seven | 286ec32e528cc9efb41bb955e7bd567f86e2496d0eddbb5d85a40a25c51746da

General

Target
2026-07-28_f3514c1e69d0ee487af164344fc1a183_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
Size 388KB
Sample260728-t7kbasac62
SHA256 286ec32e528cc9efb41bb955e7bd567f86e2496d0eddbb5d85a40a25c51746da
MD5 f3514c1e69d0ee487af164344fc1a183
SHA1 4fa3cd3685961736a9b9999d0eb33a4936bf523c
SHA512 32dba620d3c48f9566d4347ecdd5614511bf42a37aa0ba00019b377445020b0b7a65a09f8998a6ccb88ff33767df05141bc3667645948810d549a2a3637a9f9e
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oHVCvvF:/uTs1gBpQL5kmh0671o1Cl
TLSH
T1D1841926714198A6DD7268791A65BBFEAA2DB8704B940FF7F7C24AA404F03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution seven persistence ransomware spyware trojan

Malware Config

Signatures

Family: Seven, SevenCrypt, 7ev3n
Seven aka SevenCrypt or 7ev3n is a ransomware.
ransomware seven

Detects Seven ransomware 1 IoCs

resource	yara_rule
behavioral2/files/0x000a00000001b922-4.dat	family_seven

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000a00000001b922-4.dat	UPX

Executes dropped EXE 2 IoCs

pid	Process
4112	conlhost.exe
3100	conlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\allkeeper = "C:\\users\\Public\\conlhost.exe"	REG.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3664	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_f3514c1e69d0ee487af164344fc1a183_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	conlhost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c000000010000000400000000080000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	conlhost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5592 wrote to memory of 4112	5592	2026-07-28_f3514c1e69d0ee487af164344fc1a183_7ev3n_coinminer_elex_hawkeye_mespinoza.exe	89
PID 4112 wrote to memory of 3664	4112	conlhost.exe	90
PID 4112 wrote to memory of 4980	4112	conlhost.exe	92
PID 4112 wrote to memory of 3332	4112	conlhost.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-07-28_f3514c1e69d0ee487af164344fc1a183_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_f3514c1e69d0ee487af164344fc1a183_7ev3n_coinminer_elex_hawkeye_mespinoza.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5592
- C:\users\Public\conlhost.exe
  "C:\users\Public\conlhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\users\Public\del.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3664
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "allkeeper" /t REG_SZ /d "C:\users\Public\conlhost.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4980
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE" /v "crypted" /t REG_SZ /d "1" /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3332

C:\users\Public\conlhost.exe
C:\users\Public\conlhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FILES_BACK.txt

Path C:\Users\Admin\FILES_BACK.txt
Size 177B
SHA256 a2a678d59020d212a1ec32810466b9a2bc4d17fcfff8edd6c07c5aa8ef15b25f
MD5 fc605d0a0029f229d0ed645293ece316
SHA1 9ee4a83cd232b15790107ebbb98b4b515839f219
SHA512 2e43a1bbb43f9371cfcdcf550a205bb123a2facf17cbdd180591eb7a7c3ee75b5aae0a59654898814e4dee9d7bdf4ff3f6b50a37f0fbd5252865a23655b261e1
TLSH
T1B3C0C00C7F792400330192C8A0199F059D1FB500D15120D00F10500C3DFD7E4C4902D3
MD5 SHA1 SHA512 TLSH

Submit Download

conlhost.exe

Path C:\Users\Public\conlhost.exe
Size 388KB
SHA256 e7aa69370623d3cea2c07aa2531c94f47440da6d84c804e6e3cc8bfacb412041
MD5 fa00c79af2ea2196e52b796233fe0dc8
SHA1 450b1b03aac8cd11c29bdf446cb70feadc4a0192
SHA512 ecfffcc61ef9f5893cc3e56361ac4fc857199ab0bd34c50b277235d1bce508f3cae4ea3db62b3c71391ade9a492aa40db889501e8742dbf18d3a22c273e08632
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oHVCvvD:/uTs1gBpQL5kmh0671o1Cj
TLSH
T19B841926714198A6DD7268791A65BBFEAA2DB8704B940FF7F7C24AA404F03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del.bat

Path C:\users\Public\del.bat
Size 148B
SHA256 56654620fa0a41fe50a35132195a9367d33a4d9c87784b1cbef096c27c2d0180
MD5 20a902a837f07216b694767d4d9df3eb
SHA1 ced1f9332408713fd464b65119733139a68088b9
SHA512 d934d99a3d41ed2f20fcdb0a912681d386123df153c4ad75baf84f7301230408afc15d6ca6f3355da69b78fcde11cfc313b631664c4b82f4aec47216d32f48cd
TLSH
T1E8C02BD393A2DA54104A190623BD6640D5CE0CDF1304EB00023B44C41683088757880A
MD5 SHA1 SHA512 TLSH

Submit Download

time.e

Path C:\users\Public\time.e
Size 16B
SHA256 a22148641f5dd2356e491519ee8946a1aaea5ee7f1458261c44e7f2c4b561ab4
MD5 afe7f227de8c8756060c72e42eabc867
SHA1 1ca1ac7416da591f834a98364fe6353f050a9975
SHA512 99f0206b1b6b6486172591a35a56fef9263b6ce1358c87b917ba6c8f76c8798d326e0812034fb389a14944965530ae77b845229428edfbec287ffc8193395160
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads