seven | 13e46723014d564aa72029473d3ec8201721ecd716ee97a792b687f806d71c9a

General

Target
2026-07-28_ea50885f08ad7f4bb115eb6d292e3c94_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
Size 388KB
Sample260728-1rdbdayway
SHA256 13e46723014d564aa72029473d3ec8201721ecd716ee97a792b687f806d71c9a
MD5 ea50885f08ad7f4bb115eb6d292e3c94
SHA1 103c2fa8a52cf71da5811ba2eac04a69173bb9c5
SHA512 948c9ca7ac65de6b42fcbec053948a9adff15a35e61c7082f9f70b99e19e5d33b8edb4e2d42b9290fec971cda25a7fed9ace7a635b7a21597240eb135058fba4
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oHVCvvV:/uTs1gBpQL5kmh0671o1C1
TLSH
T1A7841926714198A6DD7268791A65BBFEAA2DB8704B940FF7F7C24AA404F03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution seven persistence ransomware spyware trojan

Malware Config

Signatures

Family: Seven, SevenCrypt, 7ev3n
Seven aka SevenCrypt or 7ev3n is a ransomware.
ransomware seven

Detects Seven ransomware 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c52d-4.dat	family_seven

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c52d-4.dat	UPX

Executes dropped EXE 2 IoCs

pid	Process
4844	conlhost.exe
4904	conlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\allkeeper = "C:\\users\\Public\\conlhost.exe"	REG.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5608	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_ea50885f08ad7f4bb115eb6d292e3c94_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	conlhost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c000000010000000400000000080000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	conlhost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 4844	6020	2026-07-28_ea50885f08ad7f4bb115eb6d292e3c94_7ev3n_coinminer_elex_hawkeye_mespinoza.exe	89
PID 4844 wrote to memory of 5608	4844	conlhost.exe	90
PID 4844 wrote to memory of 4900	4844	conlhost.exe	93
PID 4844 wrote to memory of 2700	4844	conlhost.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-07-28_ea50885f08ad7f4bb115eb6d292e3c94_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_ea50885f08ad7f4bb115eb6d292e3c94_7ev3n_coinminer_elex_hawkeye_mespinoza.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6020
- C:\users\Public\conlhost.exe
  "C:\users\Public\conlhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\users\Public\del.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5608
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "allkeeper" /t REG_SZ /d "C:\users\Public\conlhost.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4900
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE" /v "crypted" /t REG_SZ /d "1" /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2700

C:\users\Public\conlhost.exe
C:\users\Public\conlhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 471B
SHA256 3cf2c3d620e62621145edb85e73cb73d6101acf5743c3a8ba3fd456c491343fe
MD5 8d8eaeb8d1bf326cdf88df7311b2bf10
SHA1 ac9e2c90f5f46f82829056cf660661f0ec077293
SHA512 37d52110bf26e7adbb92acde893d1b6b37f027567d8d4b341293e665a550ec7ce0019ac3b66772a68e87703b97c2413bc7fbd0aec2d689efd35c4cfadd328117
TLSH
T13BF0DCD2843EECD27F4252C81AFA993BB120DCA446E0A4AA643CC5B22C6003D6F6B435
MD5 SHA1 SHA512 TLSH

Submit Download

86289DDB9DCDB7A9CB80977D1B95D288

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86289DDB9DCDB7A9CB80977D1B95D288
Size 779B
SHA256 70317d9d6c92367ddd7f6d81f2007edcd31ab8a4fd0a8a8859c36d01f2edecf5
MD5 fc33555f44b6ff4d9d3644899e92111d
SHA1 ae1dbb2c226cec6c6ed1e5f1ebe79ce0d7615920
SHA512 f48ed4202525b07aaba84dd12517b0495b9a082786b99ce22301a174a6dac30d988eb89893c4ab772ab7574111c7be1b98646774ee945b62a6683626a32a70f3
TLSH
T181014105884C2622CB08FA76D482ED574DF03280B3D09467979448447032FC86EEC5E6
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 420B
SHA256 a30f7ef2a8886ae3ed9ea970d9f7740946659d06ddd0bdaed45394b07861dba8
MD5 80a499942a2b2c0575ec33b6e1686717
SHA1 57fad1ac85824934205644a843631012b8ab14f7
SHA512 6c8abd8be08e9936d299bfe5a1c6accbc50dc2b592288e564aa330bc5e34572a8545683f2bfe7301e09c4d294d7a815e7fb2d069081879c177901b86ca3d70bc
TLSH
T192E0203812FB411DF5E4D53587C5B431D57DF1251525E27119D55F04B716900FC42A26
MD5 SHA1 SHA512 TLSH

Submit Download

86289DDB9DCDB7A9CB80977D1B95D288

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\86289DDB9DCDB7A9CB80977D1B95D288
Size 242B
SHA256 9efaf93dd9f0086d12f92d324a5e4c50f74f0330b6cf072405f9387e564eaa7b
MD5 01831e0e1985bb57dc8c78fbdf4ec042
SHA1 bf7a586cfef6036c430fe379c54e4b9618de0346
SHA512 bbd5486c681c2e24d85799dd9b5244b8abe87d8f79a3a1897089d1f9fdca84a9b0ab81d7628db3b758a6aff46d63ccd4f4e2770eefb4cd9163923089fe205b5e
TLSH
T108D0C73467785711F19851356EB194823BB69E207A02DB154AA0164C4518F041420B27
MD5 SHA1 SHA512 TLSH

Submit Download

FILES_BACK.txt

Path C:\Users\Admin\FILES_BACK.txt
Size 177B
SHA256 a2a678d59020d212a1ec32810466b9a2bc4d17fcfff8edd6c07c5aa8ef15b25f
MD5 fc605d0a0029f229d0ed645293ece316
SHA1 9ee4a83cd232b15790107ebbb98b4b515839f219
SHA512 2e43a1bbb43f9371cfcdcf550a205bb123a2facf17cbdd180591eb7a7c3ee75b5aae0a59654898814e4dee9d7bdf4ff3f6b50a37f0fbd5252865a23655b261e1
TLSH
T1B3C0C00C7F792400330192C8A0199F059D1FB500D15120D00F10500C3DFD7E4C4902D3
MD5 SHA1 SHA512 TLSH

Submit Download

conlhost.exe

Path C:\Users\Public\conlhost.exe
Size 388KB
SHA256 fe45133c19334d4eed3a22730d83266436641d6672cf3e1dfd326a61a525f2d4
MD5 f7f77cc88ac13316d7fe4777465736cf
SHA1 ee81df83ccc7b44d5941f25e7d7d594b0dd85424
SHA512 2a14b5aadae3780203df6f4e9cc85235652aa347fa6ad00782d151bdf0388689d17d5987abfc63a1bbe7aa22fe3e881352ac7795d5afb330df2c01483fad8ba1
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oHVCvv+:/uTs1gBpQL5kmh0671o1Ce
TLSH
T1BB841926714198A6DD7268791A65BBFEAA2DB8704B940FF7F7C24AA404F03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del.bat

Path C:\users\Public\del.bat
Size 148B
SHA256 cd1fa4496c961480682f54b6a59bd87b80e2851461454fa7dc6e22a25fd6935d
MD5 917ca9201f30f6456e74c4c8e6a55508
SHA1 2ae608080ced8b26500e3598e1a7b0c7bc32eecc
SHA512 595100476ee41ce8fdbfc51b18b320eff5c94d85195d107699d16a62b928d366cc80072d0de6fffb9ac4560155112de3508c883e5d406d8209312c0ea4394cd2
TLSH
T193C02BD1C2D9C6004A8E400A43FDBA00D4FD8CCF13401950213F03C4078BADC90F480F
MD5 SHA1 SHA512 TLSH

Submit Download

time.e

Path C:\users\Public\time.e
Size 16B
SHA256 15dc97aa4baf3ae870884bee355b7014de5a11145b9032b03f5503125dde36e7
MD5 89ed5b494815ffef8815febb95b30489
SHA1 98f807aa847100871d460ce00140d49cffa0aeb3
SHA512 0f7412e156e98c0bdf260d7c3aaf5adec353c3bfe48f9a7a8a2023ee2fda2bc2bebd9396d4df4e7069827092506a538f191e14d08980fbe0b7ba9670cb2b6400
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads