General
-
Target
Seven.zip
-
Size
1.1MB
-
Sample
240428-kef9habg47
-
MD5
ad5f5cbac267830b9483da70838951be
-
SHA1
f33b466232ada3a7a1dca26c2a72a9d921ee2ea5
-
SHA256
ab5fbfe2af4d7c814731aaae49011002271721e0e7e91c8bd9a2cd3bbbfdd378
-
SHA512
ea854dbbe3f649d2837c3d4645dc4a33864221e75cd0b61ce65aa9a09ebdf0f90c101fd51b3b27d951843ddcf682282747553aece886dd1bac593d78ec432035
-
SSDEEP
24576:rum/gixpRYv8i35goWW1Kq5/LlUkdo3zkmfP1KFZQoGC3s26n:rflRYvfIUKqrRdojkmn1UZ7s1
Static task
static1
Behavioral task
behavioral1
Sample
Seven.exe
Resource
win10v2004-20240419-en
Malware Config
Targets
-
-
Target
Seven.dll
-
Size
1.0MB
-
MD5
99d5dbdf818b55d9c1e6116193ad14fd
-
SHA1
f3990680de96f502e01e04d46b7305515dd729f9
-
SHA256
c84e4c6c36a27d29bf240980317311cee8ccde146e05c5574a39cee5a77a68d0
-
SHA512
5dbfc443a6daae25ec348a8875c65554d0cfa825f6315bb6d154ca672ba3eafa4422ac0fbdeb8a9c3b7dacbe83d916a52edbff772d4ce165ffc03dabec237c86
-
SSDEEP
24576:cAiJp30zOil50E0Wb8qj/Jlikdud9yadXv0FRAmm6xsv:k30zP2+8qDHduDya9vKRvsv
Score1/10 -
-
-
Target
Seven.exe
-
Size
139KB
-
MD5
6503f847c3281ff85b304fc674b62580
-
SHA1
947536e0741c085f37557b7328b067ef97cb1a61
-
SHA256
afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
-
SHA512
abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
-
SSDEEP
3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8lto:miS4ompB9S3BZi0a1G78IVhcTct
-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Disables cmd.exe use via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops desktop.ini file(s)
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1