seven | 06e01cbb72981f610c92d8b6ed608b63d5c7f1583ef762a6cb57a72435a3a5a0

General

Target
2026-08-08_c63ef2eee4491322e1cc9167f51e0e67_7ev3n_elex_hawkeye_mespinoza.exe
Size 363KB
Sample260808-fehecabg76
SHA256 06e01cbb72981f610c92d8b6ed608b63d5c7f1583ef762a6cb57a72435a3a5a0
MD5 c63ef2eee4491322e1cc9167f51e0e67
SHA1 20990a5f00311e0c19151fd8881b04b3150ac0ae
SHA512 1655e1b930e385ba1d7162fb95aeda3f3686cfefbb22b4e019b0c55ae1315df663f57c3b025a1b09347082cfcbf6244af69f0e18d1bd16c05ed6873536229cc3
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371o7:/uTs1gBpQL5kmh0671o7
TLSH
T158840826B14198E6DD7268791A65BBFEAA2DB4704B940FF7F7C24AA404E03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution seven persistence ransomware spyware trojan

Malware Config

Signatures

Family: Seven, SevenCrypt, 7ev3n
Seven aka SevenCrypt or 7ev3n is a ransomware.
ransomware seven

Detects Seven ransomware 1 IoCs

resource	yara_rule
behavioral2/files/0x001300000001c482-4.dat	family_seven

Executes dropped EXE 2 IoCs

pid	Process
3320	conlhost.exe
5760	conlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\allkeeper = "C:\\users\\Public\\conlhost.exe"	REG.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3392	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_c63ef2eee4491322e1cc9167f51e0e67_7ev3n_elex_hawkeye_mespinoza.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	conlhost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c000000010000000400000000080000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	conlhost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 3320	4712	2026-08-08_c63ef2eee4491322e1cc9167f51e0e67_7ev3n_elex_hawkeye_mespinoza.exe	89
PID 3320 wrote to memory of 3392	3320	conlhost.exe	90
PID 3320 wrote to memory of 1004	3320	conlhost.exe	93
PID 3320 wrote to memory of 1224	3320	conlhost.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-08-08_c63ef2eee4491322e1cc9167f51e0e67_7ev3n_elex_hawkeye_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_c63ef2eee4491322e1cc9167f51e0e67_7ev3n_elex_hawkeye_mespinoza.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712
- C:\users\Public\conlhost.exe
  "C:\users\Public\conlhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\users\Public\del.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3392
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "allkeeper" /t REG_SZ /d "C:\users\Public\conlhost.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1004
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE" /v "crypted" /t REG_SZ /d "1" /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1224

C:\users\Public\conlhost.exe
C:\users\Public\conlhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:5760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 471B
SHA256 c0061c30aa673a1fdc19a16c0e3604daf398e82bf75453c196fcce88b97b048f
MD5 e0d2ee7eda5c00fe0fa93839035bc83e
SHA1 5bfad81318093b9daaad71b43efc0c1807cb78f5
SHA512 bd8efb123dacd00fc92552904878c2c233ee8dbe41db7af7f0c71ebedac7a507138351bb24df242d877c3afa6126db5fc3dbbf306a8a53b3817c1bfd24715b74
TLSH
T1D7F023000571A4F46D10CC9478F183317D29C50A7DF9D27E6E6433E848213E1ED4ECC0
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 471B
SHA256 e8549ecfdc4641a35f78f536c081e72c38b3fbde86679a810902c4f7090db00a
MD5 e7e41c4e87494fdbacb6c0d8b82c76da
SHA1 5a4642b4e3baa2f03c1534f02b09f9693e3d5c9a
SHA512 470399cb5404462e8ddd1518f5ee7cbe9897ce0484146256e2122a35367a7379b8f96a70bce2557191d0715dd25f597c6a49ea2bf51b42776f05c7b1e5c1c70b
TLSH
T1C1F0DCF68068E0A33743888C76F58E3F3431D12E0AB8484941A5CAB0246463D2347936
MD5 SHA1 SHA512 TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 402B
SHA256 9cdd50bb54f48c0145d46789e87e573f587faf50e4c4179569fb66895aee9d71
MD5 700c7ffc6de1bcf4817ec24fc1f4050c
SHA1 46891368c8e8520e4f87610bbf1d61eb21d8efb5
SHA512 6b9392cf381f7755f6d0473714055f950fc8eb983dba5f69b41f0c3e1053bc85bddf9c915ddc74fb146dcd1a4b276849485f9685849bbd626a92cb1c5e71be52
TLSH
T125E0202455FE057CF2F1DA741FCA5973441BF1025C3493791B944A0DA70BA50DC72C75
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 420B
SHA256 44e368d14d9bccf43c3196e89e3ea5337028c441c804401799ec7957092e160e
MD5 a06cf5a9f2f37872ab1dc8cb76e51d21
SHA1 91533e4c8dc2b51df81aebb61f1f1accd3f61fb0
SHA512 5adb36139ad44e18104643998d8e85059f43a36bde2271e86a67387e9a689a40d1322ed396827ceabebf54844f495a6409aacb50eab14526e0780d469486e140
TLSH
T18EE0C03816FB411CF5E0E0394BD9B03054A9F0311416E2B02EC49B04B72A900FC12E21
MD5 SHA1 SHA512 TLSH

Submit Download

FILES_BACK.txt

Path C:\Users\Admin\FILES_BACK.txt
Size 177B
SHA256 a2a678d59020d212a1ec32810466b9a2bc4d17fcfff8edd6c07c5aa8ef15b25f
MD5 fc605d0a0029f229d0ed645293ece316
SHA1 9ee4a83cd232b15790107ebbb98b4b515839f219
SHA512 2e43a1bbb43f9371cfcdcf550a205bb123a2facf17cbdd180591eb7a7c3ee75b5aae0a59654898814e4dee9d7bdf4ff3f6b50a37f0fbd5252865a23655b261e1
TLSH
T1B3C0C00C7F792400330192C8A0199F059D1FB500D15120D00F10500C3DFD7E4C4902D3
MD5 SHA1 SHA512 TLSH

Submit Download

conlhost.exe

Path C:\Users\Public\conlhost.exe
Size 363KB
SHA256 007eadff17acc8dee1c194b8818bcf7028448efbaff41f7d5f8ba4446719837a
MD5 771b1c482d8043631aba9b4cc49d434a
SHA1 72ccb9fbaec1e9898d930aee120e3bfccd6eecfc
SHA512 575ff2a976eb77aae3239c3582cbbe7d7b393b08bff9ee4c45f7d893a62c0be5e28cb4c62dd1e0b6c365407135a1356c3e4c25ea63cbbfa8f379705057e1d2c6
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371o2:/uTs1gBpQL5kmh0671o2
TLSH
T109840826B14198E6DD7268791A65BBFEAA2DB4704B940FF7F7C24AA404E03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del.bat

Path C:\users\Public\del.bat
Size 138B
SHA256 ed10d7bd69a7c7889fdd571be7f474d7be98fe85ef2356ae074f495b61af31a9
MD5 a16e16cc006b48da86114b05c90f5f8e
SHA1 6139d4e8ad00f5fa0cff4210a0abfeb4cb90e9e7
SHA512 68ba3d879bfb54506dec4d7d9452f05d026311f39a7baf82b21dad74fde7402cd6f4f1c3b183af9722a9c4e122023b39a417ffc1eaf8d32ad7281a8c722d1f89
TLSH
T1CDC02BC1C4D24C90280A300A4FE9130030151CCF10C00AC1023B47D818DB04850B1F0D
MD5 SHA1 SHA512 TLSH

Submit Download

time.e

Path C:\users\Public\time.e
Size 16B
SHA256 fd87c0e8c72f6b7bd14bcc98a3293224d68102d0d4c885635ee79f6f0bba0b5a
MD5 cec1080758ebf983a142498358cf0900
SHA1 fec00fda4701b9faa141ce53b73c386824462a94
SHA512 98a5a8a49d1037939fa6b567fb43db7ad86c804bef494fb66572c4f885255d6465604092d93fec47c19fd340579c4ad49d8812d58a65512dde0fbc5270fbd14d
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads