seven | 59916289cc29dfe0ddf278cb46a14800ec3d37c74907729665881afb65770753

General

Target
2026-08-21_858517a2ea546128c8275c61d0586a3f_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
Size 388KB
Sample260822-ngjdesgm4z
SHA256 59916289cc29dfe0ddf278cb46a14800ec3d37c74907729665881afb65770753
MD5 858517a2ea546128c8275c61d0586a3f
SHA1 f652f21ad32fa715be28c932a13c549eef79f3d5
SHA512 3e966801c6186c6f0eb8d52c26d66950e486618a7c4a111330cc676f53ffd12a26792b415e7b570cc67ac86bfa60213164fabbd23dec793a6bed394a5e10d6a3
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oHVCvvt:/uTs1gBpQL5kmh0671o1CN
TLSH
T172841926714198A6DD7268791A65BBFEAA2DB8704B940FF7F7C24AA404F03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution seven persistence ransomware spyware trojan

Malware Config

Signatures

Family: Seven, SevenCrypt, 7ev3n
Seven aka SevenCrypt or 7ev3n is a ransomware.
ransomware seven

Detects Seven ransomware 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4be-4.dat	family_seven

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4be-4.dat	UPX

Executes dropped EXE 2 IoCs

pid	Process
5664	conlhost.exe
4752	conlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\allkeeper = "C:\\users\\Public\\conlhost.exe"	REG.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5724	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_858517a2ea546128c8275c61d0586a3f_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	conlhost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c000000010000000400000000080000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	conlhost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 5664	3012	2026-08-21_858517a2ea546128c8275c61d0586a3f_7ev3n_coinminer_elex_hawkeye_mespinoza.exe	89
PID 5664 wrote to memory of 5724	5664	conlhost.exe	90
PID 5664 wrote to memory of 6012	5664	conlhost.exe	92
PID 5664 wrote to memory of 2704	5664	conlhost.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-21_858517a2ea546128c8275c61d0586a3f_7ev3n_coinminer_elex_hawkeye_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_858517a2ea546128c8275c61d0586a3f_7ev3n_coinminer_elex_hawkeye_mespinoza.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012
- C:\users\Public\conlhost.exe
  "C:\users\Public\conlhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5664
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\users\Public\del.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5724
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "allkeeper" /t REG_SZ /d "C:\users\Public\conlhost.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:6012
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE" /v "crypted" /t REG_SZ /d "1" /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2704

C:\users\Public\conlhost.exe
C:\users\Public\conlhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 471B
SHA256 35102b7b6d95f6b751e74116d8f707034cf6cffcd017edc71f0a48ca26e94d5e
MD5 78cc5600852f1782d21d0fce2d4f6675
SHA1 14666c8c5b9628f0f9b6967bd7bd3f5ebf5d2c3e
SHA512 617d36d1af827edd74deed7df7ad1fcd445947a1f8f4b15c787f14447970162a1dee1cbf234e8420de8240ce54745d07f94dd0e2fa4e7cb934e876c9d7a92c17
TLSH
T1D4F0DC0618E868A18C10C8842CE61D39352C86481DF7D2B9FA3D2A2282223F0E8AACC0
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 471B
SHA256 efa6dc9b41e8b5c1b975cf2909e3f12c3e9c5d477220290d7b432c2952d34e0b
MD5 27ca1b8ace611290fc92adab454a457e
SHA1 1b56d3f82a2a797a0a8e4049493ced197ab8b29e
SHA512 e72fad4e535b32f357efb1ad672b43781f0074327afca076a374edd4a2c7c8e1d2cb1ec770cba6ac62a2e69b812b6a31582eb7d66710f047601bbc18833f7a3a
TLSH
T1CAF05C53951E98637B82A8DD17D95A7F2131B0D100B09202246898F159AA1B5E62E975
MD5 SHA1 SHA512 TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 402B
SHA256 16c5212c6826e43119b073fb82a400ac512b5d5a96755ea8a52f4bd2ca20dc65
MD5 f61f9c20b84c52b91b74d722225e97fa
SHA1 ff9ff548e7233471a41d5fdc1f6b34a7ce145c01
SHA512 9ba552419a97e07861f7285cb23dbbf0c17040c3e493446f3a0aecf5882a63cbc39920ab750632971bf50114bd6816e1a2f428091ecb3c77a844e4ea3eafef9a
TLSH
T1C1E0C02046FD027CF172EA704BCB59260027F1056D24836B1795830DA707640DE33D30
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 420B
SHA256 675ea0651729ba16e04bfb58b00e5d7bc1c9eb71ce13815c468b33b181894af7
MD5 8562c58e126e95d7d9492d8ebc47c8a4
SHA1 2f7f8adb8c7c5241b23404285c43aad12f69420c
SHA512 e1d6f64d9e42053541c8b5b153f12532612744dee8ca04b135c682c1e7dad9a5eda19892a566d37d129ff563fc31e4e44b0258a299d005ba5599c7f1c4bed2ca
TLSH
T152E0C02913FB410CF4E0D03647D9703155A9F0310459E2B01EC45F04B726A00FC02B25
MD5 SHA1 SHA512 TLSH

Submit Download

FILES_BACK.txt

Path C:\Users\Admin\FILES_BACK.txt
Size 177B
SHA256 a2a678d59020d212a1ec32810466b9a2bc4d17fcfff8edd6c07c5aa8ef15b25f
MD5 fc605d0a0029f229d0ed645293ece316
SHA1 9ee4a83cd232b15790107ebbb98b4b515839f219
SHA512 2e43a1bbb43f9371cfcdcf550a205bb123a2facf17cbdd180591eb7a7c3ee75b5aae0a59654898814e4dee9d7bdf4ff3f6b50a37f0fbd5252865a23655b261e1
TLSH
T1B3C0C00C7F792400330192C8A0199F059D1FB500D15120D00F10500C3DFD7E4C4902D3
MD5 SHA1 SHA512 TLSH

Submit Download

conlhost.exe

Path C:\Users\Public\conlhost.exe
Size 388KB
SHA256 b8c0ec7abe77114dc35e487f10f6e477c611dabcefe905fc9446e94bf8dd91b4
MD5 21ba49bcaff990810d2b07df989b39dc
SHA1 46157e6e1429b8cfc34b55085fe766af2ec2083c
SHA512 fcc982d02040fefe3d903f7c8a597d1fbdd49d0e09ec8d003541d45567b33c3a68525e9e73df830383546252289ff9782f3c5e2a92319589e9d2cdd933942d35
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oHVCvvD:/uTs1gBpQL5kmh0671o1Cj
TLSH
T130841926714198A6DD7268791A65BBFEAA2DB8704B940FF7F7C24AA404F03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del.bat

Path C:\users\Public\del.bat
Size 148B
SHA256 86e50df40ce4864d43ec60fda7f184b1115c8e2bad5628ffaf689b62fa5a6d75
MD5 3a786aa0068369b9be10adeccea78e75
SHA1 39150dd2eba3e50dafb87ac34c6c59d9b40c8aaa
SHA512 6e7db370c3c24fdb818db5864d69e224891eebfa898fbff95b00704effc2179fd225c3711735246dad588d1d3ab6510afcbf652b4d24dc4bf5227ac89ec183ce
TLSH
T136C02BD3C3E1CE011B8E510E03AD6305A4ED388E02841710293B47D0D9874C8E8B0946
MD5 SHA1 SHA512 TLSH

Submit Download

time.e

Path C:\users\Public\time.e
Size 16B
SHA256 4a19593dc9b143644c576d8c20eba2f5de7517e9ee36bbea271b0fe4f4de78cb
MD5 9283d9fefd90052926b2ac4c1826af95
SHA1 56b553e79a9066180b4c6cb84356d1f7dc50a44d
SHA512 07be6019b5a294c807e02872ac9cdb57fd8fd9cbfa5bad5104afe4ba6ab9e5157c7d9430137cfdd583a791aad6ad79b1bcf623ea5c948e37e1ca91b5af33fda9
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads