f8304c20b16ef167a55357aca9845041037e72697004af91cf62e3742aa75d97

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f8304c20b16ef167a55357aca9845041037e72697004af91cf62e3742aa75d97.dll
Size 8.2MB
Sample260506-ssh91shx9j
SHA256 f8304c20b16ef167a55357aca9845041037e72697004af91cf62e3742aa75d97
MD5 cdfc785e079ff24673f24624d757fa45
SHA1 0d708a875c4d885adf2e2a7b80843c51dbecf64a
SHA512 e7e35c4db1c3d628ce8186f72c485517d08bf43ca991a2633da0b970b3ce65b3a69e12a3f926851ee0d494e653bfe7f2e923fdf9612eed11192e294677163c5e
SSDEEP 49152:/6Sa4Fin3gBNpIDfa7LoGAdI2bT4UXxrr9lRmAyvTaT4rI+M9NlUwYAHR5+iHhaz:vA3R7GM7So5+iHhaJHfsh6
TLSH
T198864A7B6075D138C1A8C57AC8978F52E63170BA0739C3F72A8153D61B26AC8E93D7B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{650EC530-A854-4C4B-818F-4CE4B2FC8E0E}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79A8B19F-70B8-4DC9-A55D-471BD231BA32}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E099F6C6-FF05-42E1-8C12-867DCF182B23}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f8304c20b16ef167a55357aca9845041037e72697004af91cf62e3742aa75d97.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{697D231C-23DA-4063-9126-A9130BC1AB0A}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4682F3A0-FAC9-4141-BC44-AE2841EE694F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E058F7B-EAC2-4336-969C-440506858373}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{700525C7-4A76-4EF7-AFE9-07D1F5BC3C05}\ProgID\ = "GrandDogCom.GrandDog"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{697D231C-23DA-4063-9126-A9130BC1AB0A}\TypeLib\ = "{6EEF960F-28E8-454E-B3D7-2DBF07CED011}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{26D93518-E397-448E-88A1-8F337E3A7F34}\TypeLib\ = "{6EEF960F-28E8-454E-B3D7-2DBF07CED011}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{700525C7-4A76-4EF7-AFE9-07D1F5BC3C05}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4280FE56-ABCB-4F6F-9A63-E5FD0E61A46D}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{697D231C-23DA-4063-9126-A9130BC1AB0A}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GSCEngine.GSCParameter\Clsid\ = "{E099F6C6-FF05-42E1-8C12-867DCF182B23}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4280FE56-ABCB-4F6F-9A63-E5FD0E61A46D}\Implemented Categories\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79A8B19F-70B8-4DC9-A55D-471BD231BA32}\ = "IGSCLicense"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{064573FB-C755-4C20-A36F-8E64AB65875D}\TypeLib\ = "{6EEF960F-28E8-454E-B3D7-2DBF07CED011}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F584A44-9677-416D-8725-4853C696DC67}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E099F6C6-FF05-42E1-8C12-867DCF182B23}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ADC854A1-D487-48C7-83FE-1156A39165C1}\TypeLib\ = "{6EEF960F-28E8-454E-B3D7-2DBF07CED011}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A65379FE-445E-4BB2-892D-8D7B8F0A2401}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{793B6EC5-FABD-4A3F-AC50-5D5662169365}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GSCEngine.GSCAppManager\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E099F6C6-FF05-42E1-8C12-867DCF182B23}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{064573FB-C755-4C20-A36F-8E64AB65875D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{26D93518-E397-448E-88A1-8F337E3A7F34}\ = "IGSCProductList"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{793B6EC5-FABD-4A3F-AC50-5D5662169365}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ADC854A1-D487-48C7-83FE-1156A39165C1}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ADC854A1-D487-48C7-83FE-1156A39165C1}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00A62FEC-7572-4197-8D58-741028A3EBDD}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79A8B19F-70B8-4DC9-A55D-471BD231BA32}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68C9DE43-9490-49A7-97C5-120C67399123}\TypeLib\Version = "3.5"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GSCEngine.GSCAppManager	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4280FE56-ABCB-4F6F-9A63-E5FD0E61A46D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B85B3111-5579-49C3-AD67-B710138CBC9F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79A8B19F-70B8-4DC9-A55D-471BD231BA32}\ = "IGSCLicense"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79A8B19F-70B8-4DC9-A55D-471BD231BA32}\TypeLib\Version = "3.5"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68C9DE43-9490-49A7-97C5-120C67399123}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E058F7B-EAC2-4336-969C-440506858373}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E058F7B-EAC2-4336-969C-440506858373}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E058F7B-EAC2-4336-969C-440506858373}\TypeLib\Version = "3.5"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{793B6EC5-FABD-4A3F-AC50-5D5662169365}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f8304c20b16ef167a55357aca9845041037e72697004af91cf62e3742aa75d97.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E099F6C6-FF05-42E1-8C12-867DCF182B23}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{650EC530-A854-4C4B-818F-4CE4B2FC8E0E}\TypeLib\Version = "3.5"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{650EC530-A854-4C4B-818F-4CE4B2FC8E0E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C89C00EE-0334-429C-BFFC-2683330B084F}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{700525C7-4A76-4EF7-AFE9-07D1F5BC3C05}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{793B6EC5-FABD-4A3F-AC50-5D5662169365}\Version\ = "3.5"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E099F6C6-FF05-42E1-8C12-867DCF182B23}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E099F6C6-FF05-42E1-8C12-867DCF182B23}\Version\ = "3.5"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C89C00EE-0334-429C-BFFC-2683330B084F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{793B6EC5-FABD-4A3F-AC50-5D5662169365}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{793B6EC5-FABD-4A3F-AC50-5D5662169365}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ADC854A1-D487-48C7-83FE-1156A39165C1}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79A8B19F-70B8-4DC9-A55D-471BD231BA32}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F584A44-9677-416D-8725-4853C696DC67}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E099F6C6-FF05-42E1-8C12-867DCF182B23}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4464794E-7B7F-4576-A5B9-A81295798F4E}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GSCEngine.GSCLicense\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00A62FEC-7572-4197-8D58-741028A3EBDD}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f8304c20b16ef167a55357aca9845041037e72697004af91cf62e3742aa75d97.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E058F7B-EAC2-4336-969C-440506858373}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C89C00EE-0334-429C-BFFC-2683330B084F}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{793B6EC5-FABD-4A3F-AC50-5D5662169365}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4280FE56-ABCB-4F6F-9A63-E5FD0E61A46D}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5068	regsvr32.exe
5068	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f8304c20b16ef167a55357aca9845041037e72697004af91cf62e3742aa75d97.dll
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5068-0-0x0000000002820000-0x000000000305F000-memory.dmp

Download

memory/5068-2-0x0000000002F50000-0x0000000002F51000-memory.dmp

Download

memory/5068-3-0x0000000002820000-0x000000000305F000-memory.dmp

Download

memory/5068-4-0x0000000000D70000-0x0000000000F1C000-memory.dmp

Download

memory/5068-5-0x0000000002820000-0x000000000305F000-memory.dmp

Download

memory/5068-6-0x0000000002820000-0x000000000305F000-memory.dmp

Download