seven | 2991dcf2f6221e1a230fb499b42df02960df6e202a73cc1e6f4e1acb87a6e77a

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/04/2026, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-03_cf6c3ed920bf8da096ef70e2ff59a137_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
Size 388KB
Sample260403-dsakjsct9w
SHA256 2991dcf2f6221e1a230fb499b42df02960df6e202a73cc1e6f4e1acb87a6e77a
MD5 cf6c3ed920bf8da096ef70e2ff59a137
SHA1 4fd0eac4badfd2315f684d72c19c8cec199e4ecd
SHA512 1d8086583a100653c7c6105276033f2b84c714d39c7c94ec6e96e460f4a26861d0cadce1eb50ce77ecec99e1ce229bacb9a2c11f5b4514afd5f8524b592b6c92
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oHVCvvi:/uTs1gBpQL5kmh0671o1CC
TLSH
T108841926714198A6DD7268791A65BBFEAA2DB8704B940FF7F7C24AA404F03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery seven persistence ransomware

Malware Config

Signatures

Detects Seven ransomware 1 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b332-7.dat	family_seven

Seven family
seven
Seven, SevenCrypt, 7ev3n
Seven aka SevenCrypt or 7ev3n is a ransomware.
ransomware seven

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b332-7.dat	UPX

Executes dropped EXE 2 IoCs

pid	Process
5148	conlhost.exe
6020	conlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows\CurrentVersion\Run\allkeeper = "C:\\users\\Public\\conlhost.exe"	REG.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-03_cf6c3ed920bf8da096ef70e2ff59a137_7ev3n_coinminer_elex_hawkeye_mespinoza.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 5148	5108	2026-04-03_cf6c3ed920bf8da096ef70e2ff59a137_7ev3n_coinminer_elex_hawkeye_mespinoza.exe	79
PID 5148 wrote to memory of 1152	5148	conlhost.exe	80
PID 5148 wrote to memory of 4956	5148	conlhost.exe	82
PID 5148 wrote to memory of 1044	5148	conlhost.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-04-03_cf6c3ed920bf8da096ef70e2ff59a137_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-03_cf6c3ed920bf8da096ef70e2ff59a137_7ev3n_coinminer_elex_hawkeye_mespinoza.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5108
- C:\users\Public\conlhost.exe
  "C:\users\Public\conlhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\users\Public\del.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1152
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "allkeeper" /t REG_SZ /d "C:\users\Public\conlhost.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4956
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE" /v "crypted" /t REG_SZ /d "1" /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1044

C:\users\Public\conlhost.exe
C:\users\Public\conlhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 471B
SHA256 97818954ad45a153f84ec15ac9c57aa38f5ea45851619cc7f561fe4e2df068eb
MD5 ef30f80e4ab5c78274167095863c9c99
SHA1 7aeaf55f606eb8aedad3439dba1de729cbc7b2c7
SHA512 968169aef91394c4ab7a6c1fb1bc0b8fd9d06f57c062b1bb6ac79142854102636e6a2f39ec9c0e5bc88d2d1c214bf00ef5c9269a7886608dda91d406c7c98ecb
TLSH
T119F0540504A15CD57B710A841CF3C87270484B0C05EB907DFEBC1389512D2B5D444D70
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 471B
SHA256 d807917aa11e4bafc5e2b6be48ad12c24c3a422080a3904bbf6ba3de24486f4e
MD5 68eeb52fc2d2c24854a756718a13053b
SHA1 800fcda755f05c363c9464bb0f338b87018a137a
SHA512 34cfe1605885c3bde153cbbabcbd7e86b6514bc13aeec20fe073a30430acb0954d80c8d87bfeaf191858ce84d006fb0e8bf75689d0494e213dd5baef2ed2ab93
TLSH
T1AAF0DCDAC17BF1A17B5147AD021961BB3420A0F00D642052743EB6F02C6E5BC872A03A
MD5 SHA1 SHA512 TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 402B
SHA256 12b4ce173996b30b56074753bd57d27dde6060d23cb6fe194ecaa1fd6c2e1ea1
MD5 b3bd62b1fe87cd16c231d130a2d707bb
SHA1 26714f30789294bbdb49aa7a39a0f9466bdf4306
SHA512 0c0ded4a44a72ca827f943557a6ff9b4949f1f3585e17b80d9187762dc7da5c46a7eb8dbde2befcb0ed134a2cc2120d3a73d787930858cbe032f6a95c8f3c31a
TLSH
T179E0202516FE157CF171DA744BD69671455FE2021C74837A17D0070DB713640DC72C34
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 420B
SHA256 db466b71f09aa9431886b59eff12a639d9d5531717967d75c2bcc0e66b731c7b
MD5 62fb25862e3a0bc15517d65f097945a8
SHA1 c13544ebd86533f541ac24f6113667d426b0a229
SHA512 13caceef6d3e36adcab75b51f6c0de48ac624775cab3376c14805b30c0dba61803bf5f8afe2065b03099a9977eedbd232493c17e663b0cc6969e624a07894733
TLSH
T131E0203812FF411DF5E4E43587C9B0359569F1111979E27415D55B18B721980FC12A35
MD5 SHA1 SHA512 TLSH

Submit Download

FILES_BACK.txt

Path C:\Users\Admin\FILES_BACK.txt
Size 177B
SHA256 a2a678d59020d212a1ec32810466b9a2bc4d17fcfff8edd6c07c5aa8ef15b25f
MD5 fc605d0a0029f229d0ed645293ece316
SHA1 9ee4a83cd232b15790107ebbb98b4b515839f219
SHA512 2e43a1bbb43f9371cfcdcf550a205bb123a2facf17cbdd180591eb7a7c3ee75b5aae0a59654898814e4dee9d7bdf4ff3f6b50a37f0fbd5252865a23655b261e1
TLSH
T1B3C0C00C7F792400330192C8A0199F059D1FB500D15120D00F10500C3DFD7E4C4902D3
MD5 SHA1 SHA512 TLSH

Submit Download

conlhost.exe

Path C:\Users\Public\conlhost.exe
Size 388KB
SHA256 f7d5e9c23b9357d75d8823136e12f22a3071abbab613b5f77db415676e71d8e7
MD5 bf4162a645d5c5ce0c3cbade3e51c902
SHA1 32a822277b170ad8b34700386d9cfe7fc7da6c56
SHA512 ae46900c6be0a01fff648e19ccf0bbb4872a9c7e2bf57681e150d2438227932898c21a3c91e5e726d490f19e01f34e9af35f0f2971fd2d8b639016cdbde2b26e
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oHVCvvQ:/uTs1gBpQL5kmh0671o1Cw
TLSH
T172841926714198A6DD7268791A65BBFEAA2DB8704B940FF7F7C24AA404F03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del.bat

Path C:\users\Public\del.bat
Size 148B
SHA256 a8bbbba49d6bcd9136ba8fb83b25529399bd8a67a395a243c8ad25a4b2dc0190
MD5 3610f50f82c4bef114cf9945000a28f8
SHA1 26aac8808ce1fc22da1e54522df8ab5a1358ce35
SHA512 8d774938e3abede6953e2b4b3b58747c9f3a1ca2af62816772dbe3e6985fdf2ab4e6d867d2f7c35374a454f9959f979afd338a47d21fbaca05c806597878ab26
TLSH
T1B2C02B62DA89CD84014A110B83FE560890DE18DE09542920063B46DC454309CB972945
MD5 SHA1 SHA512 TLSH

Submit Download

time.e

Path C:\users\Public\time.e
Size 16B
SHA256 68625245097ee03e38941f6caf2f3e7892ac5a5d3ffb78fbd274edd8adbc13da
MD5 d30ce8ca5d68d69c1da7aa9c91740ff6
SHA1 83b638169a22c7b5abc0647447cd8901d91329e5
SHA512 265fe65642bec29a92bbdd0ebca8d072edcc09518c29195780f044a8ae78659a7b9bfca0961fb481b900c72dab23581d694e67d6def71607b58f75afa4e5ace6
MD5 SHA1 SHA512

Submit Download

memory/5108-9-0x0000000001040000-0x00000000010BA000-memory.dmp

Download

memory/5108-3-0x0000000001040000-0x00000000010BA000-memory.dmp

Download

memory/5148-12-0x0000000001530000-0x00000000015AA000-memory.dmp

Download

memory/5148-321-0x0000000001530000-0x00000000015AA000-memory.dmp

Download

memory/5148-324-0x0000000003E60000-0x0000000003E80000-memory.dmp

Download

memory/5148-323-0x0000000003E40000-0x0000000003E59000-memory.dmp

Download

memory/5148-322-0x0000000003E10000-0x0000000003E32000-memory.dmp

Download

memory/6020-311-0x0000000001200000-0x000000000127A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads