536e8b1207df3afebfae5d4d9f19e33948c04967c322ae1c02fae00bc3695346

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-02-2025 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bootstrapper/resources/app.asar.unpacked/node_modules/7zip/7zip-lite/7-zip.dll
Size

75KB
MD5

be4da8dc077889cd31deee3016c568cb
SHA1

b91e1ed8ecc28302c936adbb82ad600790e70352
SHA256

8d99a3fed7dd3b124a90330d33bffdf6f3ead4902dbd5fc9730d9bcc272641bf
SHA512

afd0841db04a3c2d07bc1b5a4c30fcf4124fcb054a4c4eb27e20f9d85c5eafc702579a445a614f0080438054b098ce1ef0fe141219a9aa6ba824d6c2fc5c5563
SSDEEP

1536:4IQsNOa3MZJQ+qBMrIVKpDx9B+aDdZKVNv4oJc1tP6CEFSVHaQZcDNhr9:43sVa2+qBmIV019caDdZKVNv4oJc1tPg

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bootstrapper\\resources\\app.asar.unpacked\\node_modules\\7zip\\7zip-lite\\7-zip.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bootstrapper\resources\app.asar.unpacked\node_modules\7zip\7zip-lite\7-zip.dll
1⤵
- Modifies registry class
PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads