22878ba63aea8606c59e8a562c5c6964fe7a11281790abbd78f4d2b4de0282de

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 00:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LocationFrameworkInternalPS.dll
Size 96KB
Sample260812-a474easwcx
SHA256 22878ba63aea8606c59e8a562c5c6964fe7a11281790abbd78f4d2b4de0282de
MD5 7cd82a2ed702a74bdde0fdc3af2525ad
SHA1 ec9a3b7459ee1c8e4326c93f1b93ab6b6021ee21
SHA512 7cdfef6699fb4083edb341822d2ce131d922a12ef04cd3a3fec6c6f9f632613bdb0a1ba9db31fd0ad2803f4c0f508b3f15ac49cdfe78e32d130405e12b72614c
SSDEEP 384:oY8Rn9bNKQ3AtM1sDbd2tVUOXiunIjSflFfwGOYtRVJjcOQGUl1+UDk9cF9kYMPp:oH9bkusXmJkpy0G9UVKP16VBzKemWe
TLSH
T1FBA32D9AF60014B6C03D5232849B0E24A37ADE4597D787DB00A5327D9EB7BC5AF36BC1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{49E9AE53-4547-4045-AAD1-CDC3C6C95D6C}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Interface	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{49E9AE53-4547-4045-AAD1-CDC3C6C95D6C}	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\LocationFrameworkInternalPS.dll
1⤵
- Modifies registry class
PID:3040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads