seven | 144eaa6692c2111036e01b538bed48e025b91fc1d3be21477e83ef1773d1b07f

General

Target
2026-09-19_fc2256f029dcf2fb171d7b65b5cf4fe9_7ev3n_elex_hawkeye_mespinoza.exe
Size 363KB
Sample260919-wsv6csab83
SHA256 144eaa6692c2111036e01b538bed48e025b91fc1d3be21477e83ef1773d1b07f
MD5 fc2256f029dcf2fb171d7b65b5cf4fe9
SHA1 d902675054cddcc16d06ea758806bc440164ea18
SHA512 7f6d5ca5b93afcb7e09a6eb2df2eac0ed7daedd26c4b1849e877f7d8ede9b333de1af9c26f9d7ee1d17bf0e81a60786623d0a788eac03ddb37247bcb38669391
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oF:/uTs1gBpQL5kmh0671oF
TLSH
T155840826B14198E6DD7268791A65BBFEAA2DB4704B940FF7F7C24AA404E03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution seven persistence ransomware spyware trojan

Malware Config

Signatures

Family: Seven, SevenCrypt, 7ev3n
Seven aka SevenCrypt or 7ev3n is a ransomware.
ransomware seven

Detects Seven ransomware 1 IoCs

resource	yara_rule
behavioral2/files/0x001000000001c596-4.dat	family_seven

Executes dropped EXE 2 IoCs

pid	Process
2804	conlhost.exe
5420	conlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\allkeeper = "C:\\users\\Public\\conlhost.exe"	REG.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4472	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-19_fc2256f029dcf2fb171d7b65b5cf4fe9_7ev3n_elex_hawkeye_mespinoza.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	conlhost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c000000010000000400000000080000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	conlhost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 2804	5092	2026-09-19_fc2256f029dcf2fb171d7b65b5cf4fe9_7ev3n_elex_hawkeye_mespinoza.exe	90
PID 2804 wrote to memory of 4472	2804	conlhost.exe	91
PID 2804 wrote to memory of 4880	2804	conlhost.exe	93
PID 2804 wrote to memory of 1948	2804	conlhost.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-09-19_fc2256f029dcf2fb171d7b65b5cf4fe9_7ev3n_elex_hawkeye_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-19_fc2256f029dcf2fb171d7b65b5cf4fe9_7ev3n_elex_hawkeye_mespinoza.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5092
- C:\users\Public\conlhost.exe
  "C:\users\Public\conlhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\users\Public\del.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4472
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "allkeeper" /t REG_SZ /d "C:\users\Public\conlhost.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4880
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE" /v "crypted" /t REG_SZ /d "1" /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1948

C:\users\Public\conlhost.exe
C:\users\Public\conlhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:5420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 471B
SHA256 677d5bf9f61b365e88a6e436d2ea9ec6767f5b41cfc88f7d240ffeabc18b213b
MD5 bc1dda66e1081b696cf8d9b0e1ba245f
SHA1 8f42d59182080b9951b60b5078cbfd2f6d5250de
SHA512 d464d1b7ad48b54a34f0622dfddd6d70239b0435543ba93a626c1b2ff8636ee09ddccecd1e5079604887b22cceeab95c0971cd00c4c1100cbd1726a4e80102f6
TLSH
T166F054621C7114D01D0B5408BCE0453030683D6D4CD799F7FB382042D1127B80E0ECA0
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 471B
SHA256 b18212b9ff0c9af7bd6117ff7501cfaf943b7c528006f1b282bdaac5011b96b5
MD5 05ca2a4ded49dd961f946f384709512f
SHA1 8bae68a952609089c5b4b9f2115914436de352c6
SHA512 b1a9a3e7c0495e8ef8e92a90fcc3e0bffb6dad3c465dbeb099727a1697b21905ff989d7cda532fa95dafe0b0fb14e1afa372ddaabffbb91c7e970fc9e3657cec
TLSH
T13BF0DC03E1F8E062BAC54C9C12CB513E7010B08D0A380598383AC4B0AE2AABA837F534
MD5 SHA1 SHA512 TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 402B
SHA256 ca15a6773512edd4c896088a8f2bbbb2730f4ea518df6d8fcaa6c579373e45c4
MD5 43f095f020e5d69c4d926e8bbfa53742
SHA1 a53047b2a6294f2e6f03482f04deeb0a74d7b840
SHA512 0f8fd8ee6b75f15861259d3ab7fe66054305098c1b64612533c005dba9b45cac5ff00950a28e1be26c33d17192c3c107cbe0d82e9ed099a764123040d9ec639c
TLSH
T1AEE0D82426FA017CF271EE784BC69962041BE1115D6482691BE81719A7475009D71D35
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 420B
SHA256 27d706d5bcc5310cab8877e0cd8597f5fa2de5ad156fa6b41fe28e72d2b00f8d
MD5 2effd147595d438d444a3645757997d2
SHA1 41e53139a066d6ec2a53132343c795bce400cd79
SHA512 2269246084944c59823a0fa02ce689a76ce8d571c76c82e2cae647822acf90591e29c9aaa87c928b94a05153fed59ac461343cd82a44dd28e3a159565f1f173e
TLSH
T132E0C02C03F7410DF4D4E43647C5F031556AF1110825E27029D45B08BB25A00FD02B31
MD5 SHA1 SHA512 TLSH

Submit Download

FILES_BACK.txt

Path C:\Users\Admin\FILES_BACK.txt
Size 177B
SHA256 a2a678d59020d212a1ec32810466b9a2bc4d17fcfff8edd6c07c5aa8ef15b25f
MD5 fc605d0a0029f229d0ed645293ece316
SHA1 9ee4a83cd232b15790107ebbb98b4b515839f219
SHA512 2e43a1bbb43f9371cfcdcf550a205bb123a2facf17cbdd180591eb7a7c3ee75b5aae0a59654898814e4dee9d7bdf4ff3f6b50a37f0fbd5252865a23655b261e1
TLSH
T1B3C0C00C7F792400330192C8A0199F059D1FB500D15120D00F10500C3DFD7E4C4902D3
MD5 SHA1 SHA512 TLSH

Submit Download

conlhost.exe

Path C:\Users\Public\conlhost.exe
Size 363KB
SHA256 e1f83b3a15e0e5eaa14b35cc2e3e5a3854d20e5408d926662d27b101f9d40057
MD5 e2bc482f1afa731c1a8db5120b4b0f15
SHA1 d5a424dee51c6dc3101e705210aa19ca5e2aee8e
SHA512 ec6cea6c454efdfcfa1bc74f82de5a0d5500c2ef7da808114176c816296df94338a0a31e58b5f7852e504da4f93d6d1451cf253b1b04abe10886ac98d078b23d
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371on:/uTs1gBpQL5kmh0671on
TLSH
T1E3840826B14198E6DD7268791A65BBFEAA2DB4704B940FF7F7C24AA404E03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del.bat

Path C:\users\Public\del.bat
Size 138B
SHA256 db9883a585e1acb22e2840382fcd2679de0ecc2dad49dbcbe169305444c0d49e
MD5 f0351121388ca54796128d555cc8806c
SHA1 02687b78496d91ffe29d250e0560abe59a9a4c1e
SHA512 04a60e9bc1bb8a422229198affc6837f1dea61fa04547b8beaa0fa55ec728c9400f4a89d4aeed5902e468f236bbc4b8d95992390d57b3a3d700231ac6a11a2df
TLSH
T164C02BD1C19298980A0B410D03BE2F06402A28CE20401F100A374CF401830DC4020D09
MD5 SHA1 SHA512 TLSH

Submit Download

time.e

Path C:\users\Public\time.e
Size 16B
SHA256 426388eec86612e5383fffb3d01f95dcab75fc27ef9b90db44a69e18e6a1b423
MD5 a690167b9307c44baed4fec5a5f34bb4
SHA1 4d32190ba00da6f8ad3080f32ca1aac3ac2067d4
SHA512 486dc4014dc2629cbe81f7cc3e6b9605e42e868b5c221a2546796acaa178617a4680b76dcf48018502eef3978ee60b89cfc91edc76cab1b2e0a2e619ec1e5416
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads