seven | 06e01cbb72981f610c92d8b6ed608b63d5c7f1583ef762a6cb57a72435a3a5a0

General

Target
2026-08-08_c63ef2eee4491322e1cc9167f51e0e67_7ev3n_elex_hawkeye_mespinoza.exe
Size 363KB
Sample260808-fehecabg76
SHA256 06e01cbb72981f610c92d8b6ed608b63d5c7f1583ef762a6cb57a72435a3a5a0
MD5 c63ef2eee4491322e1cc9167f51e0e67
SHA1 20990a5f00311e0c19151fd8881b04b3150ac0ae
SHA512 1655e1b930e385ba1d7162fb95aeda3f3686cfefbb22b4e019b0c55ae1315df663f57c3b025a1b09347082cfcbf6244af69f0e18d1bd16c05ed6873536229cc3
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371o7:/uTs1gBpQL5kmh0671o7
TLSH
T158840826B14198E6DD7268791A65BBFEAA2DB4704B940FF7F7C24AA404E03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution seven persistence ransomware

Malware Config

Signatures

Family: Seven, SevenCrypt, 7ev3n
Seven aka SevenCrypt or 7ev3n is a ransomware.
ransomware seven

Detects Seven ransomware 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024557-5.dat	family_seven

Executes dropped EXE 2 IoCs

pid	Process
888	conlhost.exe
3676	conlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\allkeeper = "C:\\users\\Public\\conlhost.exe"	REG.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2404	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_c63ef2eee4491322e1cc9167f51e0e67_7ev3n_elex_hawkeye_mespinoza.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 888	708	2026-08-08_c63ef2eee4491322e1cc9167f51e0e67_7ev3n_elex_hawkeye_mespinoza.exe	86
PID 888 wrote to memory of 2404	888	conlhost.exe	87
PID 888 wrote to memory of 2300	888	conlhost.exe	97
PID 888 wrote to memory of 3408	888	conlhost.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-08_c63ef2eee4491322e1cc9167f51e0e67_7ev3n_elex_hawkeye_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_c63ef2eee4491322e1cc9167f51e0e67_7ev3n_elex_hawkeye_mespinoza.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:708
- C:\users\Public\conlhost.exe
  "C:\users\Public\conlhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:888
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\users\Public\del.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2404
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "allkeeper" /t REG_SZ /d "C:\users\Public\conlhost.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2300
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE" /v "crypted" /t REG_SZ /d "1" /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3408

C:\users\Public\conlhost.exe
C:\users\Public\conlhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 471B
SHA256 e8549ecfdc4641a35f78f536c081e72c38b3fbde86679a810902c4f7090db00a
MD5 e7e41c4e87494fdbacb6c0d8b82c76da
SHA1 5a4642b4e3baa2f03c1534f02b09f9693e3d5c9a
SHA512 470399cb5404462e8ddd1518f5ee7cbe9897ce0484146256e2122a35367a7379b8f96a70bce2557191d0715dd25f597c6a49ea2bf51b42776f05c7b1e5c1c70b
TLSH
T1C1F0DCF68068E0A33743888C76F58E3F3431D12E0AB8484941A5CAB0246463D2347936
MD5 SHA1 SHA512 TLSH

Submit Download

86289DDB9DCDB7A9CB80977D1B95D288

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86289DDB9DCDB7A9CB80977D1B95D288
Size 779B
SHA256 6198e19b9216f82fba952c1262ccc5e0987a93378e94ee6d486c0c2b168fbb71
MD5 38d691a260f32eddc3c38d14564c0008
SHA1 755adc8b7b8a654d1e8ef2169b2bf566a7a9a069
SHA512 494e31294bbc505a3c2dc8a8da2fc7bfe3807e566a342f453e8c4fb64461c80525f065924fcade136edcf13d52bb0c11b81beb24154c7bd6087ff27a278b62b5
TLSH
T1AA01CE55C98D16BBC915EE76D085ED6B4CF27300A2C0A16B439449501433FEA8ED88FB
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 420B
SHA256 fa43552de17033236d3ac9de19d22d89945d672144f513487493187a4be06f9c
MD5 18c7f484cf406d0e565937cbb597705d
SHA1 0b5a9c76f11a2a3eaac3e6d16182d363e81dcac2
SHA512 0c79692bf5e288a402bf631907ead02d5f146ee4bb65cfd1475b55b146038e132e08e7e80cde373690e94f19b3259e80ca48b8e59886ea44474630f3b28215d4
TLSH
T189E0C03812FB411DF4E1E0394BD9B03054A9F1311C16E2B02EC46B04B729D00FC12E21
MD5 SHA1 SHA512 TLSH

Submit Download

86289DDB9DCDB7A9CB80977D1B95D288

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\86289DDB9DCDB7A9CB80977D1B95D288
Size 242B
SHA256 abdea2ec188d2d37e27a133ccfba1b1855841ab068261b6b20897c7fccab5a96
MD5 527406486854e626161bbcc3a5ca56b4
SHA1 e97358e84f671ba82906a52a555eda6ce8ccf876
SHA512 9239edd0bd7168780e6a0365617ec6f60936a9c5964b01febdb3aacba15df53fa3d0fc22b2a0c2e221555477145e758ffd759ff8f486e62a7aee1526c42c6b7f
TLSH
T141D0123067E41715F1B90A7A2FF165C13BA5EE26AA03DF094E62134E452CF504C7092A
MD5 SHA1 SHA512 TLSH

Submit Download

FILES_BACK.txt

Path C:\Users\Admin\FILES_BACK.txt
Size 177B
SHA256 a2a678d59020d212a1ec32810466b9a2bc4d17fcfff8edd6c07c5aa8ef15b25f
MD5 fc605d0a0029f229d0ed645293ece316
SHA1 9ee4a83cd232b15790107ebbb98b4b515839f219
SHA512 2e43a1bbb43f9371cfcdcf550a205bb123a2facf17cbdd180591eb7a7c3ee75b5aae0a59654898814e4dee9d7bdf4ff3f6b50a37f0fbd5252865a23655b261e1
TLSH
T1B3C0C00C7F792400330192C8A0199F059D1FB500D15120D00F10500C3DFD7E4C4902D3
MD5 SHA1 SHA512 TLSH

Submit Download

conlhost.exe

Path C:\Users\Public\conlhost.exe
Size 363KB
SHA256 63f6db5202ee6a76cf29319401ca928fc216fdb46db38a063347c6ba54839b5d
MD5 87f2d64fed20a250b967ba9dffed3ef6
SHA1 cda488ff1c3bb81338887020b25bb56af9e63d97
SHA512 92efc3690299e7f693ac7a71856f684cdf020e01ec521ba7994bc64711c52dfb9f0561c5f89217cd8d9f7dad58778de23236b6ec343ca08507912582241fdc83
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371op:/uTs1gBpQL5kmh0671op
TLSH
T172840826B14198E6DD7268791A65BBFEAA2DB4704B940FF7F7C24AA404E03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del.bat

Path C:\users\Public\del.bat
Size 138B
SHA256 ed10d7bd69a7c7889fdd571be7f474d7be98fe85ef2356ae074f495b61af31a9
MD5 a16e16cc006b48da86114b05c90f5f8e
SHA1 6139d4e8ad00f5fa0cff4210a0abfeb4cb90e9e7
SHA512 68ba3d879bfb54506dec4d7d9452f05d026311f39a7baf82b21dad74fde7402cd6f4f1c3b183af9722a9c4e122023b39a417ffc1eaf8d32ad7281a8c722d1f89
TLSH
T1CDC02BC1C4D24C90280A300A4FE9130030151CCF10C00AC1023B47D818DB04850B1F0D
MD5 SHA1 SHA512 TLSH

Submit Download

time.e

Path C:\users\Public\time.e
Size 16B
SHA256 b023b0de907e39666db2e5429b7e117f22b5e17dcc6ba3972e6147abf656f47e
MD5 576cda0aae1ae8365bf95f8586860bba
SHA1 a35b5436e0a950f722d086640fc90bdc1b6dec37
SHA512 8a91a71b533bca353f20293bd5a75ebcbf6e8f2e839cb1c5925761d7c745abce588f4d000715169c81503dd036e1b0a302e611e8d9cf34528a20994756a4a54e
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads