seven | f4742272f7e12be14b08b89c71e8d9a58806bd68bba555f63b37abc5d2e3b912

General

Target
2026-09-14_44af010be415d21698acb7d0a6fe81bd_7ev3n_elex_hawkeye_mespinoza.exe
Size 363KB
Sample260915-nd2etseh44
SHA256 f4742272f7e12be14b08b89c71e8d9a58806bd68bba555f63b37abc5d2e3b912
MD5 44af010be415d21698acb7d0a6fe81bd
SHA1 15993b1fb5a0e1bcdece6193a47010055064bace
SHA512 47f6f1cc59a241578217cede23f44438f297a9672b4594535e9d0e410b223bced84da79b6467ee940470a3846265d2feadd962f978a18566f5eee5328d3c47a8
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oz:/uTs1gBpQL5kmh0671oz
TLSH
T136840826B14198E6DD7268791A65BBFEAA2DB4704B940FF7F7C24AA404E03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution seven persistence ransomware spyware trojan

Malware Config

Signatures

Family: Seven, SevenCrypt, 7ev3n
Seven aka SevenCrypt or 7ev3n is a ransomware.
ransomware seven

Detects Seven ransomware 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c548-4.dat	family_seven

Executes dropped EXE 2 IoCs

pid	Process
3656	conlhost.exe
5764	conlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\allkeeper = "C:\\users\\Public\\conlhost.exe"	REG.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4264	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-14_44af010be415d21698acb7d0a6fe81bd_7ev3n_elex_hawkeye_mespinoza.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c000000010000000400000000080000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	conlhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	conlhost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 3656	2400	2026-09-14_44af010be415d21698acb7d0a6fe81bd_7ev3n_elex_hawkeye_mespinoza.exe	87
PID 3656 wrote to memory of 4264	3656	conlhost.exe	88
PID 3656 wrote to memory of 5520	3656	conlhost.exe	90
PID 3656 wrote to memory of 2516	3656	conlhost.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-09-14_44af010be415d21698acb7d0a6fe81bd_7ev3n_elex_hawkeye_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-14_44af010be415d21698acb7d0a6fe81bd_7ev3n_elex_hawkeye_mespinoza.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400
- C:\users\Public\conlhost.exe
  "C:\users\Public\conlhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\users\Public\del.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4264
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "allkeeper" /t REG_SZ /d "C:\users\Public\conlhost.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:5520
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE" /v "crypted" /t REG_SZ /d "1" /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2516

C:\users\Public\conlhost.exe
C:\users\Public\conlhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 471B
SHA256 b45b2bb7f4591baf6765222bd0fcd5916e1fd980f16039dfd82727756a777d70
MD5 a383a3e091428a8c756877db40dfe88a
SHA1 e86da534464d9fa0e7877516c910978c88ff3f03
SHA512 4caecc18c53efb84298e2c97efb28c58990756b494f1cc172c75123bdd76ebb19274f6eaa08e65f0ca812a925d55a1e89d2697cfdfd08af3e8f3d5e08dc7d434
TLSH
T1EAF0D4670475181DBD098D1838D58574386444CF8EEF94F57958579A46103E96617CC0
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 471B
SHA256 671b75eaf1c938d65a2e29c183aa7eff7e3abb21246ae102f47ec42057d89035
MD5 8d347fe19107f02881227b9ab4514d93
SHA1 06e2d7a3693b18af958ec147acee3403ac1b5dad
SHA512 cd5af3edc72a191e92dc551b5d0b0743a98842d6f2f1abc52a24dd726f29bdeac4d23d891b06a88979a07f898ee47af6fcc39608dbdcb28ae4d730c370d46ed3
TLSH
T1F1F0231389FCE8737B42948D36DC433FB170709F06C94A4AA0D441B0873D2764B1E135
MD5 SHA1 SHA512 TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 402B
SHA256 1f37e8735c47105dc99ec52d2649bc41df45c93ec7fabb1b861d7e41d0f0eb58
MD5 11e547c44b9da7cce219b13657c924d7
SHA1 02e429a27d0ae6df7d96f767dc35650f9b5af1ad
SHA512 37d45920ae8f85aa1465dcb1a96d9a2aa45e7aee7aee361f793d29e022f2cc01a6bbf5b836d0fd6fb77ed20b2021507e6fa3a9273c5c083295df2ff2e2ff7712
TLSH
T1F9E0C02805FE017CF071D9340BC75A720017E1155C2493B91BE0074DAB0B640DC33C30
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 420B
SHA256 0fd779c4f242f70d93ffb653bfe11404d87d81c487a9a3c69eadbab8560b9980
MD5 11cbe004dbe73572b08b56aaa746dd05
SHA1 5cce510f775ea0ae57f210371f901d5e27e31178
SHA512 11d510dbb0c8772260c24b13b9f36ce8d60b6c4de0bba269aa20edb89d968dd4415626dcfe3bcaf9db228f7e02814afefdce308cef059b68c370567ddd510b03
TLSH
T1A3E0C02812F7411DF4D4D53547D9B43054A9F1151816E2701EEA4B44B726D00FC02B61
MD5 SHA1 SHA512 TLSH

Submit Download

FILES_BACK.txt

Path C:\Users\Admin\FILES_BACK.txt
Size 177B
SHA256 a2a678d59020d212a1ec32810466b9a2bc4d17fcfff8edd6c07c5aa8ef15b25f
MD5 fc605d0a0029f229d0ed645293ece316
SHA1 9ee4a83cd232b15790107ebbb98b4b515839f219
SHA512 2e43a1bbb43f9371cfcdcf550a205bb123a2facf17cbdd180591eb7a7c3ee75b5aae0a59654898814e4dee9d7bdf4ff3f6b50a37f0fbd5252865a23655b261e1
TLSH
T1B3C0C00C7F792400330192C8A0199F059D1FB500D15120D00F10500C3DFD7E4C4902D3
MD5 SHA1 SHA512 TLSH

Submit Download

conlhost.exe

Path C:\Users\Public\conlhost.exe
Size 363KB
SHA256 179c8f89fb67a8456f27f6fb288dd4103932f4cf55da4272d8a9589c3f8180ae
MD5 a0c7eaa288c021ac5ec4905a25e7b8f3
SHA1 ef672474d78dad0e51c3a920105ea43af98e1f46
SHA512 dc8bdc2c8306673c098b8fb72df35b32ec3e5ee639336558c83052684e5056f79ff560aabe1b322f76234f42f297f8dd7dc66b09cf2319899eec2b1b8a845f83
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oG:/uTs1gBpQL5kmh0671oG
TLSH
T1A1840826B14198E6DD7268791A65BBFEAA2DB4704B940FF7F7C24AA404E03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del.bat

Path C:\users\Public\del.bat
Size 138B
SHA256 312e9c395fa30250950c688f96d1734f2b28a786fee9e79039c2952da92a89b0
MD5 ec8cbaaba994e34c01a4d31ce46e75f2
SHA1 6debd8e3fcd6f62278f16e34d088bec16a9babbf
SHA512 a381f64b0bb37f8552dc28f1ada8a3e4c6d7fefe642e2696e22cca1a6025c0375863202e1b04ff4b8426900730dc2e2245dba3f1e53f9b92994b214dd7db54c6
TLSH
T1DBC02BCE40C15C70050A510F07FE170C20460C8F12005F50113B28A815CB04C5520C0A
MD5 SHA1 SHA512 TLSH

Submit Download

time.e

Path C:\users\Public\time.e
Size 16B
SHA256 f6d11e0cb84e19e094ee4a817b52808d1c8b44db962e8edc7b99743021b396d5
MD5 f66a7761c4d769d739c17c0bbc0dbfb8
SHA1 c8c5186549db4cf4ccf53f4086fee7b823106eef
SHA512 73382321d3bb04f1a7d67fb067ac0c50686f27f2cf0267e0a6fa3d547da6ab488afa711f5763f0fdf8aa54a0bb39a91c7f87a2c8c29b5faa9d431c7459879459
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads