Analysis
- max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/07/2026, 23:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b1d79b8f52411b547c7bb4dab7c4517e308f897efdb6fc9aa033264ec0672bff.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
b1d79b8f52411b547c7bb4dab7c4517e308f897efdb6fc9aa033264ec0672bff.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target b1d79b8f52411b547c7bb4dab7c4517e308f897efdb6fc9aa033264ec0672bff.dll
- Size 130KB
- Sample260726-3bgd7ssflb
- SHA256 b1d79b8f52411b547c7bb4dab7c4517e308f897efdb6fc9aa033264ec0672bff
- MD5 555662b98b9c77afbf01310e7da90c63
- SHA1 fafaf938d74cdcc42e9c992a0d6284ce3990aacb
- SHA512 f20e2a77c54ab6facbbb9f7e396bac30d4b85388673d1880c7386e53e6dc2690dfd67c27fe58df71f59fbbd0418263c86577fa927379a87fffd9c4de187548d2
- SSDEEP 3072:bnnNzA/9qVvHHL/Ci8YxBkDf6YipfGkEqzXDyM5HeU:TNzA/9qRHr/C4xaD6LEqzE
- TLSH T132D34A47B7A840B6D0678139C9934A85EBB3BC450B6153CF6728A75E2F337D1AD3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Modifies registry class 60 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4310BA89-5E70-4424-A933-030DFCAD89C3}\VersionIndependentProgID\ = "AddIn4PPT.SinkEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AB7E10A5-4E2E-4D0E-BB94-C1654984C058}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AB7E10A5-4E2E-4D0E-BB94-C1654984C058}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{03B99749-50FE-4A16-9689-7036A0B4625A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{03B99749-50FE-4A16-9689-7036A0B4625A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Interface regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4310BA89-5E70-4424-A933-030DFCAD89C3}\ProgID\ = "AddIn4PPT.SinkEvents.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AB7E10A5-4E2E-4D0E-BB94-C1654984C058} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AB7E10A5-4E2E-4D0E-BB94-C1654984C058}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4310BA89-5E70-4424-A933-030DFCAD89C3}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AB7E10A5-4E2E-4D0E-BB94-C1654984C058}\1.0\0\win64 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03B99749-50FE-4A16-9689-7036A0B4625A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03B99749-50FE-4A16-9689-7036A0B4625A}\NumMethods\ = "7" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AddIn4PPT.SinkEvents regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AddIn4PPT.SinkEvents\CLSID\ = "{4310BA89-5E70-4424-A933-030DFCAD89C3}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AddIn4PPT.SinkEvents\CurVer\ = "AddIn4PPT.SinkEvents.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AB7E10A5-4E2E-4D0E-BB94-C1654984C058}\1.0\ = "AddIn4PPT 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AB7E10A5-4E2E-4D0E-BB94-C1654984C058}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03B99749-50FE-4A16-9689-7036A0B4625A}\TypeLib\ = "{AB7E10A5-4E2E-4D0E-BB94-C1654984C058}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{03B99749-50FE-4A16-9689-7036A0B4625A}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4310BA89-5E70-4424-A933-030DFCAD89C3}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03B99749-50FE-4A16-9689-7036A0B4625A}\ProxyStubClsid32\ = "{03B99749-50FE-4A16-9689-7036A0B4625A}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4310BA89-5E70-4424-A933-030DFCAD89C3}\TypeLib\ = "{AB7E10A5-4E2E-4D0E-BB94-C1654984C058}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03B99749-50FE-4A16-9689-7036A0B4625A}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\AddIn4PPT.DLL regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4310BA89-5E70-4424-A933-030DFCAD89C3}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03B99749-50FE-4A16-9689-7036A0B4625A}\ = "ISinkEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03B99749-50FE-4A16-9689-7036A0B4625A}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{03B99749-50FE-4A16-9689-7036A0B4625A}\ = "ISinkEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AddIn4PPT.SinkEvents\ = "SinkEvents Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AddIn4PPT.SinkEvents\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AddIn4PPT.SinkEvents.1\ = "SinkEvents Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FC23233B-72FC-452E-B5B4-C0F8DF4DC468}\ = "AddIn4PPT" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4310BA89-5E70-4424-A933-030DFCAD89C3}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03B99749-50FE-4A16-9689-7036A0B4625A}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b1d79b8f52411b547c7bb4dab7c4517e308f897efdb6fc9aa033264ec0672bff.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AB7E10A5-4E2E-4D0E-BB94-C1654984C058}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b1d79b8f52411b547c7bb4dab7c4517e308f897efdb6fc9aa033264ec0672bff.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{03B99749-50FE-4A16-9689-7036A0B4625A}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{03B99749-50FE-4A16-9689-7036A0B4625A}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AddIn4PPT.SinkEvents.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4310BA89-5E70-4424-A933-030DFCAD89C3}\ = "SinkEvents Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4310BA89-5E70-4424-A933-030DFCAD89C3}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4310BA89-5E70-4424-A933-030DFCAD89C3}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AB7E10A5-4E2E-4D0E-BB94-C1654984C058}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AddIn4PPT.SinkEvents.1\CLSID\ = "{4310BA89-5E70-4424-A933-030DFCAD89C3}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4310BA89-5E70-4424-A933-030DFCAD89C3} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AB7E10A5-4E2E-4D0E-BB94-C1654984C058}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03B99749-50FE-4A16-9689-7036A0B4625A} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4310BA89-5E70-4424-A933-030DFCAD89C3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b1d79b8f52411b547c7bb4dab7c4517e308f897efdb6fc9aa033264ec0672bff.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{03B99749-50FE-4A16-9689-7036A0B4625A}\TypeLib\ = "{AB7E10A5-4E2E-4D0E-BB94-C1654984C058}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03B99749-50FE-4A16-9689-7036A0B4625A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03B99749-50FE-4A16-9689-7036A0B4625A}\ = "PSFactoryBuffer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03B99749-50FE-4A16-9689-7036A0B4625A}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\AddIn4PPT.DLL\AppID = "{FC23233B-72FC-452E-B5B4-C0F8DF4DC468}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03B99749-50FE-4A16-9689-7036A0B4625A}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FC23233B-72FC-452E-B5B4-C0F8DF4DC468} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AddIn4PPT.SinkEvents.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AddIn4PPT.SinkEvents\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03B99749-50FE-4A16-9689-7036A0B4625A}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03B99749-50FE-4A16-9689-7036A0B4625A}\NumMethods regsvr32.exe