cc6920f5e93bf9faeb2ef179d8bd7bd074149211f5f038167bea1e5303a7a9e5

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/04/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
active_desktop_render_x64.dll
Size 7.9MB
Sample260416-e9ndeafv2r
SHA256 cc6920f5e93bf9faeb2ef179d8bd7bd074149211f5f038167bea1e5303a7a9e5
MD5 dc4620ced97044d5c7d1098bf1ddc9e1
SHA1 8e2edb1e1b2e4945c827638a42a8b6be12f0fb63
SHA512 ea578d743a07ea37a5b79dcde15d9736b6726f487add52100bbd01d399e76ccfe4d7e4d0eda7803ee2bf3ffd836b9810cff81e8d1509c5ceeea70c02ec9cce71
SSDEEP 98304:mV+froMl4BJrRpELtOzYIsGA37WpYw13TDIanf/tg:m8Vl4zHFsBCyaf/t
TLSH
T1C08633269BDDA4D3D3C7597841348A01B38A7053163FAD32B44C69624AFE18B36EDF27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

upx

Malware Config

Signatures

Manipulates Digital Signatures 1 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File opened for modification	C:\Windows\system32\wintrust.dll	regsvr32.exe

Executes dropped EXE 1 IoCs

pid	Process
2692	regsvr32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\catsrv.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\dafpos.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\UevTemplateBaselineGenerator.exe	regsvr32.exe
File opened for modification	C:\Windows\system32\Windows.Media.BackgroundMediaPlayback.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\AppxProvisioning.xml	regsvr32.exe
File opened for modification	C:\Windows\system32\INETRES.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\KBDBLR.DLL	regsvr32.exe
File opened for modification	C:\Windows\system32\kbdnec.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\SrpUxNativeSnapIn.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\wsmanconfig_schema.xml	regsvr32.exe
File opened for modification	C:\Windows\system32\WsmRes.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\dataclen.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\FDResPub.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\hvhostsvc.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\WUDFPlatform.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\CryptoWinRT.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\imgutil.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\InputService.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\rasdiag.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\vmdevicehost.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\aeinv.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\inseng.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\ngcrecovery.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\PushToInstall.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\wlidres.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\@language_notification_icon.png	regsvr32.exe
File opened for modification	C:\Windows\system32\MSPhotography.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\typeperf.exe	regsvr32.exe
File opened for modification	C:\Windows\system32\ucsvc.exe	regsvr32.exe
File opened for modification	C:\Windows\system32\Defrag.exe	regsvr32.exe
File opened for modification	C:\Windows\system32\devmgmt.msc	regsvr32.exe
File opened for modification	C:\Windows\system32\directml.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\NgcProCsp.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\qdvd.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\Windows.CloudStore.Schema.Shell.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\credprovs.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\KBDMONMO.DLL	regsvr32.exe
File opened for modification	C:\Windows\system32\win32kbase.sys	regsvr32.exe
File opened for modification	C:\Windows\system32\CSystemEventsBrokerClient.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\LockHostingFramework.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\eapputil.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\mfh264enc.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\Mystify.scr	regsvr32.exe
File opened for modification	C:\Windows\system32\profsvc.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\schedsvc.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\advpack.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\devinv.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\Windows.Internal.CapturePicker.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\winhttpcom.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\spwizres.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\Windows.Security.Authentication.OnlineId.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\BootMenuUX.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\DialogBlockingManager.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\energyprov.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\fltLib.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\iemigplugin.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\dabapi.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\iscsicpl.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\MP43DECD.DLL	regsvr32.exe
File opened for modification	C:\Windows\system32\wosc.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\rdpsharercom.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\tsdiscon.exe	regsvr32.exe
File opened for modification	C:\Windows\system32\Windows.Internal.Graphics.Display.DisplayEnhancementManagement.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\Windows.UI.Shell.dll	regsvr32.exe

Modifies termsrv.dll 1 TTPs 1 IoCs

Commonly used to allow simultaneous RDP sessions.

Remote Desktop Protocol

T1021.001

description	ioc	Process
File opened for modification	C:\Windows\system32\termsrv.dll	regsvr32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral13/memory/5356-0-0x00007FFE7D330000-0x00007FFE7D7D5000-memory.dmp	upx
behavioral13/memory/5356-10-0x00007FFE7D330000-0x00007FFE7D7D5000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	regsvr32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5356	regsvr32.exe
5356	regsvr32.exe
5356	regsvr32.exe
5356	regsvr32.exe
5356	regsvr32.exe
5356	regsvr32.exe
5356	regsvr32.exe
5356	regsvr32.exe
5356	regsvr32.exe
5356	regsvr32.exe
5356	regsvr32.exe
5356	regsvr32.exe
5356	regsvr32.exe
5356	regsvr32.exe
5356	regsvr32.exe
5356	regsvr32.exe
5356	regsvr32.exe
5356	regsvr32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5356 wrote to memory of 2692	5356	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\active_desktop_render_x64.dll
1⤵
- Manipulates Digital Signatures
- Drops file in System32 directory
- Modifies termsrv.dll
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5356
- C:\ProgramData\LavenderOrchid\regsvr32.exe
  "C:\ProgramData\LavenderOrchid\regsvr32.exe"
  2⤵
  - Executes dropped EXE
  PID:2692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

regsvr32.exe

Path C:\ProgramData\LavenderOrchid\regsvr32.exe
Size 24KB
SHA256 022cb167a29a32dae848be91aef721c74f1975af151807dafcc5ed832db246b7
MD5 b0c2fa35d14a9fad919e99d9d75e1b9e
SHA1 8d7c2fd354363daee63e8f591ec52fa5d0e23f6f
SHA512 a6155e42b605425914d1bf745d9b2b5ed57976e161384731c6821a1f8fa2bc3207a863ae45d6ad371ac82733b72bb024204498baa4fb38ad46c6d7bc52e5a022
SSDEEP 384:n5Y3wBQ8l/m60z+G7XU9I6ExBOMDl16AvcX9dp/Ql7YQCrA2WrcLHW:n5Yg3l/mTRXU9FeGpX9dp/47tCnL
TLSH
T1C4B21A0897EA2499E5BA973998F31225D771353117014FFF39E4823A0F22BD19E36F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5356-0-0x00007FFE7D330000-0x00007FFE7D7D5000-memory.dmp

Download

memory/5356-10-0x00007FFE7D330000-0x00007FFE7D7D5000-memory.dmp

Download

memory/5356-9-0x0000000003390000-0x0000000003398000-memory.dmp

Download