9430965c7c980faa356025e139f983624fa67565d4c5b2cc776f698117325b60

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/06/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer/act/mstscax.dll
Size 8.0MB
Sample260608-vec7ysds3n
SHA256 9430965c7c980faa356025e139f983624fa67565d4c5b2cc776f698117325b60
MD5 96bd36ed3d5a04e8a9f44fd38b0bfa91
SHA1 6ad76494cad227633b01f52ed5bae6e28e2acb1d
SHA512 d2f4caf5a2c78c75ee267574775c996490b4f2c08e790075d6ab9e1dc07aa4e2f7153d4a8df6297f3928bf213b912de058606fe4b582ef400f1b40355e4ed09d
SSDEEP 196608:frDIdWVp5K3s3V3w7t0K9TkHge7nnB1IhTKMa4JVl8tkxQDdRfKez2mW5iIAa2tG:frDIdWVp5K3Q3w7t0K9TkHge7nnB1IhH
TLSH
T1A1865C18A3FC2054D4BAD23886454A1AFEB17C1C3F739ADB4066812A7F77ED15A38F16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 48 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D3E07363-087C-476C-86A7-DBB15F46DDB4}\ProxyStubClsid32\ = "{A1230201-1439-4E62-A414-190D0AC3D40E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B7ACC97-F3C9-46F7-8C5B-FA685D3441B1}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B7ACC97-F3C9-46F7-8C5B-FA685D3441B1}\NumMethods\ = "6"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1230201-1439-4E62-A414-190D0AC3D40E}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D3E07363-087C-476C-86A7-DBB15F46DDB4}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B7ACC97-F3C9-46F7-8C5B-FA685D3441B1}\ = "IWTSBitmapRenderer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1230201-1439-4E62-A414-190D0AC3D40E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1230205-D6A7-11D8-B9FD-000BDBD1F198}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1230205-D6A7-11D8-B9FD-000BDBD1F198}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1230206-9A39-4D58-8674-CDB4DFF4E73B}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1230207-D6A7-11D8-B9FD-000BDBD1F198}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1230203-D6A7-11D8-B9FD-000BDBD1F198}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1230204-D6A7-11D8-B9FD-000BDBD1F198}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D782928E-FE4E-4E77-AE90-9CD0B3E3B353}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D782928E-FE4E-4E77-AE90-9CD0B3E3B353}\ProxyStubClsid32\ = "{A1230201-1439-4E62-A414-190D0AC3D40E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA326091-05FE-40C1-B49C-3D2EF4626A0E}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1230203-D6A7-11D8-B9FD-000BDBD1F198}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1230207-D6A7-11D8-B9FD-000BDBD1F198}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1230207-D6A7-11D8-B9FD-000BDBD1F198}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D3E07363-087C-476C-86A7-DBB15F46DDB4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D782928E-FE4E-4E77-AE90-9CD0B3E3B353}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA326091-05FE-40C1-B49C-3D2EF4626A0E}\ = "IWTSBitmapRenderService"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA326091-05FE-40C1-B49C-3D2EF4626A0E}\NumMethods\ = "4"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B7ACC97-F3C9-46F7-8C5B-FA685D3441B1}\ProxyStubClsid32\ = "{A1230201-1439-4E62-A414-190D0AC3D40E}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D3E07363-087C-476C-86A7-DBB15F46DDB4}\ = "IWTSPluginServiceProvider"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D782928E-FE4E-4E77-AE90-9CD0B3E3B353}\ = "IWTSBitmapRendererCallback"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA326091-05FE-40C1-B49C-3D2EF4626A0E}\ProxyStubClsid32\ = "{A1230201-1439-4E62-A414-190D0AC3D40E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1230201-1439-4E62-A414-190D0AC3D40E}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1230205-D6A7-11D8-B9FD-000BDBD1F198}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1230206-9A39-4D58-8674-CDB4DFF4E73B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1230206-9A39-4D58-8674-CDB4DFF4E73B}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D3E07363-087C-476C-86A7-DBB15F46DDB4}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D782928E-FE4E-4E77-AE90-9CD0B3E3B353}\NumMethods\ = "4"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1230203-D6A7-11D8-B9FD-000BDBD1F198}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1230204-D6A7-11D8-B9FD-000BDBD1F198}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D3E07363-087C-476C-86A7-DBB15F46DDB4}\NumMethods\ = "4"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D782928E-FE4E-4E77-AE90-9CD0B3E3B353}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA326091-05FE-40C1-B49C-3D2EF4626A0E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA326091-05FE-40C1-B49C-3D2EF4626A0E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B7ACC97-F3C9-46F7-8C5B-FA685D3441B1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B7ACC97-F3C9-46F7-8C5B-FA685D3441B1}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1230201-1439-4E62-A414-190D0AC3D40E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1230201-1439-4E62-A414-190D0AC3D40E}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1230204-D6A7-11D8-B9FD-000BDBD1F198}\NumMethods	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Installer\act\mstscax.dll
1⤵
- Modifies registry class
PID:3540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads