.runtimeconfig.json cmd.exe File opened for modification C:\Windows\System32\Seven.runtimeconfig.json cmd.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\System32\SevenCopy.exe cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3260 powershell.exe 3260 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3260 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1404 wrote to memory of 3260 1404 Seven.exe 86 PID 1404 wrote to memory of 3260 1404 Seven.exe 86 PID 1404 wrote to memory of 1316 1404 Seven.exe 88 PID 1404 wrote to memory of 1316 1404 Seven.exe 88 PID 1404 wrote to memory of 4900 1404 Seven.exe 89 PID 1404 wrote to memory of 4900 1404 Seven.exe 89 PID 1404 wrote to memory of 1496 1404 Seven.exe 90 PID 1404 wrote to memory of 1496 1404 Seven.exe 90 PID 1404 wrote to memory of 2728 1404 Seven.exe 91 PID 1404 wrote to memory of 2728 1404 Seven.exe 91 PID 1404 wrote to memory of 3036 1404 Seven.exe 94 PID 1404 wrote to memory of 3036 1404 Seven.exe 94 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1" Seven.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Seven.exe"C:\Users\Admin\AppData\Local\Temp\Seven.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1404 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3260
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe2⤵PID:1316
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Windows\System32\SevenCopy.exe2⤵
- Drops file in System32 directory
PID:4900
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Windows\System32\Seven.dll2⤵
- Drops file in System32 directory
PID:1496
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Windows\System32\Seven.runtimeconfig.json2⤵
- Drops file in System32 directory
PID:2728
-
-
C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Drops desktop.ini file(s)
PID:3036
-
-
C:\Windows\System32\SevenCopy.exeC:\Windows\System32\SevenCopy.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:344
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139KB
MD56503f847c3281ff85b304fc674b62580
SHA1947536e0741c085f37557b7328b067ef97cb1a61
SHA256afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
SHA512abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.0MB
MD5c8f3bcc7f47b2daa469e3f46ca0d5d3b
SHA17213bd8ede8248aced7150f649ee6d3c1f3e2da0
SHA2563f4b670e88ee9450036a77fc2791a1824df5f54f94d772399455d30087a54e90
SHA512fc10b098e01f35957b658873fbb5116dab879e2c2b0a602eeaf7e729661945b22389788f74a05a86fd43e1f3850dd0b3c45451f13415f078868e1f3b8d6a01a2
-
Filesize
340B
MD5253333997e82f7d44ea8072dfae6db39
SHA103b9744e89327431a619505a7c72fd497783d884
SHA25628329cf08f6505e73806b17558b187c02f0c1c516fe47ebfb7a013d082aaa306
SHA51256d99039e0fb6305588e9f87361e7e0d5051507bf321ba36619c4d29741f35c27c62f025a52523c9e1c7287aabf1533444330a8cdf840fa5af0fa2241fcb4fc2