81d083300a2c836da6c3b0b9a77b86db4702312586eda2c9b2e85fbc36a16da6

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VeeamLicense.dll
Size 597KB
Sample260602-ffk7mady7t
SHA256 81d083300a2c836da6c3b0b9a77b86db4702312586eda2c9b2e85fbc36a16da6
MD5 230f176c6185fed928168d89ab5f76b2
SHA1 aa9e35e9d761852cd87a9e59cd9ff8d7d29bc08a
SHA512 1448f2f572fec567c9ea431229c8f0884cc769c4e525ff538208463b4451860a6ef3bce61d4597c351996bbda1bbac54019306b73d8f9f3836c818633ece2cea
SSDEEP 6144:cNuLd5CjCnNrCPVJ7M/FA7UsdnpQ0sZ4WGqbMsyRe3VX9Voh9AIR/xJXLw:37CjgrCPVrRp95WeReJjov0
TLSH
T14FD45B1AB7A842B5E077D13488A38606E7B2B8061B3097DF43E0536E5F777E15E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EDF04440-BDF9-430F-BC52-6F8E1EFF7071}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{627BB9DA-1AA5-494A-B522-F23BA5A4DC48}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EDF04440-BDF9-430F-BC52-6F8E1EFF7071}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9637024E-5028-4A41-8C14-E95B372CA51D}\TypeLib\ = "{00B2A12C-5076-44D8-8CEF-D6B4E965E17B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9637024E-5028-4A41-8C14-E95B372CA51D}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0434CA7D-C523-4680-B24A-A47F368AA3DC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VeeamLicense.VeeamLicense.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VeeamLicense.VeeamLicenseStore.1\ = "VeeamLicenseStore Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00B2A12C-5076-44D8-8CEF-D6B4E965E17B}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VeeamLicense.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{627BB9DA-1AA5-494A-B522-F23BA5A4DC48}\TypeLib\ = "{00B2A12C-5076-44D8-8CEF-D6B4E965E17B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A9D80C30-CD75-4EF2-B73E-DD6A50565A29}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VeeamLicense.VeeamLicense\CLSID\ = "{0B9ACAEA-1F38-47FB-8608-17E19FF58150}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VeeamLicense.VeeamLicenseManager\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0E64AD8-870C-439C-97BE-089D87FAF520}\TypeLib\ = "{00B2A12C-5076-44D8-8CEF-D6B4E965E17B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00B2A12C-5076-44D8-8CEF-D6B4E965E17B}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9637024E-5028-4A41-8C14-E95B372CA51D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0434CA7D-C523-4680-B24A-A47F368AA3DC}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{627BB9DA-1AA5-494A-B522-F23BA5A4DC48}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A9D80C30-CD75-4EF2-B73E-DD6A50565A29}\ = "IVeeamLicense"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EDF04440-BDF9-430F-BC52-6F8E1EFF7071}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VeeamLicense.CheckResult\ = "CheckResult Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0434CA7D-C523-4680-B24A-A47F368AA3DC}\VersionIndependentProgID\ = "VeeamLicense.CheckResult"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VeeamLicense.VeeamLicense\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA198767-9F5F-4FD1-993C-C4FC098BA1A9}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A9D80C30-CD75-4EF2-B73E-DD6A50565A29}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EDF04440-BDF9-430F-BC52-6F8E1EFF7071}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9637024E-5028-4A41-8C14-E95B372CA51D}\ = "IVeeamLicenseManager"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VeeamLicense.CheckResult\CLSID\ = "{0434CA7D-C523-4680-B24A-A47F368AA3DC}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VeeamLicense.VeeamLicense.1\ = "VeeamLicense Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0B9ACAEA-1F38-47FB-8608-17E19FF58150}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0B9ACAEA-1F38-47FB-8608-17E19FF58150}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VeeamLicense.VeeamLicenseManager.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA198767-9F5F-4FD1-993C-C4FC098BA1A9}\ = "VeeamLicenseManager Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VeeamLicense.VeeamLicenseStore\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VeeamLicense.VeeamLicenseStore\CurVer\ = "VeeamLicense.VeeamLicenseStore.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{25ED4646-192A-42E5-9806-3412AC53B2A9}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VeeamLicense.VeeamLicenseManager.1\ = "VeeamLicenseManager Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA198767-9F5F-4FD1-993C-C4FC098BA1A9}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0E64AD8-870C-439C-97BE-089D87FAF520}\ProgID\ = "VeeamLicense.VeeamLicenseStore.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0E64AD8-870C-439C-97BE-089D87FAF520}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VeeamLicense.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{627BB9DA-1AA5-494A-B522-F23BA5A4DC48}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9D80C30-CD75-4EF2-B73E-DD6A50565A29}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EDF04440-BDF9-430F-BC52-6F8E1EFF7071}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VeeamLicense.CheckResult\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VeeamLicense.VeeamLicenseManager\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00B2A12C-5076-44D8-8CEF-D6B4E965E17B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9D80C30-CD75-4EF2-B73E-DD6A50565A29}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EDF04440-BDF9-430F-BC52-6F8E1EFF7071}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EDF04440-BDF9-430F-BC52-6F8E1EFF7071}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9637024E-5028-4A41-8C14-E95B372CA51D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9637024E-5028-4A41-8C14-E95B372CA51D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VeeamLicense.CheckResult.1\ = "CheckResult Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VeeamLicense.CheckResult.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA198767-9F5F-4FD1-993C-C4FC098BA1A9}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VeeamLicense.VeeamLicenseStore\CLSID\ = "{F0E64AD8-870C-439C-97BE-089D87FAF520}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A9D80C30-CD75-4EF2-B73E-DD6A50565A29}\TypeLib\ = "{00B2A12C-5076-44D8-8CEF-D6B4E965E17B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9D80C30-CD75-4EF2-B73E-DD6A50565A29}\ = "IVeeamLicense"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EDF04440-BDF9-430F-BC52-6F8E1EFF7071}\TypeLib\ = "{00B2A12C-5076-44D8-8CEF-D6B4E965E17B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9637024E-5028-4A41-8C14-E95B372CA51D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00B2A12C-5076-44D8-8CEF-D6B4E965E17B}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{627BB9DA-1AA5-494A-B522-F23BA5A4DC48}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA198767-9F5F-4FD1-993C-C4FC098BA1A9}\VersionIndependentProgID\ = "VeeamLicense.VeeamLicenseManager"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0E64AD8-870C-439C-97BE-089D87FAF520}\ = "VeeamLicenseStore Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0B9ACAEA-1F38-47FB-8608-17E19FF58150}\InprocServer32	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\VeeamLicense.dll
1⤵
- Modifies registry class
PID:3248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads