d0419d58487ed5491b2ce44a97f32af58e80138800da52f5debaaae8f58b0516

Analysis

user interaction
yes
max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wiresock-secure-connect-x64-3.7.2.1.exe
Size 16.9MB
Sample261023-v98mcaft6j
SHA256 d0419d58487ed5491b2ce44a97f32af58e80138800da52f5debaaae8f58b0516
MD5 5e1238c170005400b586a12a00087c00
SHA1 9c8bc79f5043831e9fb2fe323977eaa59776b8cd
SHA512 131fabd0f66dcf27c37b338b0922f06f8d3c05e6487b973649c3738951224c726e612e2e20bc88238a27b46c6cac8b59dc2337ec5616b64d53f3899c08fa9e03
SSDEEP 393216:uOf7VqsBHPMLYiXBhT6LiEzlXGAfG+3/U3YkqCWVlsA05vSxx3Sdjyfq:30LYqb6Li6xG8G+PU3YkBtqxxSj/
TLSH
T16207337A33B025EAC1BA46B9E9848132FF75745A332481A9C455C5282F7BBB835FF305
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{B2C2B368-871A-42B8-A057-48B83B1DD0B9} = "\"C:\\ProgramData\\Package Cache\\{B2C2B368-871A-42B8-A057-48B83B1DD0B9}\\wiresock-secure-connect.exe\" /burn.runonce"	wiresock-secure-connect.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 3 IoCs

pid	Process
6080	wixstdba.exe
4116	netcoresearch.exe
4140	wiresock-secure-connect.exe

Loads dropped DLL 2 IoCs

pid	Process
5464	wiresock-secure-connect-x64-3.7.2.1.exe
4116	netcoresearch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4116	netcoresearch.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{B2C2B368-871A-42B8-A057-48B83B1DD0B9}	wiresock-secure-connect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B2C2B368-871A-42B8-A057-48B83B1DD0B9}\ = "{B2C2B368-871A-42B8-A057-48B83B1DD0B9}"	wiresock-secure-connect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B2C2B368-871A-42B8-A057-48B83B1DD0B9}\Version = "3.7.2.1"	wiresock-secure-connect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B2C2B368-871A-42B8-A057-48B83B1DD0B9}\DisplayName = "WireSock Secure Connect"	wiresock-secure-connect.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B2C2B368-871A-42B8-A057-48B83B1DD0B9}	wiresock-secure-connect.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6080	wixstdba.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5464 wrote to memory of 6080	5464	wiresock-secure-connect-x64-3.7.2.1.exe	89
PID 5464 wrote to memory of 4116	5464	wiresock-secure-connect-x64-3.7.2.1.exe	90
PID 5464 wrote to memory of 4140	5464	wiresock-secure-connect-x64-3.7.2.1.exe	92

C:\Users\Admin\AppData\Local\Temp\wiresock-secure-connect-x64-3.7.2.1.exe
"C:\Users\Admin\AppData\Local\Temp\wiresock-secure-connect-x64-3.7.2.1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5464
- C:\Windows\TEMP\{53771BEE-3B7E-4D39-9150-B8E14AB0C6E7}\.ba\wixstdba.exe
  "C:\Windows\TEMP\{53771BEE-3B7E-4D39-9150-B8E14AB0C6E7}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{5B16D1DC-D382-4907-A509-F7C6FD5BDDBE} {5D406C19-78A4-4CC5-80C4-16A115E89939}
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:6080
- C:\Windows\TEMP\{53771BEE-3B7E-4D39-9150-B8E14AB0C6E7}\.ba\Wix4NetfxBootstrapperExtension_X64\x64\netcoresearch.exe
  "C:\Windows\TEMP\{53771BEE-3B7E-4D39-9150-B8E14AB0C6E7}\.ba\Wix4NetfxBootstrapperExtension_X64\x64\netcoresearch.exe" runtime 10 Microsoft.WindowsDesktop.App
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Time Discovery
  PID:4116
- C:\Windows\TEMP\{53771BEE-3B7E-4D39-9150-B8E14AB0C6E7}\.be\wiresock-secure-connect.exe
  "C:\Windows\TEMP\{53771BEE-3B7E-4D39-9150-B8E14AB0C6E7}\.be\wiresock-secure-connect.exe" -q -burn.elevated BurnPipe.{EE428067-969E-4210-B8EC-C76BFA8DCC7D} {530ABCF3-3B96-412E-9186-0C885582256B} 5464
  2⤵
  - Adds Run key to start application
  - Executes dropped EXE
  - Modifies registry class
  PID:4140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

thm.wxl

Path C:\Windows\TEMP\{53771BEE-3B7E-4D39-9150-B8E14AB0C6E7}\.ba\1033\thm.wxl
Size 8KB
SHA256 a76c45fa6dbe297f7942feb1e66e0c2996d4f68cda1896b2cf97bba539f5e47a
MD5 f532b144a988f9d6870f3ef849ceb202
SHA1 ca200b6237a535dd1170a1fb6359a0550cf359ce
SHA512 2e075865983ba14a1cbabd924ebf543726d77cc17df7f236b73f18c55df14ed116e4144db8ed88ae5b004761ed464426d39600be42922617dd57f51bd0374573
SSDEEP 96:OLAvKjcjvMcivL5MXP1l+XS/cEOYJA0SCwZQipCeyAhLXkl479mddaFbgK9JogRA:cQEb+OuwYK0vdd+scY
TLSH
T1C302325B59CFEBF02A731714B5F3588A2618C2E6432B2CF4F8AA054B836750063B3B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{53771BEE-3B7E-4D39-9150-B8E14AB0C6E7}\.ba\BootstrapperApplicationData.xml
Size 11KB
SHA256 be51db60832657239566597715529611d019a7774b577203fcdc2861ec78e275
MD5 0387add496d95d3da39ee834b1841edc
SHA1 6bea2fdfe47259d8d082a963321ee5e6cd0546b4
SHA512 f867fa30eed14048778e57061dc76955569771d1c9536b76d2c6f8755f6f538ddd68dfbfacff3219ab84921556a74c23c26cfcf5bc0c7b6ed7180e4da909aa9b
SSDEEP 192:NJLl4+gykFIg79zWGxRJLx3x4f3Ry7u7lqsBZsH4sRsVGsHN:8yIalqsfsYsRsksHN
TLSH
T1A832C3527BFD1208F0F35F88EEFA65161A7ABD516D35C96C01601D0E4973E81C8A2FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Windows\TEMP\{53771BEE-3B7E-4D39-9150-B8E14AB0C6E7}\.ba\Wix4NetfxBootstrapperExtension_X64\x64\hostfxr.dll
Size 366KB
SHA256 cbde5e0bb9260e4ceeb0c7d774cb3aba0f885f150c9c8fe3922da4c71125f628
MD5 d78ba64f3c660b2af200757ae3a41688
SHA1 aef16497474845b15fc5a60494d53c79cc3e4961
SHA512 31aca945758bee357a6625440d910c49ad005695990028323a1e634be597ee047b25c36594c776d8776945e8363a8148ffebcd25ca77064d747889d2c0917fa4
SSDEEP 6144:6r6HIxaAxFwPGChDDJ4zHzqEnEA229D4Fc9xAyK:m6HIxhx6PGChczQylAyK
TLSH
T18E841916E2AC056CF1BBE23896B79901F6763C4A4770D6CF03A0416A2F77BD09E79721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{53771BEE-3B7E-4D39-9150-B8E14AB0C6E7}\.ba\thm.xml
Size 9KB
SHA256 c16ea9b2ddc6923f88e221f8d7885710bbf06cad100ef699e2cc5517a37a8999
MD5 b2e1d7355b36a58e88371fd7af0d3445
SHA1 55ed3283482b8b72ee8a78425e399ddb2897a70e
SHA512 e02f5b3950d2975ea158300c06718c3504842caadd9f4568e3cc688030e343f9cbb34d23547dfafda992ac3bf864ad5677488d7789e08381fdb6fadc518b3ae1
SSDEEP 96:8LaR45bsysWfPM0MRULyBsjPByR4GQBEc4LbOBcpR5wFpQ+l4roJLA1AEpeTFpwQ:hEbTDfk0IuYB7UpyQP
TLSH
T16312CAB556DDBC01C133E75267F321C2BF226D62C1C46949B84E26BB1FF211069B726D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.ico

Path C:\Windows\Temp\{53771BEE-3B7E-4D39-9150-B8E14AB0C6E7}\.ba\1036\icon.ico
Size 465KB
SHA256 f7a7aa48644508a9c624f4b9acdc8d03031bfd45097d93d7ac3337f34300ab6a
MD5 8b4cd6bea65a2fc8e1d5b3c90d989066
SHA1 4b1584d8e156a787f558d3df0df5ed2b8d204557
SHA512 b9d8d6c5380e4384a57a959b204170364eb77bd8e7d13ade5b76fae7c25f75181bdf4409d6c2ac8fd5d8b0c774add1be5f10eb8a497a21d5854e83b544cb7f4c
SSDEEP 6144:0cBs8McQBu2TKyWfHcUCh/424kSsww8XZ+5PH:dqLlSTO
TLSH
T1A3A4E98E6F385B8BD045597CED5E0C3BA4B87832018C9984F01245A48EB77FD69EFE58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{53771BEE-3B7E-4D39-9150-B8E14AB0C6E7}\.ba\1049\logo.png
Size 213KB
SHA256 e627a5a1d090adc3f85eb6c52dbcb6bd8b7b07b6395ebbf7f281235c929d7be2
MD5 594f3877cce1db2395acffbb6c182e4e
SHA1 7c7a7611f18641bcbceb8103c824880484697b53
SHA512 bcb0f8a7216cf88c5260d7cbe29f9dfd61b5e1ca66ea5f4805dc6e1095cc6e3a4d701279560fe01d4d08ba81e8cef7f12a25c32d648ed5e21f11e2278ed8392e
SSDEEP 3072:uqpMATGpZYP4slPMEmW6yEhz3vXFW3voRxeWTJkl9j7rigo8yq3EEZhdwK5/K8EW:bnqC4S0EuyG/1W/8x3TSahEZ8ySKlax0
TLSH
T1EB24027D89AD58E4D130407179AF5B3173BC508B8A18F9015769C8E6BDEF70BDCE2948
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{53771BEE-3B7E-4D39-9150-B8E14AB0C6E7}\.ba\1049\thm.xml
Size 9KB
SHA256 a85e2d8dc5484bc79de3dddca683eaadd3dc41a465406ded2b2fa5547537f026
MD5 5cf38e5c14ac2b3a781d514b0c5453a0
SHA1 7b0780a6e4b5934058b140d4b87a2007e5c60700
SHA512 7bd47336a220049b87d1389201086ffc566d0117cf79b8b42522925c381edcd43ebf8b487f00ab16b68a6b16acd1b2ab6516be4b9caa88c56d41878f6d6e206d
SSDEEP 96:8Laa45DsZCPx0MRULyBsjPByR4GQBEc4LbOBcpR5wFpQ+l4roJLA1AEpeTFpws4e:hRDYCp0IuYB7UpyQP
TLSH
T17D12CAB546DD7C01C233E75267F321C2BF226D62C1C46949B84E26BB1FF211069B726D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{53771BEE-3B7E-4D39-9150-B8E14AB0C6E7}\.ba\1055\thm.xml
Size 9KB
SHA256 e9bc981b0ef4d92f37c7a274e107850d5b9782473758505a7bd8effdc75e7505
MD5 42b7b3446ad2f50b3890bcd9467321c7
SHA1 2853f6256e8b7363f7e45172308938d02676c1d0
SHA512 8973b853e66cfe0a22d4fbd36d6b65804cdae4224249236cb91c371ca8187f81fd165b576492320d501f5fff77889f5d6eb4508a89133310745ea5a248ac9c87
SSDEEP 96:8Laa45DsZCPM0MRULyBsjPByR4GQBEc4LbOBcpR5wFpQ+l4roJLA1AEpeTFpws4e:hRDYCk0IuYB7UpyQP
TLSH
T11312CAB556DD7C01C233E75267F321C2BF226D62C1C46949B84E26BB1FF211069B726D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netfxbe.dll

Path C:\Windows\Temp\{53771BEE-3B7E-4D39-9150-B8E14AB0C6E7}\.ba\Wix4NetfxBootstrapperExtension_X64\netfxbe.dll
Size 188KB
SHA256 1292f29490e906e0f209396f6947b001618662996e96794ba1fc629cca72e58f
MD5 52f92596787d7a369324dada982770b6
SHA1 1f7295109033fcfffd3686a3a349390948ecf32c
SHA512 9b24a5928f035cb1cf5993a4e42d4f9f1fe9ccf1663d207ca593be13580db71bc1ac66018a45f29cf5369abbc5a6e90e717bb5fc2322af02993ddd10ba35f18f
SSDEEP 3072:Hbf8TLCKqnbuyHaL1Tmj1DCd8xV3y88oesjaYXWkFrh:HbU3CTiyHuYRxhTqk
TLSH
T170147C16B3E500BADDB78278C8934616FB72785517209BEF43A442799F2F3D0693EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netcoresearch.exe

Path C:\Windows\Temp\{53771BEE-3B7E-4D39-9150-B8E14AB0C6E7}\.ba\Wix4NetfxBootstrapperExtension_X64\x64\netcoresearch.exe
Size 161KB
SHA256 13c2f45ec7339d7aaa819a89dd2409885e225fadad1d91a02e9fad47e1d41b04
MD5 96df9976d2bb7bed6c631ecd0940f04a
SHA1 e34708be664dbed3f259563a14e301ad7dc68563
SHA512 8ae162a2cf7df7324223362eb12c1e48a896356b1f1ec7bb5d7180abcefb7e3322ad92b553d8b14a06609fd0048754046f451d85318eb8ca904cb5bb9c6e339c
SSDEEP 3072:REuaiIanSEAOiSwLgtduG9DwRpazhwe2o11nH:REuanEAO+Lkdf9DwRKp
TLSH
T100F37D57B3A030F9E1B38634C8A15616FB72B47517209BDF03A482751F276D1AE7EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{53771BEE-3B7E-4D39-9150-B8E14AB0C6E7}\.ba\wixstdba.exe
Size 495KB
SHA256 9eeaa3b84d2c7e1603780ad29b18c14c95f6ffa35ec63c59018160f71ba70267
MD5 1706c3ac35ff2c4e066cd780d6416f8a
SHA1 0f4d41e4bc9ca9378b53b1e232e85fd2fb054da8
SHA512 180331e2155cc765a2d84c5a9b91044e3b61695d1e518831b584235d4e74ce79cf52669e0fbdd5077c9e8464249dd83f4f41057d04a8ddebca82706bdfd5916a
SSDEEP 6144:u5hqWcsjJS0utF+89Kw7trrYrIVrFkzUmA5oUuL+S9fl7VTV:u5heseF59Kw7dErQaYmAfuL+0l7lV
TLSH
T10EB45CBA22F412E9C5FA82B5D581A131FF70714C371191EB8250893D6F3B9AA39BF345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiresock-secure-connect.exe

Path C:\Windows\Temp\{53771BEE-3B7E-4D39-9150-B8E14AB0C6E7}\.be\wiresock-secure-connect.exe
Size 2.5MB
SHA256 e4f1cd7406ebc9d51f2e0e4fba34330fcd63c1eccf7a6208e91f9a9112b58970
MD5 bd8e327797a4b5d49079c8dc75ddedc5
SHA1 c638449d93186e26fc09173423d7477fe2200c57
SHA512 24251837bfb0f7927c4d3b15ce71c41038689b79bb4f2cca785e839d143e7427d64c673f86168737161594296fba96ae390fa572336288eedd0d29c0c57c8cad
SSDEEP 49152:8wMOf70rT/eqs+8Rxkw75iHx1Qj8sBgmLNGKxaY80Co:QOf7Imqs3RDwQosbxGKs50l
TLSH
T1DEC5D07A37B421EAC0B947BAE9858532FE74711E332444A9D595852C2F3BBB825FF304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads