seven | 49bb9fde1c318dda2162e58df269ad08640b64e80734d9a68d5d1f325312316c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_246e964a71e80893e229c4c0aff65860_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
Size 388KB
Sample260728-3ddfbsce46
SHA256 49bb9fde1c318dda2162e58df269ad08640b64e80734d9a68d5d1f325312316c
MD5 246e964a71e80893e229c4c0aff65860
SHA1 78a740971973be8953b5612a084c6cde01e4f163
SHA512 55f3aa83914874a6dca56989037e7f88936d80f39b8d62e9a66eb8b36aaa488c1f8cd71bdfacca81d2772984e21f7c69b6d211bae7740f082c03fc33e1ca508c
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oHVCvv9:/uTs1gBpQL5kmh0671o1Cd
TLSH
T139841926714198A6DD7268791A65BBFEAA2DB8704B940FF7F7C24AA404F03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution seven persistence ransomware

Malware Config

Signatures

Family: Seven, SevenCrypt, 7ev3n
Seven aka SevenCrypt or 7ev3n is a ransomware.
ransomware seven

Detects Seven ransomware 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024468-5.dat	family_seven

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024468-5.dat	UPX

Executes dropped EXE 2 IoCs

pid	Process
4472	conlhost.exe
4544	conlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\allkeeper = "C:\\users\\Public\\conlhost.exe"	REG.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3612	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_246e964a71e80893e229c4c0aff65860_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 4472	1744	2026-07-28_246e964a71e80893e229c4c0aff65860_7ev3n_coinminer_elex_hawkeye_mespinoza.exe	86
PID 4472 wrote to memory of 3612	4472	conlhost.exe	87
PID 4472 wrote to memory of 1336	4472	conlhost.exe	91
PID 4472 wrote to memory of 1752	4472	conlhost.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-07-28_246e964a71e80893e229c4c0aff65860_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_246e964a71e80893e229c4c0aff65860_7ev3n_coinminer_elex_hawkeye_mespinoza.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1744
- C:\users\Public\conlhost.exe
  "C:\users\Public\conlhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\users\Public\del.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3612
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "allkeeper" /t REG_SZ /d "C:\users\Public\conlhost.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1336
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE" /v "crypted" /t REG_SZ /d "1" /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1752

C:\users\Public\conlhost.exe
C:\users\Public\conlhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 471B
SHA256 f779ee3f8e63c3ba55fddce84e8178eb6545d6607f90ba46f15e71e8f581fa1e
MD5 bc9cca71447b588aa5133d2dad2c664c
SHA1 e7d898d3ba53fbb6b7f3b082688e148642c99599
SHA512 5718ebef6be013553d161f60e763a42a98cf5dba295fb87ea84e2a258966b012e7380c47c47dde1637f0069a5cb9c1f34759e48072a29dbe41645862cf1a0448
TLSH
T154F0540308A318F04A0F1AD80FF68C343657804538F543F4BD7C046219723D72D0C880
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 471B
SHA256 3cf2c3d620e62621145edb85e73cb73d6101acf5743c3a8ba3fd456c491343fe
MD5 8d8eaeb8d1bf326cdf88df7311b2bf10
SHA1 ac9e2c90f5f46f82829056cf660661f0ec077293
SHA512 37d52110bf26e7adbb92acde893d1b6b37f027567d8d4b341293e665a550ec7ce0019ac3b66772a68e87703b97c2413bc7fbd0aec2d689efd35c4cfadd328117
TLSH
T13BF0DCD2843EECD27F4252C81AFA993BB120DCA446E0A4AA643CC5B22C6003D6F6B435
MD5 SHA1 SHA512 TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 402B
SHA256 69905ac670fef6892dd9260679d38568e3f1d473b119dd09d579d9ae12750877
MD5 1455445e1e3421c5aead7c23ae0bd99c
SHA1 e041fc74017213c4499130288fb8a8c66f91ecb8
SHA512 04fb25a7c402b6121a7e3dae587fff079309c1ec101f97bdef14dec4f8c53324b3fa3e5bbad9103aef946671bd9a6f3df512fafd5133b636417d3475024df64b
TLSH
T1B4E07D241AFE027CF1B1EA740BCA9572406BE1011D64927D15D45709B703600DCB2D35
MD5 SHA1 SHA512 TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 402B
SHA256 683e7b94d2834d7da5e2b0a77377612c47c41927ccd3ae5ca04678c4e498032d
MD5 ef2ecf6579cf46df4b87c54f51f0860a
SHA1 425e5fd9ed6781ef3f0a59c63260aa219e60edc2
SHA512 52c1a310bd306ddd6d4245a353f904d4850db2583b7a37debb09c4d6cbe05a448a4f6c30f23b47a3fae2d7b17804cc4c43c23a22afdd74606a318a2ca95a999e
TLSH
T151E07D2015FE02BCF1B1EAB40BC69572406BE1011D24D27D11C0470EB703500DCF2D36
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 420B
SHA256 ebd7a3f0294ef3d3ace1d7cb699e4dbe597d7676904467529554477d5d1437be
MD5 b52c35fd124c2109346a268bbdfca5fb
SHA1 de0f346d076f819c2a24c288afa6279b66947970
SHA512 3a48fc765bcd44478e5ea07a0abaf805e1dcdd31b71591cc9174cc16f833f8853f3595d3924465302ee0a1b1b774e3e84f27835a81816c8c6a7cd4c93928fea8
TLSH
T1E3E0C03812FB411CF4E4D03587C97031D57DF1251515E27019D55F04B717900FC42A22
MD5 SHA1 SHA512 TLSH

Submit Download

FILES_BACK.txt

Path C:\Users\Admin\FILES_BACK.txt
Size 177B
SHA256 a2a678d59020d212a1ec32810466b9a2bc4d17fcfff8edd6c07c5aa8ef15b25f
MD5 fc605d0a0029f229d0ed645293ece316
SHA1 9ee4a83cd232b15790107ebbb98b4b515839f219
SHA512 2e43a1bbb43f9371cfcdcf550a205bb123a2facf17cbdd180591eb7a7c3ee75b5aae0a59654898814e4dee9d7bdf4ff3f6b50a37f0fbd5252865a23655b261e1
TLSH
T1B3C0C00C7F792400330192C8A0199F059D1FB500D15120D00F10500C3DFD7E4C4902D3
MD5 SHA1 SHA512 TLSH

Submit Download

conlhost.exe

Path C:\Users\Public\conlhost.exe
Size 388KB
SHA256 baa2fd67c64243f32f32a3eddd73fb688402efa91c797f92ac22489affbcf5c3
MD5 10192ab559d27ffe43f9bc2802df84ef
SHA1 2d62ce18da1a8f5ab27e8470906f8791fdcf00d4
SHA512 e67962b51293a0df84f3fbfc80b66ad99c3894d5cf89f3d79c1470d7ac673f23c4c9afb598cf32d672c37fcf7a08cc3dbadbd732846f30df54b13a4f45d137b7
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oHVCvvt:/uTs1gBpQL5kmh0671o1CN
TLSH
T17D841926714198A6DD7268791A65BBFEAA2DB8704B940FF7F7C24AA404F03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del.bat

Path C:\users\Public\del.bat
Size 148B
SHA256 5afff47c8004b2bfa3cbfcf9355a557e8c1136a5cf532ce7366b5877c8030b44
MD5 158382c2dc4c4338d905715286aa36dc
SHA1 bbbcda1c59e3e3033590815fb209d632e2de3d8f
SHA512 23b28d70b5cad7ba37f199d5649646e14abee6287da484b81b73a77a7aea1e7aac04435a391babbd6d84860742ed1ded52bf81681a43ce3bbd9c16ff261a37f4
TLSH
T1F6C02B41E392E560678B711703BAAE00C8CE48AE09001E40453B0DC81B8709899B8D09
MD5 SHA1 SHA512 TLSH

Submit Download

time.e

Path C:\users\Public\time.e
Size 16B
SHA256 9eb75761dde3d27badd6bd92e05c10a8d3c86841fd49bda55a9e52443d8cb196
MD5 7673ab1f369445639fb024c48c0ba61f
SHA1 856ed770087565818d68b5e9b06b25fd4681f2ef
SHA512 379cf7366c0ca9f7d53f39f59630228a33768ecd1a5f8839b66218ebb1a98a1243c18bc282d2f8ba41d0152614410c2db7dcb58d6f81e40acd6c5d39ff67dd0e
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads