4f762c665dc02b317ab4ecbfb6d9bbbdf2a9b73631cc1225688bc6f3c6498865

Analysis

max time kernel
898s
max time network
491s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aswAMSI.dll
Size 984KB
Sample260420-ds91eabz3y
SHA256 4f762c665dc02b317ab4ecbfb6d9bbbdf2a9b73631cc1225688bc6f3c6498865
MD5 2c287fd0558b7bddeac11ea4e5cb892c
SHA1 9ffff9a07c5fd215c163915ad1569c7f6830ee3e
SHA512 77800d0eb7376f2e9e96cbaee3d1168569ed518ce32fec0e69d5a61b2dc91f3b7dbe200c6d4058571acfeec1674f58eaf6c9663373794ba145ecceb1d8e3d5da
SSDEEP 24576:Ow0WuhtzpBt6rbYl1PJcVR+th0lhSMXlOytJOcV:OLZt7t6Hg1PSvZbt
TLSH
T116259E0BB79C40B9D4BEC1B9896B590AEE727896036157CB26E0DE151F27BE05F3E301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware persistence privilege_escalation spyware

Malware Config

Signatures

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	regsvr32.exe
Key opened	\REGISTRY\MACHINE\Software\Avira\Antivirus	regsvr32.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{0F130806-2047-44B1-95C0-589B935DE389}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTENSION VALIDATION\{0F130806-2047-44B1-95C0-589B935DE389}	regsvr32.exe

Modifies registry class 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC650FC4-FFD8-4C05-B3A5-F7A94D5629CC}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aswAMSI.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC650FC4-FFD8-4C05-B3A5-F7A94D5629CC}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC650FC4-FFD8-4C05-B3A5-F7A94D5629CC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F130806-2047-44B1-95C0-589B935DE389}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F130806-2047-44B1-95C0-589B935DE389}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC650FC4-FFD8-4C05-B3A5-F7A94D5629CC}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F130806-2047-44B1-95C0-589B935DE389}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F130806-2047-44B1-95C0-589B935DE389}\ = "Norton IExtensionValidation implementation"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F130806-2047-44B1-95C0-589B935DE389}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aswAMSI.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F130806-2047-44B1-95C0-589B935DE389}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F130806-2047-44B1-95C0-589B935DE389}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC650FC4-FFD8-4C05-B3A5-F7A94D5629CC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC650FC4-FFD8-4C05-B3A5-F7A94D5629CC}\ = "Norton IAntimalwareProvider implementation"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC650FC4-FFD8-4C05-B3A5-F7A94D5629CC}\InprocServer32	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\aswAMSI.dll
1⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
PID:1428