Overview

overview

10

Static

static

3

Seven.exe

windows10-2004-x64

1

Seven.exe

windows11-21h2-x64

1

Seven.exe

windows10-2004-x64

10

Seven.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Seven.zip

  • Size

    1.1MB

  • Sample

    240429-qgscfabd38

  • MD5

    6c1a65a59f531d32ccf4d86e75139cda

  • SHA1

    cefec839ab56019d909fbff184cb28cc7f891fba

  • SHA256

    816a19d971edfde4e6259c07da3736f542de64f024b8a849068e9099ab8d2a51

  • SHA512

    fb66de899fa6acb34f441a30ec1ed056e3fd690d134c73ebc99a09a309d9f5c272c499a222a01c7f6ac1d0ea4c6c71696bc7c584b1e3558fb4ae66be0ea15449

  • SSDEEP

    24576:IxRysKfiJtehDWypamjV7liuj4DoH1sj8IRWpBefir0q:I4I9eamTXj4DoH1swI+Uk

Score
10/10
evasionransomwaretrojan

Malware Config

Targets

    • Target

      Seven.dll

    • Size

      1.0MB

    • MD5

      caaef7e7c2cd74afce04661f036e5d70

    • SHA1

      0038e849d8a6f2a3825c61f5c0acbfc4a4d76406

    • SHA256

      b20fabc102563acf12595c14f51eb775fbe46dc170bdd916ef4a44c98d251819

    • SHA512

      256d5d9193d26f375afc89793e1dbc0ab8ddc853640db3d5bbf04d51c24e40ca5cdb615b4f8c93bf1621e5e0db6788f4745a22ea242c22a182ece7ad6578e261

    • SSDEEP

      24576:85A5tpiuNindohTgWPQmjVTlWuxw5CHlsjsUH+RHAhET:8Iqu0xCQmX7xw5CHlsgU0g

    Score
    1/10
    behavioral1behavioral2

    • Target

      Seven.exe

    • Size

      139KB

    • MD5

      6503f847c3281ff85b304fc674b62580

    • SHA1

      947536e0741c085f37557b7328b067ef97cb1a61

    • SHA256

      afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f

    • SHA512

      abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174

    • SSDEEP

      3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8lto:miS4ompB9S3BZi0a1G78IVhcTct

    Score
    10/10
    evasiontrojanransomware

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • UAC bypass

      evasiontrojan

    • Blocks application from running via registry modification

      Adds application to list of disallowed applications.

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Disables cmd.exe use via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks