cc6920f5e93bf9faeb2ef179d8bd7bd074149211f5f038167bea1e5303a7a9e5

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
active_desktop_render_x64.dll
Size 7.9MB
Sample260416-e9ndeafv2r
SHA256 cc6920f5e93bf9faeb2ef179d8bd7bd074149211f5f038167bea1e5303a7a9e5
MD5 dc4620ced97044d5c7d1098bf1ddc9e1
SHA1 8e2edb1e1b2e4945c827638a42a8b6be12f0fb63
SHA512 ea578d743a07ea37a5b79dcde15d9736b6726f487add52100bbd01d399e76ccfe4d7e4d0eda7803ee2bf3ffd836b9810cff81e8d1509c5ceeea70c02ec9cce71
SSDEEP 98304:mV+froMl4BJrRpELtOzYIsGA37WpYw13TDIanf/tg:m8Vl4zHFsBCyaf/t
TLSH
T1C08633269BDDA4D3D3C7597841348A01B38A7053163FAD32B44C69624AFE18B36EDF27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

upx

Malware Config

Signatures

Manipulates Digital Signatures 1 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File opened for modification	C:\Windows\system32\wintrust.dll	regsvr32.exe

Executes dropped EXE 1 IoCs

pid	Process
4936	regsvr32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\cs-CZ	regsvr32.exe
File opened for modification	C:\Windows\system32\HrtfApo.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\KBDFTHRK.DLL	regsvr32.exe
File opened for modification	C:\Windows\system32\riched32.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\WinHvPlatform.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\WorkFoldersRes.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\CredProvHelper.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\wshext.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\scksp.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\spnet.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\fwbase.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\keepaliveprovider.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\PointOfService	regsvr32.exe
File opened for modification	C:\Windows\system32\SettingsHandlers_AnalogShell.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\simpdata.tlb	regsvr32.exe
File opened for modification	C:\Windows\system32\Windows.Internal.ShellCommon.PrintExperience.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\chs_singlechar_pinyin.dat	regsvr32.exe
File opened for modification	C:\Windows\system32\eapputil.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\gpresult.exe	regsvr32.exe
File opened for modification	C:\Windows\system32\KBDSORA.DLL	regsvr32.exe
File opened for modification	C:\Windows\system32\mspatchc.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\onnxruntime.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\provops.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\C_20003.NLS	regsvr32.exe
File opened for modification	C:\Windows\system32\netutils.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\PrintWSDAHost.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\RMapi.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\SecurityAndMaintenance.png	regsvr32.exe
File opened for modification	C:\Windows\system32\sihost.exe	regsvr32.exe
File opened for modification	C:\Windows\system32\KBDVNTC.DLL	regsvr32.exe
File opened for modification	C:\Windows\system32\lcptr.tbl	regsvr32.exe
File opened for modification	C:\Windows\system32\LocationWinPalMisc.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\ResBParser.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\DeviceCredentialDeployment.exe	regsvr32.exe
File opened for modification	C:\Windows\system32\dmcertinst.exe	regsvr32.exe
File opened for modification	C:\Windows\system32\EsdSip.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\MsSpellCheckingHost.exe	regsvr32.exe
File opened for modification	C:\Windows\system32\netdiagfx.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\RTMediaFrame.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\vss_ps.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\Windows.ApplicationModel.Wallet.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\C_857.NLS	regsvr32.exe
File opened for modification	C:\Windows\system32\diagperf.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\gpedit.msc	regsvr32.exe
File opened for modification	C:\Windows\system32\makecab.exe	regsvr32.exe
File opened for modification	C:\Windows\system32\Windows.Media.Import.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\wininet.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\wshelper.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\agentactivationruntimestarter.exe	regsvr32.exe
File opened for modification	C:\Windows\system32\comsvcs.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\prauthproviders.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\sk-SK	regsvr32.exe
File opened for modification	C:\Windows\system32\ISM.exe	regsvr32.exe
File opened for modification	C:\Windows\system32\stdole32.tlb	regsvr32.exe
File opened for modification	C:\Windows\system32\sxssrv.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\Windows.UI.Cred.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\xwizard.exe	regsvr32.exe
File opened for modification	C:\Windows\system32\bridgeres.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\dmcfgutils.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\remoteaudioendpoint.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\BthTelemetry.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\dxdiagn.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\iscsiexe.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\sharemediacpl.dll	regsvr32.exe

Modifies termsrv.dll 1 TTPs 1 IoCs

Commonly used to allow simultaneous RDP sessions.

Remote Desktop Protocol

T1021.001

description	ioc	Process
File opened for modification	C:\Windows\system32\termsrv.dll	regsvr32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral14/memory/1592-0-0x00007FFCA1BA0000-0x00007FFCA2045000-memory.dmp	upx
behavioral14/memory/1592-9-0x00007FFCA1BA0000-0x00007FFCA2045000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	regsvr32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 4936	1592	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\active_desktop_render_x64.dll
1⤵
- Manipulates Digital Signatures
- Drops file in System32 directory
- Modifies termsrv.dll
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1592
- C:\ProgramData\LavenderOrchid\regsvr32.exe
  "C:\ProgramData\LavenderOrchid\regsvr32.exe"
  2⤵
  - Executes dropped EXE
  PID:4936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

regsvr32.exe

Path C:\ProgramData\LavenderOrchid\regsvr32.exe
Size 44KB
SHA256 dab97346901ae36ddc4553255da518c4128efd426613cbb66b242daba210c97b
MD5 0c9318bbe9a07725154ace027acf7655
SHA1 d0117cd590b83ffdf9971c9826314aaacaca7a0f
SHA512 400fe720db42ea714b872caae40bff95a391ffcd906e44f195f88a571b0709c872b3d8f3e26e29d6ad705bf24679e0e1fedcad8652be3a09a96a18bb812ce29f
SSDEEP 384:xHzYGd+cUyATtngJlRtGdAPGYHVPJGyfm8NtCFQQl/GMk1OrAuWrDLHW:xTYF9DtngJl2dAPxPJW8NyQ4/i1O4L
TLSH
T12F131A0C97E52099E5BA5A3D9CA31126977135312B018EFF39E4C63A0F336D19E35F1A
MD5 SHA1 SHA512 SSDEEP TLSH