9d29773850f4267eb74daeb512978a7b72225e2379017938df3f92bc870328c0

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NetworkUXBroker.dll
Size 560KB
Sample260812-a4djsshf92
SHA256 9d29773850f4267eb74daeb512978a7b72225e2379017938df3f92bc870328c0
MD5 bdb5abc971682001be69a2d4d290b2eb
SHA1 ce398e615fac7452b3f9155bbde2fa61b3786219
SHA512 54e9ff1e9e6575f36853e3661c11488fd51f4c4340ed2bbc6924322b3c6ff5c9ad31d9363fe48bb82d0a4401393ba56e9b81c462f6f854e24984a0e49eb8a86d
SSDEEP 6144:ntVay88nd/2en6rQSo+8xoSXMXs4hmJCjKYltyc9nSzeTev7pXilfliuGc3zz0VI:7ay88nd/1n6rQ48isSm8ltLl9S3V0
TLSH
T110C4292DBA9802A6D17DE13980A74915E371BC1197A2D7CF01D0727E4E3BBE15F3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Interface	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E68D2B3E-192D-448E-827E-239082D74DC6}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E68d2B3E-192D-448E-827E-239082D74DC6}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E68d2B3E-192D-448E-827E-239082D74DC6}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NetworkUXBroker.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E68d2B3E-192D-448E-827E-239082D74DC6}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E68d2B3E-192D-448E-827E-239082D74DC6}\ = "PSFactoryBuffer"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NetworkUXBroker.dll
1⤵
- Modifies registry class
PID:3564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads