4ebb42f59cfe51ff043b42fb0095bc22c68c5a018b3feb6e7af61456ebe4c6e5

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4ebb42f59cfe51ff043b42fb0095bc22c68c5a018b3feb6e7af61456ebe4c6e5.dll
Size 753KB
Sample260806-e6vy3sx1ew
SHA256 4ebb42f59cfe51ff043b42fb0095bc22c68c5a018b3feb6e7af61456ebe4c6e5
MD5 43dcc6048b01e5eeb87bbbff7415ed1c
SHA1 588219ca387d9d78968299448d039356b0381513
SHA512 505da974596111e962ae29aa4a00d75f643322369f9ffbb27f9e029eafe52ce8bd19a19e3e41c3215c5c327cc6e99e86dbd64edfccd69196cf485c4ed1363d58
SSDEEP 6144:c+5BEWbCc6WnyPe9L44q+l48ZIW+xwyRxZtKGDBOhH0b:JHFWEn99L4n+l48ZIW+xJKjhH0b
TLSH
T158F46C40B2A5ACBAD92A8334496393327739BD8167629B271A0C9D780F33FC57E54F35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchAssistantOC.SearchAssistantOC.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mailto\URL Protocol	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34A715A0-6587-11D0-924A-0020AFC7AC4D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA1}\ProxyStubClsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1611FDDA-445B-11D2-85DE-00C04FA35C89}\ = "_SearchAssistantEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{64AB4BB7-111E-11d1-8F79-00C04FC2FBE1}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{64AB4BB7-111E-11d1-8F79-00C04FC2FBE1}\VersionIndependentProgId	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E71FD0F-AAB1-42C0-9146-6D2C4EDCF07D}\ProgId\ = "SearchAssistantOC.SearchAssistantOC.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E71FD0F-AAB1-42C0-9146-6D2C4EDCF07D}\Version\ = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchAssistantOC.SearchAssistantOC.1	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.URL\ShellEx\{000214F9-0000-0000-C000-000000000046}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA2}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA3}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1611FDDA-445B-11D2-85DE-00C04FA35C89}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchAssistantOC.SearchAssistantOC\CurVer	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.URL\ShellEx\{00021500-0000-0000-C000-000000000046}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA3}\ = "ISearchAssistantOC3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E71FD0F-AAB1-42C0-9146-6D2C4EDCF07D}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.URL\ShellEx	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA9239A4-3DD5-11D2-BF8B-00C04FB93661}\TypeLib\ = "{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA9239A4-3DD5-11D2-BF8B-00C04FB93661}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAB22AC2-30C1-11CF-A7EB-0000C05BAE0B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7FE6EDA-1932-4281-B881-87B31B8BC52C}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA3}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE4106E0-399A-11D0-A48C-00A0C90A8F39}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7FE6EDA-1932-4281-B881-87B31B8BC52C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1611FDDA-445B-11D2-85DE-00C04FA35C89}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}\ProgId	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55136806-B2DE-11D1-B9F2-00A0C98BC547}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{47C922A2-3DD5-11D2-BF8B-00C04FB93661}\TypeLib\ = "{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1611FDDA-445B-11D2-85DE-00C04FA35C89}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1611FDDA-445B-11D2-85DE-00C04FA35C89}\TypeLib\Version = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E71FD0F-AAB1-42C0-9146-6D2C4EDCF07D}\TypeLib\ = "{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A}\ProgId	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{55136805-B2DE-11D1-B9F2-00A0C98BC547}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE4106E0-399A-11D0-A48C-00A0C90A8F39}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA3}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\IsShortcut	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{47C922A2-3DD5-11D2-BF8B-00C04FB93661}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E71FD0F-AAB1-42C0-9146-6D2C4EDCF07D}\ProgId	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}\ = "SearchAssistantOC"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchAssistantOC.SearchAssistantOC\ = "SearchAssistantOC"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchAssistantOC.SearchAssistantOC\CLSID\ = "{B45FF030-4447-11D2-85DE-00C04FA35C89}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{47C922A2-3DD5-11D2-BF8B-00C04FB93661}\ = "ISearches"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{85CB6900-4D95-11CF-960C-0080C7F4EE85}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA9239A4-3DD5-11D2-BF8B-00C04FB93661}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1611FDDA-445B-11D2-85DE-00C04FA35C89}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}\ProgId\ = "SearchAssistantOC.SearchAssistantOC.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA9239A4-3DD5-11D2-BF8B-00C04FB93661}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA1}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA3}\ProxyStubClsid32	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4ebb42f59cfe51ff043b42fb0095bc22c68c5a018b3feb6e7af61456ebe4c6e5.dll
1⤵
- Modifies registry class
PID:908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/908-0-0x000000006E02A000-0x000000006E02B000-memory.dmp

Download