seven | cbffe6eaaf507bb95351400107a580e075ebbb97ad52720d6b9e58d11f5fd1c7

General

Target
2026-07-28_6459739639bfc0472f8d25641c668d57_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
Size 388KB
Sample260728-2t2bnabl8t
SHA256 cbffe6eaaf507bb95351400107a580e075ebbb97ad52720d6b9e58d11f5fd1c7
MD5 6459739639bfc0472f8d25641c668d57
SHA1 7d858c8763cdaae379ee7e831b21f7f8acea613d
SHA512 09c8889ee77f8ff6bedbb4b58f91b1b1cc8adc505ee584e1df6f44001893e135913547435ef1495e3fa98ef7cc04c62f98811f9e637d8bb0bb0823c34201025a
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oHVCvva:/uTs1gBpQL5kmh0671o1C6
TLSH
T123841926714198A6DD7268791A65BBFEAA2DB8704B940FF7F7C24AA404F03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution seven persistence ransomware spyware trojan

Malware Config

Signatures

Family: Seven, SevenCrypt, 7ev3n
Seven aka SevenCrypt or 7ev3n is a ransomware.
ransomware seven

Detects Seven ransomware 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c569-4.dat	family_seven

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c569-4.dat	UPX

Executes dropped EXE 2 IoCs

pid	Process
2368	conlhost.exe
5948	conlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\allkeeper = "C:\\users\\Public\\conlhost.exe"	REG.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6164	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_6459739639bfc0472f8d25641c668d57_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	conlhost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c000000010000000400000000080000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	conlhost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5452 wrote to memory of 2368	5452	2026-07-28_6459739639bfc0472f8d25641c668d57_7ev3n_coinminer_elex_hawkeye_mespinoza.exe	90
PID 2368 wrote to memory of 6164	2368	conlhost.exe	91
PID 2368 wrote to memory of 3824	2368	conlhost.exe	94
PID 2368 wrote to memory of 5984	2368	conlhost.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-07-28_6459739639bfc0472f8d25641c668d57_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_6459739639bfc0472f8d25641c668d57_7ev3n_coinminer_elex_hawkeye_mespinoza.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5452
- C:\users\Public\conlhost.exe
  "C:\users\Public\conlhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\users\Public\del.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:6164
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "allkeeper" /t REG_SZ /d "C:\users\Public\conlhost.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3824
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE" /v "crypted" /t REG_SZ /d "1" /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5984

C:\users\Public\conlhost.exe
C:\users\Public\conlhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:5948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 471B
SHA256 f779ee3f8e63c3ba55fddce84e8178eb6545d6607f90ba46f15e71e8f581fa1e
MD5 bc9cca71447b588aa5133d2dad2c664c
SHA1 e7d898d3ba53fbb6b7f3b082688e148642c99599
SHA512 5718ebef6be013553d161f60e763a42a98cf5dba295fb87ea84e2a258966b012e7380c47c47dde1637f0069a5cb9c1f34759e48072a29dbe41645862cf1a0448
TLSH
T154F0540308A318F04A0F1AD80FF68C343657804538F543F4BD7C046219723D72D0C880
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 471B
SHA256 3cf2c3d620e62621145edb85e73cb73d6101acf5743c3a8ba3fd456c491343fe
MD5 8d8eaeb8d1bf326cdf88df7311b2bf10
SHA1 ac9e2c90f5f46f82829056cf660661f0ec077293
SHA512 37d52110bf26e7adbb92acde893d1b6b37f027567d8d4b341293e665a550ec7ce0019ac3b66772a68e87703b97c2413bc7fbd0aec2d689efd35c4cfadd328117
TLSH
T13BF0DCD2843EECD27F4252C81AFA993BB120DCA446E0A4AA643CC5B22C6003D6F6B435
MD5 SHA1 SHA512 TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 402B
SHA256 636a383003779ff43a2409399bb839ad887da9538645faf6237fea69c8778755
MD5 a54aedf94c71fe4109512cac37101d93
SHA1 087179e78249c184e1b83699d8ff58e5fb24eb2e
SHA512 416d8ee58bb88a2ccba44f51308f345bc16aebcb990b39708b1865db6e402d57fc71fdd49fd72f8f76d3f765c280857f0e438e56c8df073166563072b3abb2b4
TLSH
T16EE0C62025FA027CF2B0EA700FC6A9A304ABF1025C28832A1B98021DEB07600DCB2D30
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 420B
SHA256 eb3661fb4c823215c6fa8064194aa0e6672a738447e51fe21ce82a1a8a6574fb
MD5 3470a728f04d2e0d51c92ade85ae1d34
SHA1 d9e7f0255c8104270b4e2c2fb30e43ca72e54ed4
SHA512 a0ee0f30d7e7ed85b3fe862cfd5235bc194b6fe7195195ddeca7411ef805a8a1de989a155640015949989b604293ffe09f169754d54cfc3c9038068ca99c6af9
TLSH
T1E4E0D83812FB412DE9E4D53587D5B431957DF1651515F27019D55B04F726900EC43A26
MD5 SHA1 SHA512 TLSH

Submit Download

FILES_BACK.txt

Path C:\Users\Admin\FILES_BACK.txt
Size 177B
SHA256 a2a678d59020d212a1ec32810466b9a2bc4d17fcfff8edd6c07c5aa8ef15b25f
MD5 fc605d0a0029f229d0ed645293ece316
SHA1 9ee4a83cd232b15790107ebbb98b4b515839f219
SHA512 2e43a1bbb43f9371cfcdcf550a205bb123a2facf17cbdd180591eb7a7c3ee75b5aae0a59654898814e4dee9d7bdf4ff3f6b50a37f0fbd5252865a23655b261e1
TLSH
T1B3C0C00C7F792400330192C8A0199F059D1FB500D15120D00F10500C3DFD7E4C4902D3
MD5 SHA1 SHA512 TLSH

Submit Download

conlhost.exe

Path C:\Users\Public\conlhost.exe
Size 388KB
SHA256 dbb4ac1eae33afafce70a2f4746ad4123bd71bb963ca30b2bcbbec8c2f625bf4
MD5 5adf1b6f8256a5b3d676e6bfc3aa757b
SHA1 5fc98cb3afffa2d229ac7fee5587bfae90aa2de7
SHA512 ccd7d27932187fb815471eeefbd4444667af28704c6c903a4e2c5c5a99503aa30891cfc8ab7a1082af270118945a8dd79b5a47b79b99d1bc7094bdca651f3b3c
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oHVCvvd:/uTs1gBpQL5kmh0671o1C9
TLSH
T1EE841926714198A6DD7268791A65BBFEAA2DB8704B940FF7F7C24AA404F03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del.bat

Path C:\users\Public\del.bat
Size 148B
SHA256 5bfde80e5bb8f2715bdd9166b5016733164d969b6f0a2ff52dba1dcaa6fa20e5
MD5 d7b607ffa80783bb25daa2d0fb1ada63
SHA1 cbf456544b5f4ca97000ec416a9340173326f81b
SHA512 b0b9cfa8e6cdfc09f77ffa5ea982aa3b282fa67f6f24ce05e2aa0d087921c0d98d8874bad472ba78244c855b0183f5ab88475fa716f205c354c0d9cf7fc29525
TLSH
T16AC02BE286A2FDC20185301503E96204988D288F19001F00163F01C01F47198B170D57
MD5 SHA1 SHA512 TLSH

Submit Download

time.e

Path C:\users\Public\time.e
Size 16B
SHA256 d2feaaab92da7aaa431b52559fc02ea3089e2509bd7720be04a14318bb253484
MD5 7a8cb26045dcf2e917306f8b139b86eb
SHA1 418f7db4ea5d0eb340d1905310a33376ecb2e8f0
SHA512 f094176c48387189cd41c44374881173160c497bff4a94da281b02e780df64a97297b730ed38e7ab72b1aa654afb7f5d56215783cc326ba17714edd3885922cc
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads