seven | 49bb9fde1c318dda2162e58df269ad08640b64e80734d9a68d5d1f325312316c

General

Target
2026-07-28_246e964a71e80893e229c4c0aff65860_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
Size 388KB
Sample260728-3ddfbsce46
SHA256 49bb9fde1c318dda2162e58df269ad08640b64e80734d9a68d5d1f325312316c
MD5 246e964a71e80893e229c4c0aff65860
SHA1 78a740971973be8953b5612a084c6cde01e4f163
SHA512 55f3aa83914874a6dca56989037e7f88936d80f39b8d62e9a66eb8b36aaa488c1f8cd71bdfacca81d2772984e21f7c69b6d211bae7740f082c03fc33e1ca508c
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oHVCvv9:/uTs1gBpQL5kmh0671o1Cd
TLSH
T139841926714198A6DD7268791A65BBFEAA2DB8704B940FF7F7C24AA404F03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution seven persistence ransomware spyware trojan

Malware Config

Signatures

Family: Seven, SevenCrypt, 7ev3n
Seven aka SevenCrypt or 7ev3n is a ransomware.
ransomware seven

Detects Seven ransomware 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4df-4.dat	family_seven

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4df-4.dat	UPX

Executes dropped EXE 2 IoCs

pid	Process
5704	conlhost.exe
2956	conlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\allkeeper = "C:\\users\\Public\\conlhost.exe"	REG.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1044	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_246e964a71e80893e229c4c0aff65860_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	conlhost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c000000010000000400000000080000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	conlhost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 5704	3676	2026-07-28_246e964a71e80893e229c4c0aff65860_7ev3n_coinminer_elex_hawkeye_mespinoza.exe	88
PID 5704 wrote to memory of 1044	5704	conlhost.exe	89
PID 5704 wrote to memory of 5988	5704	conlhost.exe	91
PID 5704 wrote to memory of 3140	5704	conlhost.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-07-28_246e964a71e80893e229c4c0aff65860_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_246e964a71e80893e229c4c0aff65860_7ev3n_coinminer_elex_hawkeye_mespinoza.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3676
- C:\users\Public\conlhost.exe
  "C:\users\Public\conlhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:5704
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\users\Public\del.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1044
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "allkeeper" /t REG_SZ /d "C:\users\Public\conlhost.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:5988
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE" /v "crypted" /t REG_SZ /d "1" /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3140

C:\users\Public\conlhost.exe
C:\users\Public\conlhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 471B
SHA256 f779ee3f8e63c3ba55fddce84e8178eb6545d6607f90ba46f15e71e8f581fa1e
MD5 bc9cca71447b588aa5133d2dad2c664c
SHA1 e7d898d3ba53fbb6b7f3b082688e148642c99599
SHA512 5718ebef6be013553d161f60e763a42a98cf5dba295fb87ea84e2a258966b012e7380c47c47dde1637f0069a5cb9c1f34759e48072a29dbe41645862cf1a0448
TLSH
T154F0540308A318F04A0F1AD80FF68C343657804538F543F4BD7C046219723D72D0C880
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 471B
SHA256 3cf2c3d620e62621145edb85e73cb73d6101acf5743c3a8ba3fd456c491343fe
MD5 8d8eaeb8d1bf326cdf88df7311b2bf10
SHA1 ac9e2c90f5f46f82829056cf660661f0ec077293
SHA512 37d52110bf26e7adbb92acde893d1b6b37f027567d8d4b341293e665a550ec7ce0019ac3b66772a68e87703b97c2413bc7fbd0aec2d689efd35c4cfadd328117
TLSH
T13BF0DCD2843EECD27F4252C81AFA993BB120DCA446E0A4AA643CC5B22C6003D6F6B435
MD5 SHA1 SHA512 TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 402B
SHA256 3bceef11bc5fc73c0f1fa09c12f453c8ea5a61b01ddc91b62cc978e0ff19ccd0
MD5 74ecb57b39ece7829185408a062d6a4d
SHA1 ee9a558ac494a6d4a5bc47b4d520b567963598ae
SHA512 c12efd3db537c6b328f9dad54d7b6a7d59c3e0082d60f7d8da016e792cf9539bd7cfa54e755a1498ef2d17af81be9ddc18e144d97041f3b4b56dd91355622e01
TLSH
T142E0C02015F9013CF1B0D9700FC655624467F0015D14832A27940209AB07600DC72D34
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 420B
SHA256 956e3dcf8af4bab8b30ff30a6d74d345e45e46cbfb9117af3b6b2b8b62689f8f
MD5 71bbf9393df2734e052f0fff4a9a3b3c
SHA1 6b7c7ca94f097035eaa88f349e4fb79d1d66010c
SHA512 c941aaae9bf1d8d29a07f56bf310b70947cca9eeb74178dd77f42f786ccde04886558d30b94f6a5d80934cd3d8b4a97a6b7256215d3df7087a3eaeb46e29d77e
TLSH
T129E0C03812FB411CF4F4D03587C57031D47EF0251515E27029D95F04B717A00FC42E26
MD5 SHA1 SHA512 TLSH

Submit Download

FILES_BACK.txt

Path C:\Users\Admin\FILES_BACK.txt
Size 177B
SHA256 a2a678d59020d212a1ec32810466b9a2bc4d17fcfff8edd6c07c5aa8ef15b25f
MD5 fc605d0a0029f229d0ed645293ece316
SHA1 9ee4a83cd232b15790107ebbb98b4b515839f219
SHA512 2e43a1bbb43f9371cfcdcf550a205bb123a2facf17cbdd180591eb7a7c3ee75b5aae0a59654898814e4dee9d7bdf4ff3f6b50a37f0fbd5252865a23655b261e1
TLSH
T1B3C0C00C7F792400330192C8A0199F059D1FB500D15120D00F10500C3DFD7E4C4902D3
MD5 SHA1 SHA512 TLSH

Submit Download

conlhost.exe

Path C:\Users\Public\conlhost.exe
Size 388KB
SHA256 73b8955124b9d54991201f0b461cd51991bf9a43000a1628f067a0885f6e2b2a
MD5 c4f6a9887375efb6e01999fc73cbe5ca
SHA1 71e6479d199edd99689b4eebbaee5bb1376f487b
SHA512 5f550af103b669e95be99c31c0101a912e5b4b8f62f6d4d953c698b8008dd71d197f295df798dfa5198f9caa0d89c48416da9cd9407d734a1c5417a5c7ac623d
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oHVCvvb:/uTs1gBpQL5kmh0671o1C7
TLSH
T101841926714198A6DD7268791A65BBFEAA2DB8704B940FF7F7C24AA404F03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del.bat

Path C:\users\Public\del.bat
Size 148B
SHA256 5afff47c8004b2bfa3cbfcf9355a557e8c1136a5cf532ce7366b5877c8030b44
MD5 158382c2dc4c4338d905715286aa36dc
SHA1 bbbcda1c59e3e3033590815fb209d632e2de3d8f
SHA512 23b28d70b5cad7ba37f199d5649646e14abee6287da484b81b73a77a7aea1e7aac04435a391babbd6d84860742ed1ded52bf81681a43ce3bbd9c16ff261a37f4
TLSH
T1F6C02B41E392E560678B711703BAAE00C8CE48AE09001E40453B0DC81B8709899B8D09
MD5 SHA1 SHA512 TLSH

Submit Download

time.e

Path C:\users\Public\time.e
Size 16B
SHA256 9eb75761dde3d27badd6bd92e05c10a8d3c86841fd49bda55a9e52443d8cb196
MD5 7673ab1f369445639fb024c48c0ba61f
SHA1 856ed770087565818d68b5e9b06b25fd4681f2ef
SHA512 379cf7366c0ca9f7d53f39f59630228a33768ecd1a5f8839b66218ebb1a98a1243c18bc282d2f8ba41d0152614410c2db7dcb58d6f81e40acd6c5d39ff67dd0e
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads