13736b2c670c88e85834cb15c6d842545412138a91f0afa3fa6aa018484be168

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
13736b2c670c88e85834cb15c6d842545412138a91f0afa3fa6aa018484be168.dll
Size 889KB
Sample260806-e6vy3sfg36
SHA256 13736b2c670c88e85834cb15c6d842545412138a91f0afa3fa6aa018484be168
MD5 60aea166f40c1d88550897b860a3e68c
SHA1 e00c37d2609d8af4b66bb9ca10ab29fbfc9a8e27
SHA512 2a265f4fe39020af64313093a4a9993784b7f223743f7e671ba36f8a83e12ebd58b0d99268037f0c26208755b1661a37f5af58445b41e01da8034c0d31e27511
SSDEEP 12288:NjEjNM16W0Vr24g5YZAJ9YJLKhMqhJQWckNOCAG0dsRWeA9yt:N4pMwW0Vr24guZpCEkNueA9yt
TLSH
T171153B50B2A1DDADC96AC33445A7A333BBB8BD810376AB272248DD751F53FD06D58B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2AD1EDAF-D83D-48B5-9ADF-03DBE19F53BD}\ = "IAuthenticateEx"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5CA5F7F-1847-4D87-9C5B-918509F7511D}\NumMethods\ = "4"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A39EE748-6A27-4817-A6F2-13914BEF5890}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\local\CLSID = "{79eac9e7-baf9-11ce-8c82-00aa004ba90b}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D8-BAFA-11CE-8C82-00AA004BA90B}\NumMethods\ = "5"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A39EE748-6A27-4817-A6F2-13914BEF5890}\ = "IUri"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\lzdhtml	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D6-BAFA-11CE-8C82-00AA004BA90B}\NumMethods\ = "4"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5CA5F7F-1847-4D87-9C5B-918509F7511D}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9EE-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F164EDF1-CC7C-4F0D-9A94-34222625C393}\ = "IInternetSecurityManagerEx"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ftp\CLSID = "{79eac9e3-baf9-11ce-8c82-00aa004ba90b}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\gopher\CLSID = "{79eac9e4-baf9-11ce-8c82-00aa004ba90b}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2AD1EDAF-D83D-48B5-9ADF-03DBE19F53BD}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C9-BAF9-11CE-8C82-00AA004BA90B}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D2-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C1-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "11"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\gopher	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\lzdhtml\ = "AP Deflate Encoding/Decoding Filter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F6B0360-B80D-11D0-A9B3-006097942311}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F6B0360-B80D-11D0-A9B3-006097942311}\ = "AP lzdhtml encoding/decoding Filter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F6B0360-B80D-11D0-A9B3-006097942311}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\local\ = "file:, local: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\deflate\ = "AP Deflate Encoding/Decoding Filter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAA74EF9-8EE7-4659-88D9-F8C504DA73CC}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC4801A1-2BA9-11CF-A229-00AA003D7352}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1E50292-A795-4117-8E09-2B560A72AC60}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D8-BAFA-11CE-8C82-00AA004BA90B}\ = "IWinInetHttpInfo"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1E50292-A795-4117-8E09-2B560A72AC60}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\cdl\ = "CDL: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https\ = "https: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\gzip	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAA74EF9-8EE7-4659-88D9-F8C504DA73CC}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5CA5F7F-1847-4D87-9C5B-918509F7511D}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\file	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ftp	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\mk\CLSID = "{79eac9e6-baf9-11ce-8c82-00aa004ba90b}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C9-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F164EDF1-CC7C-4F0D-9A94-34222625C393}\NumMethods\ = "12"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\gopher\ = "gopher: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2AD1EDAF-D83D-48B5-9ADF-03DBE19F53BD}\NumMethods\ = "5"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F9F9FCB-E0F4-48EB-B7AB-FA2EA9365CB4}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\mk\ = "mk: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F164EDF1-CC7C-4F0D-9A94-34222625C393}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\local	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C0-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C1-BAF9-11CE-8C82-00AA004BA90B}\NumMethods	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\file	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ftp	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\lzdhtml\CLSID = "{8f6b0360-b80d-11d0-a9b3-006097942311}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5CA5F7F-1847-4D87-9C5B-918509F7511D}\ = "IMonikerProp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C1-BAF9-11CE-8C82-00AA004BA90B}\ = "IBindStatusCallback"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D8-BAFA-11CE-8C82-00AA004BA90B}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https\CLSID = "{79eac9e5-baf9-11ce-8c82-00aa004ba90b}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C0-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "9"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D2-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "5"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F9F9FCB-E0F4-48EB-B7AB-FA2EA9365CB4}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC4801A1-2BA9-11CF-A229-00AA003D7352}\ = "IBindHost"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C9-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "9"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http\ = "http: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\deflate\CLSID = "{8f6b0360-b80d-11d0-a9b3-006097942311}"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\13736b2c670c88e85834cb15c6d842545412138a91f0afa3fa6aa018484be168.dll
1⤵
- Modifies registry class
PID:5168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RGI387B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RGI387B.tmp
Size 19KB
SHA256 8563acc79b2a074a8ad9bc8d7c1f1dd2ba47621119dc2ef5a0d71786106eb333
MD5 9dbe95b579148af3fb97ff934ab62939
SHA1 0703b5afb16ae7d48f956fb02b7994ab1b6ed01c
SHA512 da3b07db111680811cf655461a048bf94c986b5440eaef1d51af24a3d3fef92f0c9bacfa646d6f65fa602374b11c81f8abaadc2b558a31ab103feb9e1337dea7
SSDEEP 384:XY/qNHA2BtKwX+9+6Z9Z6L9L6bMZ9Z6P9P6+9+67976k9k6o9o6L9L60906zkO91:YYA7WJ/76ljYGZNyRuWJdiYIUH+RlKYk
TLSH
T1DA924439A068EF0DA00F3229629F3061F1DC28F9D15CFD6669DFA7BB5D88D494072786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5168-0-0x00000000623E1000-0x00000000623E3000-memory.dmp

Download