20c85a275cbd6ec43904db1ec62ed529c60f846ce3b5fceeb3f8ddcda8776c1f

Analysis

max time kernel
298s
max time network
302s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
190038.dll
Size 426KB
Sample260427-psby6aev2p
SHA256 20c85a275cbd6ec43904db1ec62ed529c60f846ce3b5fceeb3f8ddcda8776c1f
MD5 0140c541434f08b562460e7d0bc66f77
SHA1 b689d36622d58433877e2aa5e5dceb756256a477
SHA512 a492e2a6830a1e8fecbe9db9b412b99e447b129bdf395200ea6e81e1273a14c2e48518583d45da5ba97d323ac7f06d13f9874c7df303309ff6d407532cbf18ab
SSDEEP 6144:2Wq+PZps1dTn72ZeXiNWQWcqZPSRoc0r4Kdyj7XKUTa8m23d7KJKKWMJ8jo+ehAp:y+PZpKlnqZeXpvI7XHgZwKhJAea0
TLSH
T14F94BF67B6A14E73D267C134C5E26A62F772B151AF11830B0E74977E6EAB3F02E84311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8D12492-CE0F-40AD-83EA-099A03D493F1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\190038.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7DFFDF1-BD1F-450A-B98D-96B6D30BA4C1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\190038.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\190038.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EE84065-8BA3-4a8a-9542-6EC8B56A3378}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\190038.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8D12492-CE0F-40AD-83EA-099A03D493F1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7DFFDF1-BD1F-450A-B98D-96B6D30BA4C1}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EE84065-8BA3-4a8a-9542-6EC8B56A3378}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8D12492-CE0F-40AD-83EA-099A03D493F1}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\190038.dll
1⤵
- Modifies registry class
PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads