Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 00:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cb8fe8bc83a6a22ef2c9d0ce2dbcc8d0ec73b5c7322e0a7226ad8bd6e2e54849.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
cb8fe8bc83a6a22ef2c9d0ce2dbcc8d0ec73b5c7322e0a7226ad8bd6e2e54849.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target cb8fe8bc83a6a22ef2c9d0ce2dbcc8d0ec73b5c7322e0a7226ad8bd6e2e54849.dll
- Size 496KB
- Sample260729-a83pgssxcv
- SHA256 cb8fe8bc83a6a22ef2c9d0ce2dbcc8d0ec73b5c7322e0a7226ad8bd6e2e54849
- MD5 cda7add73cfe6dd6933db3e847c9f75f
- SHA1 acc8f5d778069cf84d33cdb58f9d5237a4a9c7e6
- SHA512 46deca9bcdf990437756b3b8a6632463443c29799ac85ba8c97b10b250396bbf8eec3d998eb3924aca4ca27a5b69ab1d47f0a7e710c36c5aa8840acc8cd73318
- SSDEEP 12288:6cPPpGHVLiC3kF/iMlV7dBhiBUTKlEbwg:6cPPYHLkF/iMlV7dBhiBUTKlEbwg
- TLSH T17AB4D515A3FA4069F1F797381E7B56206AB67D152FB0D1CF2258912E2E71FD0A870B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Print regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EEF9758-35FC-11D1-8CE4-00C04FC2B186}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F4DACB1-160D-11D2-A8E9-00104B365C9F}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F4DACB2-160D-11D2-A8E9-00104B365C9F} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3EEF9758-35FC-11D1-8CE4-00C04FC2B185}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EEF9758-35FC-11D1-8CE4-00C04FC2B186}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Print\Command regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EEF9758-35FC-11D1-8CE4-00C04FC2B187}\ = "ErrObj" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EEF9758-35FC-11D1-8CE4-00C04FC2B187}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F4DACA1-160D-11D2-A8E9-00104B365C9F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBScript.Encode\ = "VB Script Language Encoding" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBS\ = "VB Script Language" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptEngine regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EEF9758-35FC-11D1-8CE4-00C04FC2B186}\TypeLib regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ShellEx\DropHandler regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EEF9758-35FC-11D1-8CE4-00C04FC2B187}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EEF9758-35FC-11D1-8CE4-00C04FC2B187}\TypeLib\ = "{3EEF9758-35FC-11D1-8CE4-00C04FC2B185}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F4DACB3-160D-11D2-A8E9-00104B365C9F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EEF9758-35FC-11D1-8CE4-00C04FC2B186}\TypeLib\ = "{3EEF9758-35FC-11D1-8CE4-00C04FC2B185}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EEF9758-35FC-11D1-8CE4-00C04FC2B187}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F4DACB1-160D-11D2-A8E9-00104B365C9F} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ShellEx\PropertySheetHandlers regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ShellEx regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EEF9758-35FC-11D1-8CE4-00C04FC2B187} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F4DACA0-160D-11D2-A8E9-00104B365C9F}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F4DACB2-160D-11D2-A8E9-00104B365C9F}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F4DACB3-160D-11D2-A8E9-00104B365C9F}\ProxyStubClsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBScript\ = "VB Script Language" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ShellEx\PropertySheetHandlers\WSHProps regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptEngine regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F4DACA2-160D-11D2-A8E9-00104B365C9F} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptHostEncode regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptEngine\ = "VBScript" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "\"C:\\Windows\\system32\\notepad.exe\" %1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Print\Command regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3EEF9758-35FC-11D1-8CE4-00C04FC2B185}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3EEF9758-35FC-11D1-8CE4-00C04FC2B185}\1.0\ = "Microsoft VBScript Globals" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EEF9758-35FC-11D1-8CE4-00C04FC2B186}\ = "GlobalObj" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F4DACA1-160D-11D2-A8E9-00104B365C9F}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F4DACB0-160D-11D2-A8E9-00104B365C9F}\ProxyStubClsid regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "\"C:\\Windows\\system32\\wscript.exe\" \"%1\" %*" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3EEF9758-35FC-11D1-8CE4-00C04FC2B185}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3EEF9758-35FC-11D1-8CE4-00C04FC2B185}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EEF9758-35FC-11D1-8CE4-00C04FC2B187}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F4DACA0-160D-11D2-A8E9-00104B365C9F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBScript.RegExp\ = "VBScript Regular Expression" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\DefaultIcon regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ = "VBScript Script File" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EEF9758-35FC-11D1-8CE4-00C04FC2B186}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe