830bb3c4d06bb69575c84dc50258059ad609d6e7a820079bd2179179b6037583

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
830bb3c4d06bb69575c84dc50258059ad609d6e7a820079bd2179179b6037583.dll
Size 5.1MB
Sample260706-e8kk5ahy5v
SHA256 830bb3c4d06bb69575c84dc50258059ad609d6e7a820079bd2179179b6037583
MD5 132ed543001a44fda636c193e8bb6c18
SHA1 8a1c83dc5b14d8b71c839a21a6fc528b45071d97
SHA512 023b577808011c6eeea783fdb1d84ee58a304043d555079943f6ea4f20a0f925245745ed125db3821859460d02ddd60fd0801325a286107ad832cfe3c98d7e3f
SSDEEP 49152:cq7Cju0DRYbHHZWYe5JjbxSTZHTra8FLwPcKysCcBWZf+toiVf33ly+tzF/+N4GJ:Tau08ZHRjGttoiw+b/+S+UJ/wyC
TLSH
T124467D19696541A4C0A2C13CCAD38953E7727C084B75C7EB25A566FE2F33BE07A3B721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055AAB0-EACB-46DB-9BB4-1B97FC046D02}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\830bb3c4d06bb69575c84dc50258059ad609d6e7a820079bd2179179b6037583.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055AAB0-EACB-46DB-9BB4-1B97FC046D02}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055AAB0-EACB-46DB-9BB4-1B97FC046D02}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055AAB0-EACB-46DB-9BB4-1B97FC046D02}\ = "中文(简体) - 2345王牌拼音输入法"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055AAB0-EACB-46DB-9BB4-1B97FC046D02}\InprocServer32	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\830bb3c4d06bb69575c84dc50258059ad609d6e7a820079bd2179179b6037583.dll
1⤵
- Modifies registry class
PID:4384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads