seven | 4f60e0c2fc72ccd0d3daec562d158884ef4110c215c873c440fc10f8d0593773

Resubmissions

15/06/2026, 16:10

260615-tmd9jsft9k10

13/03/2026, 17:01

260313-vjmbesd17v10

Analysis

max time kernel
149s
max time network
127s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
13/03/2026, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4f60e0c2fc72ccd0d3daec562d158884ef4110c215c873c440fc10f8d0593773.exe
Size 363KB
Sample260313-vjmbesd17v
SHA256 4f60e0c2fc72ccd0d3daec562d158884ef4110c215c873c440fc10f8d0593773
MD5 54919e1bd37c6431b3b1b8b6d53aabfe
SHA1 c2327bab84fa0d55cc23ee5006c83f0a6dc53e4c
SHA512 9b1d07e28cc63075748d42c2afdac6f55332d35dcd791c93ecfbe73d5868c3fbc84558f0778358e576babb955210b4fc79a263fa703009ed247391ccc3790722
SSDEEP 6144:5aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oe:5uTs1gBpQL5kmh0671oe
TLSH
T14B840826B14198E6DD7268791A65BBFEAA2DB4704B940FF7F7C24AA404E03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery seven persistence ransomware

Malware Config

Signatures

Detects Seven ransomware 1 IoCs

resource	yara_rule
behavioral2/files/0x001e00000002b309-7.dat	family_seven

Seven family
seven
Seven, SevenCrypt, 7ev3n
Seven aka SevenCrypt or 7ev3n is a ransomware.
ransomware seven

Executes dropped EXE 2 IoCs

pid	Process
1944	conlhost.exe
2268	conlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\allkeeper = "C:\\users\\Public\\conlhost.exe"	REG.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f60e0c2fc72ccd0d3daec562d158884ef4110c215c873c440fc10f8d0593773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 1944	652	4f60e0c2fc72ccd0d3daec562d158884ef4110c215c873c440fc10f8d0593773.exe	79
PID 1944 wrote to memory of 4576	1944	conlhost.exe	80
PID 1944 wrote to memory of 1056	1944	conlhost.exe	82
PID 1944 wrote to memory of 4044	1944	conlhost.exe	87

C:\Users\Admin\AppData\Local\Temp\4f60e0c2fc72ccd0d3daec562d158884ef4110c215c873c440fc10f8d0593773.exe
"C:\Users\Admin\AppData\Local\Temp\4f60e0c2fc72ccd0d3daec562d158884ef4110c215c873c440fc10f8d0593773.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:652
- C:\users\Public\conlhost.exe
  "C:\users\Public\conlhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\users\Public\del.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4576
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "allkeeper" /t REG_SZ /d "C:\users\Public\conlhost.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1056
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE" /v "crypted" /t REG_SZ /d "1" /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4044

C:\users\Public\conlhost.exe
C:\users\Public\conlhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 471B
SHA256 34f411a936c88aac2fd58f62fff226a0a03433a92d24b7e6a2eebab6b8a4f5da
MD5 b40de546cb9d537aabb4bc70e74088d3
SHA1 c538fc1432054f2e6e051cb46a316e17023956a3
SHA512 f6fdb23791da499a63b4c85b37e4715c9871251099135cbca9b4d996d6702d055702030ed4802f811b15249a78ec2b5ff4b0167fef381db17dc4e52649615ce1
TLSH
T1E2F0D4D244B018715B054D48A9F15E59312612ED1FFA80FFBC5C0D47911AB64F5380CC
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 471B
SHA256 a3787183f65fac7bc730a4b56340611ef08a46d3cf38f9804720291c6e766fb7
MD5 5059c8623cbd68c0504f11892e051b6d
SHA1 644f820c9a144e21a40af808ca35c99096a5f746
SHA512 87533c38495f5810c1a7087002652dcf58d3bd72cc3deeeacb6b7d1162d52237280bf26957775d2eee4a160c4e936b29ad68a9017b6c324636c5ff02ed5fd318
TLSH
T18CF0DC83447CE6327BD38ACC51898676300045F106AC138F7129D8E348626B9E3A6421
MD5 SHA1 SHA512 TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 402B
SHA256 ab85006f12c70346e8e0f8c3cc1f2d00382f76ad0fdc91df4723e3fdced898b6
MD5 06edf9d7e72fff9798b30b7afaf0a77a
SHA1 18c5f77dbaa76ba42740eee12fee31b0772f2b4e
SHA512 3bc6582136a360f4927bf385977b2e463a0226208ba9a060429ffce8e0459620d9af663e0e2b29f9745b7bbb88f5870ddd8e1250ce66db6c696ccce646f2cab4
TLSH
T180E0DF241AFA027CF2F1EA744BCAE962446AE1012DB8C76E12900A0EBB47A00DD72834
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 420B
SHA256 49fb2e6bdd5071cee3bb705fbfc400ba725e8635be445758bee598a322e3753d
MD5 c16b946764f034efddc2328ba84483af
SHA1 f6fd7f4216ada7aebd6fba536aa1f476c345b400
SHA512 16d56c46e11f4dfed92fa7dea9b97543dc77cc5360af3c3f041f9e6091752a1b501ac638d301c62ff63a3445d7a3b96ee83ad7e90a637a688c709435ad9bd4ea
TLSH
T1E4E0682806FB420CE4D0E4388BCAB4309569F2510926B27010C66B08B621A00AC02A22
MD5 SHA1 SHA512 TLSH

