Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
41s -
max time network
50s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
30/04/2024, 02:55
Static task
static1
Behavioral task
behavioral1
Sample
Seven.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
Seven.exe
Resource
win11-20240419-en
Behavioral task
behavioral3
Sample
Seven.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
Seven.exe
Resource
win11-20240419-en
General
-
Target
Seven.exe
-
Size
139KB
-
MD5
350273e0d2e8a9ba5e37b791016112a0
-
SHA1
5bfb616dd46f67d1dcbbff55ca5917ffc1ec8b71
-
SHA256
27297bf8139bea755e9297e7e1489d827d1ee09a8e1d94a3ef96a2edb2de61ba
-
SHA512
b1e768524b4e840bd5f4163205122dd1725583245d8bfd5cbd89eb21a5fb9d33aff1b7b0ca42132b7dae469e025068ae663b3b02ad59927a558dc340141ec91b
-
SSDEEP
3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8ltw:miS4ompB9S3BZi0a1G78IVhcTct
Malware Config
Signatures
-
Renames multiple (241) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini Seven.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini Seven.exe File opened for modification C:\Users\Admin\Documents\desktop.ini Seven.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini Seven.exe File opened for modification C:\Users\Admin\Music\desktop.ini Seven.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini Seven.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini Seven.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 1 raw.githubusercontent.com