8badaeccb7286e732c654db4f3ae56228bfa39d17892177071ffb31d3f39eb84

General

Target

Seven.zip
Size

1.4MB
Sample

240430-ewxpxscf5x
MD5

32155fff65a91fb94ba1a54bb57ee37d
SHA1

6a44f85f810632cbcec6727c68640c74613a14dd
SHA256

8badaeccb7286e732c654db4f3ae56228bfa39d17892177071ffb31d3f39eb84
SHA512

459a6407467d9593f38f3576ac50ac6497194845e4b5b54246e6e17a764c407e6d1d0a5e09a28cbbbebd012189a511c649860a98051ef27817d8e383cb95fed2
SSDEEP

24576:z8Wa21cqjrnlAmFKWhKPNQ1Fb9xovN7VCp+AqL+0NQCW4qKm99yXzVKWnS30C:zt1cqlPFKWMNQ9xoVDFWBKm9yVK339

Score

10^/10

Malware Config

Targets

- Target
  
  Seven.dll
- Size
  
  1.3MB
- MD5
  
  bb4439ef14bcf61a8b9615e7de6f8450
- SHA1
  
  dbe25723b1c5b9e34c68875bb59de5b39020c476
- SHA256
  
  5a24944ed94f1f0da312562980c4dcc72278fe85feee4aa9147662f21676b902
- SHA512
  
  e9926342865bd602fad13a569efc76753f12050410684a239d380522dfd7028a08b3b4fc369578096f63094234325699836a09892c91a245a2f2c0253053a7b2
- SSDEEP
  
  24576:Aeai2lqqjV/lMuFEWdKtbs5FpD7ivDTVeH06Y7+g9eKWUgKc5rajz9SWBMz:ADlqqzVFEWqbsZ7iLF3W1Kc5c9SJz
Score

1^/10
behavioral1 behavioral2
- Target
  
  Seven.exe
- Size
  
  139KB
- MD5
  
  350273e0d2e8a9ba5e37b791016112a0
- SHA1
  
  5bfb616dd46f67d1dcbbff55ca5917ffc1ec8b71
- SHA256
  
  27297bf8139bea755e9297e7e1489d827d1ee09a8e1d94a3ef96a2edb2de61ba
- SHA512
  
  b1e768524b4e840bd5f4163205122dd1725583245d8bfd5cbd89eb21a5fb9d33aff1b7b0ca42132b7dae469e025068ae663b3b02ad59927a558dc340141ec91b
- SSDEEP
  
  3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8ltw:miS4ompB9S3BZi0a1G78IVhcTct
Score

10^/10

evasion ransomware spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- UAC bypass
  evasion trojan
- Renames multiple (284) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  evasion
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Disables cmd.exe use via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral3 behavioral4