Submit Download

FILES_BACK.txt

Path C:\Users\Admin\FILES_BACK.txt
Size 177B
SHA256 a2a678d59020d212a1ec32810466b9a2bc4d17fcfff8edd6c07c5aa8ef15b25f
MD5 fc605d0a0029f229d0ed645293ece316
SHA1 9ee4a83cd232b15790107ebbb98b4b515839f219
SHA512 2e43a1bbb43f9371cfcdcf550a205bb123a2facf17cbdd180591eb7a7c3ee75b5aae0a59654898814e4dee9d7bdf4ff3f6b50a37f0fbd5252865a23655b261e1
TLSH
T1B3C0C00C7F792400330192C8A0199F059D1FB500D15120D00F10500C3DFD7E4C4902D3
MD5 SHA1 SHA512 TLSH

Submit Download

conlhost.exe

Path C:\Users\Public\conlhost.exe
Size 363KB
SHA256 bcdd86c074de933138f13811ed180b365a0539b2db5efc12688638cecb28297b
MD5 9df10875bcf67d6314e84ef02e957412
SHA1 541dbb5ec1bafe665f4639d53eb9368d691f21bc
SHA512 803509a8d1d0c4797bac154ca2a308b552bd5280229ac2c3584204a9461038ab55a2cb9318b754989f6a469a1d810b37ef1e1418a8b4b3e5e6a90c1b151e54ec
SSDEEP 6144:5aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371ol:5uTs1gBpQL5kmh0671ol
TLSH
T1C0840826B14198E6DD7268791A65BBFEAA2DB4704B940FF7F7C24AA404E03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del.bat

Path C:\users\Public\del.bat
Size 130B
SHA256 efa0f89bf88e23b3de5931571c180ae80bd784b02ea1e5f433e84fe8d3fd9c82
MD5 7a7b5ecbedf88d68ebaadc94b4d4aa28
SHA1 ddd995ab350655c23eac808d86102094bb8263d2
SHA512 8b9b7829d05755106292f5d90cb1c483360a5e4c81d484f32521003b9f7f9dda6957a2a8c1de7e08a7bcf80980030ba79ff8838374834b96077f3f4288c87578
TLSH
T107C02BA6884604531021001B220C4208906E4CCF0200E1B426132B980503C10B640C23
MD5 SHA1 SHA512 TLSH

Submit Download

time.e

Path C:\users\Public\time.e
Size 16B
SHA256 7e4362f9b1ecc124014927a9733318edc09802cafceeb195021cf72a4b1c5904
MD5 f9e496e6e76a568274239cc49aee34c1
SHA1 df13e818d5f335e541515187bb85a526dc128a4c
SHA512 5fcde2b66456efed36698b31a8ae319b5fca2f2afa982253c1784deefb16eafd3f8babd2a084c6c8d0fb7257a6766f1565c5c5051851cf3473a5fb3a6b6f13d4
MD5 SHA1 SHA512

Submit Download

memory/652-3-0x0000000002C40000-0x0000000002C8A000-memory.dmp

Download

memory/652-10-0x0000000002C40000-0x0000000002C8A000-memory.dmp

Download

memory/1944-12-0x0000000002D70000-0x0000000002DBA000-memory.dmp

Download

memory/1944-253-0x0000000003E60000-0x0000000003E79000-memory.dmp

Download

memory/1944-252-0x0000000003E30000-0x0000000003E52000-memory.dmp

Download

memory/1944-254-0x0000000003E80000-0x0000000003EA0000-memory.dmp

Download

memory/2268-243-0x0000000002F00000-0x0000000002F4A000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads