Analysis
-
max time kernel
67s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 08:59
Static task
static1
Behavioral task
behavioral1
Sample
Seven.exe
Resource
win10v2004-20240419-en
General
-
Target
Seven.exe
-
Size
139KB
-
MD5
6503f847c3281ff85b304fc674b62580
-
SHA1
947536e0741c085f37557b7328b067ef97cb1a61
-
SHA256
afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
-
SHA512
abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
-
SSDEEP
3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8lto:miS4ompB9S3BZi0a1G78IVhcTct
Malware Config
Signatures
-
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Seven.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Seven.exe -
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1" Seven.exe -
Blocks application from running via registry modification 1 IoCs
Adds application to list of disallowed applications.
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" Seven.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Seven.exe -
Disables Task Manager via registry modification
-
Disables cmd.exe use via registry modification 1 IoCs
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" Seven.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Seven.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation Seven.exe -
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Seven.exe -
Processes:
Seven.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe -
Drops file in System32 directory 9 IoCs
Processes:
cmd.execmd.execmd.exeattrib.exeattrib.exeattrib.exedescription ioc process File opened for modification C:\Windows\System32\Desktop cmd.exe File created C:\Windows\System32\Desktop cmd.exe File created C:\Windows\System32\Desktop cmd.exe File opened for modification C:\Windows\System32\Desktop cmd.exe File opened for modification C:\Windows\System32\Desktop cmd.exe File created C:\Windows\System32\Desktop cmd.exe File opened for modification C:\Windows\System32\Desktop attrib.exe File opened for modification C:\Windows\System32\Desktop attrib.exe File opened for modification C:\Windows\System32\Desktop attrib.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 4136 powershell.exe 4136 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4136 powershell.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
Seven.execmd.execmd.execmd.exedescription pid process target process PID 4572 wrote to memory of 4136 4572 Seven.exe powershell.exe PID 4572 wrote to memory of 4136 4572 Seven.exe powershell.exe PID 4572 wrote to memory of 3892 4572 Seven.exe cmd.exe PID 4572 wrote to memory of 3892 4572 Seven.exe cmd.exe PID 4572 wrote to memory of 2684 4572 Seven.exe cmd.exe PID 4572 wrote to memory of 2684 4572 Seven.exe cmd.exe PID 4572 wrote to memory of 1132 4572 Seven.exe cmd.exe PID 4572 wrote to memory of 1132 4572 Seven.exe cmd.exe PID 4572 wrote to memory of 2044 4572 Seven.exe cmd.exe PID 4572 wrote to memory of 2044 4572 Seven.exe cmd.exe PID 4572 wrote to memory of 5008 4572 Seven.exe cmd.exe PID 4572 wrote to memory of 5008 4572 Seven.exe cmd.exe PID 4572 wrote to memory of 4036 4572 Seven.exe cmd.exe PID 4572 wrote to memory of 4036 4572 Seven.exe cmd.exe PID 4572 wrote to memory of 3548 4572 Seven.exe cmd.exe PID 4572 wrote to memory of 3548 4572 Seven.exe cmd.exe PID 4036 wrote to memory of 2712 4036 cmd.exe attrib.exe PID 4036 wrote to memory of 2712 4036 cmd.exe attrib.exe PID 3548 wrote to memory of 2708 3548 cmd.exe attrib.exe PID 3548 wrote to memory of 2708 3548 cmd.exe attrib.exe PID 1132 wrote to memory of 3160 1132 cmd.exe attrib.exe PID 1132 wrote to memory of 3160 1132 cmd.exe attrib.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1" Seven.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 2712 attrib.exe 3160 attrib.exe 2708 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Seven.exe"C:\Users\Admin\AppData\Local\Temp\Seven.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\Desktop C:\Users\Admin\Desktop2⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\Desktop C:\Windows\System32\Desktop2⤵
- Drops file in System32 directory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\Desktop2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\Desktop3⤵
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\Desktop C:\Windows\System32\Desktop2⤵
- Drops file in System32 directory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\Desktop C:\Windows\System32\Desktop2⤵
- Drops file in System32 directory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\Desktop2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\Desktop3⤵
- Drops file in System32 directory
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\Desktop2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\Desktop3⤵
- Drops file in System32 directory
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u3ysr5pf.maz.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Windows\System32\DesktopFilesize
6KB
MD58acc7bd88368dde08bb3db3c2c2fd70a
SHA1e08727fbdedab8c1734ae8dea01402db446f207d
SHA25646e0f93a73fe79effcadee66739bea24eede732cad6a89b46d519a97caf24ed2
SHA5120cf277e98cec6174ca9aa6f8b082d740ec2f4ff2d786bcf2a572ea9586b3cbd7ae725788cd76e76a2e5564a99828463c1e4e28b04f2a3f3d736ac3badafca85e
-
memory/4136-5-0x000001F256E70000-0x000001F256E92000-memory.dmpFilesize
136KB
-
memory/4136-10-0x00007FF93E530000-0x00007FF93EFF1000-memory.dmpFilesize
10.8MB
-
memory/4136-12-0x000001F256D10000-0x000001F256D20000-memory.dmpFilesize
64KB
-
memory/4136-11-0x000001F256D10000-0x000001F256D20000-memory.dmpFilesize
64KB
-
memory/4136-15-0x00007FF93E530000-0x00007FF93EFF1000-memory.dmpFilesize
10.8MB