MALICIOUS — 7caa71d7b5abbe23a7ad4e0638bca339d940e788d7ff98d8c3bf6490d4a7c31a.exe

MALICIOUS — 7caa71d7b5abbe23a7ad4e0638bca339d940e788d7ff98d8c3bf6490d4a7c31a.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the PowerShell family. 8 of 26 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

• SHA-256: 7caa71d7b5abbe23a7ad4e0638bca339d940e788d7ff98d8c3bf6490d4a7c31a
• SHA-1: 7a228610a539de18de12ad8fcc7547cc7f8d2bd8
• MD5: 98b912dfd29aa642575542164e449dc5
• imphash: f30680522f7fbb5ec5d3df7af44789ef
• ssdeep: 196608:cdvIyQs3CY9eO8OwcPFGUej4IegnBtg39dd+LyQ:cdrz7whr8IJBtg3o
• TLSH: T1486FAE9806022331E4FAEC54BC61D1ED9462F8ACE5B46DCC1747D87A50D8E33A9F11BA
• Submitted as: 7caa71d7b5abbe23a7ad4e0638bca339d940e788d7ff98d8c3bf6490d4a7c31a.exe
• File type: pe · Size: 15082489 bytes
• Verdict: malicious (100/100) · Family: PowerShell

Source: MalwareBazaar · first seen 2026-07-26T00:00:00.000Z · SHA-256 verified

Detections (8 of 26 engines)

• capa (capabilities): execute via PowerShell
• YARA: delivr.to detections: DLV_LNK_PowerShell_Launcher
• YARA: JPCERT/CC: JPCERT_Emotet
• YARA: ReversingLabs: RL_Formbook_XLoader
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): Trojan.GenericKD.80944278
• Kaspersky (KVRT): Trojan.Win32.Staser.fatl

MITRE ATT&CK

• T1059.001
• T1497
• T1486
• T1543.003
• T1112

Why this verdict

The malicious score of 100/100 is the fusion of 19 weighted signals:

• Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 6716) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.GenericKD.80944278 (rule Trojan.GenericKD.80944278) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• YARA: delivr.to detections flagged DLV_LNK_PowerShell_Launcher (rule DLV_LNK_PowerShell_Launcher) - engine signal, weight 0.35, confidence 0.70
• YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
• YARA: ReversingLabs flagged RL_Formbook_XLoader (rule RL_Formbook_XLoader) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• query domain / anti-analysis (rule query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: http://www.years, http://www.interpretation, https://www.recent - static signal, weight 0.35, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60
• Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
• Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

868 behavior events · 2 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• searchapp.bundleassets.example
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• desktop-hsgcbep
• config.edge.skype.com
• www.bing.com
• fd.api.iris.microsoft.com
• aps.prod.windows.com
• dns.msftncsi.com
• tas02.sls.update.microsoft.com
• settings-win.data.microsoft.com
• to-do.microsoft.com
• ctldl.windowsupdate.com
• staging.to-do.microsoft.com
• edge.microsoft.com
• watson.events.data.microsoft.com

Dropped files

• 372a10328c1555f842276acb50f9ab8f7fcc86cbdd320f734707fbb2f594b2bc - 372a10328c1555f842276acb50f9ab8f7fcc86cbdd320f734707fbb2f594b2bc

Embedded URLs

• http://www.years
• http://www.interpretation
• https://www.recent
• http://www.wencodeURIComponent
• http://www.icon
• http://www.hortcut
• http://www.w3.org/shortcut
• http://.css
• http://www.css
• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• http://www.microsoft.com/pkiops/certs/Microsoft%20Windows%20Code%20Signing%20PCA%202024.crt0
• https://github.com/dotnet/runtime
• https://aka.ms/binaryformatter
• http://go.microsoft.com/fwlink/?LinkId=522706
• https://aka.ms/GlobalizationInvariantMode
• https://aka.ms/nativeaot-compatibility
• https://go.microsoft.com/fwlink/?LinkID=169180
• https://aka.ms/dotnet-illink/com
• https://aka.ms/dotnet-illink/nativehost
• https://go.microsoft.com/fwlink/?linkid=2233907
• https://docs.microsoft.com/dotnet/api/system.text.json.serialization.jsonnumberhandling
• https://aka.ms/dotnet/download
• https://aka.ms/dotnet/info
• https://aka.ms/dotnet/app-launch-failed
• https://aka.ms/dotnet/sdk-not-found

Embedded domains

• thing.org
• dressclipsroomsonkeymobilmain.name
• tos.org
• people.in
• the.com
• proprietaryoriginatingprestigiousgrammaticalexperience.to
• www.world
• w3.org
• www.w3.org
• crl.microsoft.com
• www.microsoft.com
• github.com
• go.microsoft.com
• handle.to
• docs.microsoft.com
• g.net
• api.ipify.org
• dns.question.name
• manifests.microsoft.com
• schemas.xmlsoap.org
• schemas.microsoft.com
• www.years
• www.interpretation
• www.recent
• www.wencodeuricomponent

Embedded IP addresses

• 4.2.1.0
• 8.0.0.1
• 4.0.1.0
• 1.12.1.3
• 1.12.1.4
• 1.12.1.5
• 1.12.1.6
• 1.101.3.4
• 3.2.8.1
• 1.9.16.3
• 1.1.2.1
• 1.101.2.1

File paths

• D:\a\_work\1\s\src\coreclr\vm\threads.cpp
• D:\a\_work\1\s\src\coreclr\vm\jithelpers.cpp
• D:\a\_work\1\s\src\coreclr\vm\amd64\jitinterfaceamd64.cpp
• D:\a\_work\1\s\src\coreclr\jit\gentree.cpp
• D:\a\_work\1\s\src\coreclr\jit\morph.cpp
• D:\a\_work\1\s\src\coreclr\jit\codegenxarch.cpp
• D:\a\_work\1\s\src\coreclr\jit\hwintrinsiccodegenxarch.cpp
• D:\a\_work\1\s\src\coreclr\dlls\mscoree\exports.cpp
• D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb
• D:\a\_work\1\s\src\coreclr\debug\daccess\enummem.cpp
• D:\a\_work\1\s\src\coreclr\vm\typehandle.cpp
• D:\a\_work\1\s\src\coreclr\vm\method.cpp
• D:\a\_work\1\s\src\coreclr\vm\peimage.cpp
• D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscordac\mscordaccore.pdb
• c:\\
• C:\ProgramData\Microsoft\UpdateService

More PowerShell samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report