seven | d5cf7191901a6ef3c6615abc9f5c31974a21ff703a07e8aea0297be62d6f9816

General

Target
2026-07-28_aa966fc3bdf3ff6f7efac13ad82f3bbd_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
Size 388KB
Sample260728-w11qtaba47
SHA256 d5cf7191901a6ef3c6615abc9f5c31974a21ff703a07e8aea0297be62d6f9816
MD5 aa966fc3bdf3ff6f7efac13ad82f3bbd
SHA1 68e824cd0d950ec0c18ee26adebab25c977d2ac0
SHA512 182573d132b5d79f84fb3836c1688a38c08afb579054aff91b0b70bcdf51500f3f1c2f2fb71e8826ae39662088f3ea6afbbd0d065e8470524dfafe44e93e5717
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oHVCvv+:/uTs1gBpQL5kmh0671o1Ce
TLSH
T178841926714198A6DD7268791A65BBFEAA2DB8704B940FF7F7C24AA404F03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution seven persistence ransomware spyware trojan

Malware Config

Signatures

Family: Seven, SevenCrypt, 7ev3n
Seven aka SevenCrypt or 7ev3n is a ransomware.
ransomware seven

Detects Seven ransomware 1 IoCs

resource	yara_rule
behavioral2/files/0x001100000001c4fd-4.dat	family_seven

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x001100000001c4fd-4.dat	UPX

Executes dropped EXE 2 IoCs

pid	Process
468	conlhost.exe
4372	conlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\allkeeper = "C:\\users\\Public\\conlhost.exe"	REG.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1368	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_aa966fc3bdf3ff6f7efac13ad82f3bbd_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	conlhost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c000000010000000400000000080000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	conlhost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 468	5856	2026-07-28_aa966fc3bdf3ff6f7efac13ad82f3bbd_7ev3n_coinminer_elex_hawkeye_mespinoza.exe	89
PID 468 wrote to memory of 1368	468	conlhost.exe	90
PID 468 wrote to memory of 4508	468	conlhost.exe	92
PID 468 wrote to memory of 1684	468	conlhost.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-07-28_aa966fc3bdf3ff6f7efac13ad82f3bbd_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_aa966fc3bdf3ff6f7efac13ad82f3bbd_7ev3n_coinminer_elex_hawkeye_mespinoza.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5856
- C:\users\Public\conlhost.exe
  "C:\users\Public\conlhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\users\Public\del.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1368
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "allkeeper" /t REG_SZ /d "C:\users\Public\conlhost.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4508
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE" /v "crypted" /t REG_SZ /d "1" /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1684

C:\users\Public\conlhost.exe
C:\users\Public\conlhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:4372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 471B
SHA256 f779ee3f8e63c3ba55fddce84e8178eb6545d6607f90ba46f15e71e8f581fa1e
MD5 bc9cca71447b588aa5133d2dad2c664c
SHA1 e7d898d3ba53fbb6b7f3b082688e148642c99599
SHA512 5718ebef6be013553d161f60e763a42a98cf5dba295fb87ea84e2a258966b012e7380c47c47dde1637f0069a5cb9c1f34759e48072a29dbe41645862cf1a0448
TLSH
T154F0540308A318F04A0F1AD80FF68C343657804538F543F4BD7C046219723D72D0C880
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 471B
SHA256 3cf2c3d620e62621145edb85e73cb73d6101acf5743c3a8ba3fd456c491343fe
MD5 8d8eaeb8d1bf326cdf88df7311b2bf10
SHA1 ac9e2c90f5f46f82829056cf660661f0ec077293
SHA512 37d52110bf26e7adbb92acde893d1b6b37f027567d8d4b341293e665a550ec7ce0019ac3b66772a68e87703b97c2413bc7fbd0aec2d689efd35c4cfadd328117
TLSH
T13BF0DCD2843EECD27F4252C81AFA993BB120DCA446E0A4AA643CC5B22C6003D6F6B435
MD5 SHA1 SHA512 TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 402B
SHA256 39d9706f6f2900543805669ccbd748eec6b8f5465136046e1f719b7df738d185
MD5 68001f634ce6b9047136e3c497c55916
SHA1 37d19c0b668dd872881c7e4c02b4998ff939d311
SHA512 1b4116605b9d06336996d728c68be20170bed9d7056250a379692f4ba1715abcebbd7ffd30dcb648d7ba801742df4bceb6d4dd34958b4c181236805d5a62bf93
TLSH
T148E0C02015F9013CF2B0D9700FC6A5670467F1011C2483392B94020DAB07600EDB2D31
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 420B
SHA256 4d53f398c380de14c5c23edef785e5ee0cb3ca1fd21e9ee727a8dc829863d85b
MD5 8c3052e797ff9558984057556a6f526d
SHA1 056e26bc06052f8779ad7905fd45e670911875e3
SHA512 e2a0afe982c347b5b91cf9d0d0e172261feed13a93cf4e9520571cd5e1570392e7d6178891a7fd1ad4f342ee0b95b267bde9cc11d57fda15322194bab9e6a901
TLSH
T16FE0C03812FB421CF4E4D535C7C4B03191BDF0251515E1701AD5AF04B726900FC42B22
MD5 SHA1 SHA512 TLSH

Submit Download

FILES_BACK.txt

Path C:\Users\Admin\FILES_BACK.txt
Size 177B
SHA256 a2a678d59020d212a1ec32810466b9a2bc4d17fcfff8edd6c07c5aa8ef15b25f
MD5 fc605d0a0029f229d0ed645293ece316
SHA1 9ee4a83cd232b15790107ebbb98b4b515839f219
SHA512 2e43a1bbb43f9371cfcdcf550a205bb123a2facf17cbdd180591eb7a7c3ee75b5aae0a59654898814e4dee9d7bdf4ff3f6b50a37f0fbd5252865a23655b261e1
TLSH
T1B3C0C00C7F792400330192C8A0199F059D1FB500D15120D00F10500C3DFD7E4C4902D3
MD5 SHA1 SHA512 TLSH

Submit Download

conlhost.exe

Path C:\Users\Public\conlhost.exe
Size 388KB
SHA256 d2752e78df01ad603f8d4760f5f4921a2fec714c62dc94a70f26caa0d91cde33
MD5 17c287b3964606c03f2dc6464c3fe7ac
SHA1 d9f150fb5ff3e50b4d87fbb3472b7d4beaa16b6a
SHA512 14c3a3198a203d72b0692a883c59d740ef960d28655a7be1ff7295ceef438009d7a047b728731ea3bdade798f8e97caf60ea242b5432fc6caa5ae698f1d00192
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oHVCvvW:/uTs1gBpQL5kmh0671o1C2
TLSH
T1B9841926714198A6DD7268791A65BBFEAA2DB8704B940FF7F7C24AA404F03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del.bat

Path C:\users\Public\del.bat
Size 148B
SHA256 bd8d376910dfd627eda70baa3e47b4df84ac286f299a3b0cba131338d72636ca
MD5 9f8d02dda11d127c47758c5d82dd25a5
SHA1 d4f0b21c3e881feafe910433e936f570d5d84b4e
SHA512 12794076e35b706a8c73109663455c65135de655cab2118379b48188d00e0d7fd8b729ea35c9ab527dde8a0b3a18c91f64afbda3a0575817009697afc1d63146
TLSH
T151C02B829396DB44089D000AC3FD7604D0ED0C8F0A0C1A10323F44C0D7470EFA871846
MD5 SHA1 SHA512 TLSH

Submit Download

time.e

Path C:\users\Public\time.e
Size 16B
SHA256 7980f6a8ffa7bf414191056f9c0a8715ab720193fae1e42f616ebda71e1829a6
MD5 8268570dd3bac71d902388d6ebc3c33c
SHA1 4037e8dcd4ee0c90a7a7e6b632f380cd6e855c1f
SHA512 3c406ff5e04f1b8c9b4eb1612e8d87d9ff3b1fa987419112d8ebd5eab57e48e2a86eaddb651ff3303c5987963e4657d5c5270382b1c172a269d33ca5675778d8
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads