Encrypted 7z file password not working

Assuming the hash is correct and you just forgot some characters in the supposed password, or added some too much, your password can be recovered using Hashcat within a reasonable time.

I already tried your password, Hashcat doesn't crack the hash using a dict, only containing your password, so there must be something like a typo.

Determine hash type

I saved your 7z hash in hash. To determine its exact hash type -m, you can run hashcat --identify hash. This will return

      # | Name                                                       | Category
  ======+============================================================+======================================
  11600 | 7-Zip                                                      | Archive

Dictionary Attack

The first thing you should try is checking whether you accidently added a character to your password. To check that we create a dictionary based on the presumable password but with an increasing amount of chars iteratively removed.

This can be done using this simple Python script.

original_string = "4^^#iy3N3Et9LG$3kws!Qqz$VN$WF8r5h5$dS9FM$2JfQUjkmd%2778#X3&M"

# Specify the output file path
output_file_path = "wordlist.lst"

# Open the file for writing
with open(output_file_path, "a") as output_file:
        # iterating from 3 to 59 (length of password - 1)
    for j in range(1, 59):
        # iterating through string length
        for i in range(len(original_string)-j):
            
            # modified_string = original_string up to the 'i'th char + original_string, starting from the 'i'th + 'j'th character until the end
            modified_string = original_string[:i] + original_string[i+j:]
            output_file.write(modified_string + "\n")

    # What this double for loop does, is it takes your "password", removes the 1st char, then the second one and so on.
    # After that, the same procedure, but now 2 chars are replaced by ?a and this goes on for up to 59 chars being removed. (Sure it's very unlikely/up to impossible you accidently added 59 false characters to your pw,
    # but it does not increase cracking time drastically either)



print(f"Variations written to {output_file_path}")

Now we also check for and remove duplicate lines with the following script

file_name = 'input.txt'  # Replace with your file name

with open(file_name, 'r') as file:
        lines = file.readlines()

lines = list(dict.fromkeys(lines))  # Removes duplicates while preserving order

with open(file_name, 'w') as file:
        file.writelines(lines)

print(f"Duplicate lines removed in '{file_name}'.")

Use -m to specify the hash mode and -a0to specify that we will run a dictionary attack. Use hashcat -I to see all available devices and then the -D flag to specify all available devices.

Now we will start the dictionary attack using hashcat -m11600 hash -a0 wordlist.lst -D <device ids here, seperated by a comma

(I also needed to set the flag --self-test-disable in order to work)

Mask attack

If the dictionary attack did not find your password, we need to move to a more advanced method, the mask attack.

With the mask attack, we will take your password and replace every char with ?a, one of the built-in charsets, iteratively, to check for typos.

Built-in charsets

    ?l = abcdefghijklmnopqrstuvwxyz
    ?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ
    ?d = 0123456789
    ?h = 0123456789abcdef
    ?H = 0123456789ABCDEF
    ?s = «space»!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
    ?a = ?l?u?d?s
    ?b = 0x00 - 0xff

Then we will do the same with 2 chars at a time again and so on, theoretically until we have all chars of the password except 1 replaced with ?a, since this is extremely performance intensive, we will crop the replacement at 10 chars maximum.

After that, we will do the exact same, but without replacing the char, so just adding a ?a in between the password.

In this script, both tasks will be combined, look at the comments of the code for more information.

original_string = "4^^#iy3N3Et9LG$3kws!Qqz$VN$WF8r5h5$dS9FM$2JfQUjkmd%2778#X3&M"

# Specify the output file path
output_file_path = "masks"

# Open the file for writing
with open(output_file_path, "a") as output_file:
        # iterating from 3 to 10 
    for j in range(3, 10):
            # iterating through string length
        for i in range(len(original_string)-j):
            
            # modified_string = original_string up to the 'i'th char + '?a' multiplied by j + original_string from the 'i'th + 'j'th character until the end
            # A
            modified_string = original_string[:i] + '?a'*j + original_string[i+j:]
            output_file.write(modified_string + "\n")
            
            # B
            modified_string = original_string[:i] + '?a'*j + original_string[i+j+1:]
            output_file.write(modified_string + "\n")

    # (SEE A)
    # What this double for loop does, is it takes your "password", replaces the first char with '?a' (= Hashcat tries every char), then the second one and so on.
    # After that, the same procedure, but now 2 chars are replaced by ?a and this goes on for up to 10 chars being replaced.

    # I was lying, actually this described procedure is directly starting at replacing the first 3 chars since anything lower than that would be a bottle neck for Hashcat

    # (SEE B)
    # And now all of those steps again, but no chars will be replaced, just added in between (to check if just a char is missing)


print(f"Variations written to {output_file_path}")

Now we will also again remove duplicates using the script before.

After that change to flag to -a3 to specify mask attack and run hashcat -m11600 hash -a3 masks -D <again devices here>

Hint: The flag -O would provide a better cracking performance but isn't available for this password length.