7z.exe

Top Paths

• C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin44.41%
• C:\...14.05%
• C:\Users\...12.42%
• C:\Program Files\Unity\Hub\Editor\2019.1.5f1\Editor\Data\Tools12.03%
• C:\Program Files\7-Zip8.99%
• C:\ProgramData\...4.55%
• C:\Program Files\Unity\Editor\Data\Tools1.35%
• C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience1.01%
• C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience0.39%
• C:\Program Files\AMD\CNext\CNext0.17%

Top Hashes (SHA256)

• a20d93e7dc3711e8b8a8f63bd148ddc70de8c952de882c5495ac121bfedb749f45.08%
• c7245e21a7553d9e52d434002a401c77a7ca7d0f245f2311b0ddf16f8f946c6f12.46%
• ae78a8f0f144eb50b4d5251ee8166557e1ffdc776c3806adce2a954f99f7ac3b12.18%
• 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad211.72%
• eb021240d46f6c12e53fcf92f095ee87aae055a82ae0d986318e8f8b57e463cb6.72%
• 5d359c7f2d3594fb9e32554aa7acea767231ea6bfa693c2f31415a79377ea65c4.44%
• 47462483fe54776e01d8ceb8ff9fd5bf2c3f1f01d852a54d878914f62f98f2d33.7%
• 907a9e5e8f67c66745088804e5ff6b66939ab3113567d96074a4778b0f95dd410.46%
• 3b914d023fd198f395009552d977f4ff77a0187496f790a1298ffdecb94a46b60.4%
• d0f86b1dfa038c7ae30e94d297935a8b49f018cea9378524aaeea0bf984628190.34%
• 6ee3c0ed0b27663c1b948ae85a7c0bb073aed1498983182f3f0df1f6a8c30b2f

Signers by share of executions

• Unsigned

  1 hash

  100%

Top Grandparents

• explorer.exe83.28%
• nvnodejslauncher.exe5.9%
• Unity.exe2.62%
• RuntimeBroker.exe2.3%
• userinit.exe1.97%
• chrome.exe0.66%
• Unity Hub.exe0.66%
• dllhost.exe0.33%
• svchost.exe0.33%
• cmd.exe

Top Parents

• dcmsghandler.exe43.56%
• cmd.exe25.52%
• Unity.exe13.49%
• 7z.exe4.38%
• powershell.exe2.02%
• NVIDIA Web Helper.exe1.35%
• explorer.exe0.39%
• msiexec.exe0.11%
• nvcontainer.exe0.06%
• OpenWith.exe0.06%

Top Children

• conhost.exe83.4%
• 7z.exe16.6%

What does 7z.exe normally do?

7z.exe is the console front-end of 7-Zip, used to create, list, test and extract archives (7z, zip, tar, gz, iso, and many others) and is commonly driven interactively or from scripts and build pipelines. In the lab the silent installer C:\lab\in\7z2603-x64.exe /S was launched from powershell.exe, installed to C:\Program Files\7-Zip, and registered the shell context-menu handler under HKCR\*\shellex\ContextMenuHandlers\7-Zip; 7z.exe, 7zG.exe and 7zFM.exe were then started from cmd.exe and powershell.exe. Observed 7z.exe invocations were ordinary archive operations against C:\Users\lab\labwork (a -y sample.7z, a -y -tzip sample.zip, l sample.7z, x -y -o<dir>), each loading 7z.dll from the install directory and spawning only conhost.exe. 7z.exe itself generated no network traffic; the DNS/TCP activity to www.7-zip.org, github.com/release-assets.githubusercontent.com and cdn.winget.microsoft.com came from winget.exe and powershell.exe during acquisition, and the large volume of Edge/EdgeUpdate/WebView2 and telemetry activity was unrelated background Windows maintenance.

When is 7z.exe suspicious?

7z.exe or a copied/renamed 7-Zip binary executing from non-standard paths (%TEMP%, %APPDATA%, %PUBLIC%, C:\Users\Public, ProgramData, or a WebDAV/UNC share) rather than C:\Program Files\7-Zip. Command lines containing -p<password> with high-entropy values, -mhe=on (encrypted headers), -v<size> volume splitting, or -sdel, especially when combined with recursive collection of user document trees, browser profile directories, mailbox stores, \\<host>\C$ paths, or SQL/backup shares. Parent processes that indicate hands-on-keyboard or C2 activity: cmd.exe or powershell.exe spawned by w3wp.exe, wmiprvse.exe, services.exe, rundll32.exe, mshta.exe, or an Office application; also execution under SYSTEM or a service account on a server where 7-Zip has no business role. Extraction (x/e) into startup folders, C:\Windows, or service binary paths, or 7z.exe used to expand a freshly downloaded archive seconds before a new unsigned executable runs, is a strong sequence indicator. Unusual encoding of legitimate activity — 7z.exe present without the 7-Zip installation/registry footprint, or 7z.dll side-loaded from a writable directory alongside a renamed 7z.exe — also warrants review.

How do attackers abuse 7z.exe?

7-Zip's console binary is one of the most heavily abused archivers in real intrusions. Ransomware and extortion crews (Conti, BlackCat/ALPHV, LockBit affiliates, FIN7, APT41, Iranian and Chinese espionage groups) stage victim data with commands like 7z.exe a -mx1 -pPassword -v500m C:\Windows\Temp\d.7z to compress, encrypt and split collections before exfiltrating over Rclone, MEGAcmd, FTP or a webshell; encrypted archives (-p, -mhe=on) defeat DLP and content inspection. It is also used to stage/extract tooling: droppers ship a password-protected 7z or SFX archive to bypass AV and email gateways, then call 7z.exe x -pinfected to unpack Cobalt Strike beacons, Mimikatz, or credential dumps into %TEMP% or %ProgramData%. Self-extracting 7-Zip SFX modules (7z.sfx/7zS.sfx) are frequently weaponized as installer-looking droppers with embedded config. Attackers copy 7z.exe plus 7z.dll onto hosts that lack it (bring-your-own-binary) or rename it to blend in, and side-load a malicious 7z.dll next to a legitimate/renamed 7z.exe for DLL search-order hijacking. Archive handling itself has been an exploit surface (CVE-2018-10115 Rar, CVE-2022-29072 SFX help-file local privilege escalation, and the 2025 CVE-2025-0411 Mark-of-the-Web bypass where extracted contents lost MotW and executed without SmartScreen warnings), and 7z.exe is also used to bulk-collect files as a precursor to staging on network shares.

Detection guidance

Baseline the parent processes, working directories and switch sets for 7z.exe in your environment (interactive cmd.exe/powershell.exe/Explorer under Program Files\7-Zip as seen in the lab) and alert on deviations, particularly archiver process creation on servers or under service/SYSTEM accounts. Hunt command lines for the staging signature: archive verbs a/u combined with -p, -mhe=on, -v, -sdel, -mx, output to Temp/ProgramData/Public, or source paths spanning many user profiles, mapped drives or admin shares; correlate a large 7z.exe write burst with a subsequent outbound transfer by rclone/curl/powershell/megacmd within minutes. Track image-load events for 7z.dll from directories outside C:\Program Files\7-Zip and hash/original-filename mismatches (OriginalFileName 7z.exe under a different name) to catch renamed or side-loaded copies. Flag extraction events (x/e) that drop executables, scripts or LNKs into Startup, Run-key targets, or system directories, and keep 7-Zip patched against MotW-bypass and SFX LPE issues while monitoring for .7z/.exe SFX files arriving via mail or browser downloads.

MITRE ATT&CK techniques

References

• https://7-zip.org/download.html
• https://7-zip.org/