217e2c6cdb392bc71d04ea9590b38234e8cbf9765f6a22793c00d2fb46a9d8f8

Analysis

max time kernel
298s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/04/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
190190.dll
Size 686KB
Sample260427-pshrpsew5m
SHA256 217e2c6cdb392bc71d04ea9590b38234e8cbf9765f6a22793c00d2fb46a9d8f8
MD5 bc129bddd1d2b3a0fd4f2e0e09ea45e5
SHA1 0e196130d1d7b640fa4b10a270397496593216dd
SHA512 a9b72bb51e40a8fb19f4e990a434968924d47fda84de8a2f5d04d04ae2a3ed0004786f6b0e3936bf6d97d3b6bac7e527c605d52ea73facb3ab14b3fc29fa4325
SSDEEP 12288:QXZVWbgiOHOY0n3JOWnmUE5icz6bF/l58s0KYKH5fCKaHdtbEhNyRM:QJsbgiOHE3JOWnmUE5iczUdC4ZwHPQPL
TLSH
T183E4AE8BE27000E1D1A6C570C65B977BEB71B45D1820E75A65B0C3837F0BBB48F2A75A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{153fbd8a-6c9b-4f39-aa3c-cc710bdd9008}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{153fbd8a-6c9b-4f39-aa3c-cc710bdd9008}\ = "SmartScreenUrl Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{153fbd8a-6c9b-4f39-aa3c-cc710bdd9008}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{153fbd8a-6c9b-4f39-aa3c-cc710bdd9008}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\190190.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{153fbd8a-6c9b-4f39-aa3c-cc710bdd9008}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\190190.dll
1⤵
- Modifies registry class
PID:2644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads