5e31b06ab8cf2a01b131370560086233b07c63162b3608d863c4e4a023d344e0

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinSATAPI.dll
Size 408KB
Sample260812-gn2d9azeld
SHA256 5e31b06ab8cf2a01b131370560086233b07c63162b3608d863c4e4a023d344e0
MD5 52bb6e69ec7534459605caede3269b71
SHA1 e260f642f81f952de9d121a013317b9772844e9b
SHA512 5a257b5c3ae28d6b93dbe0fd6152f7e9777d3c1f0d02375183c13bce4fa982e11efb8cfd491da7219c10580e69d24bec93caab55899f25c366a7a55e7e903c67
SSDEEP 6144:S2MRg07v96wYgMVq12241Rov7nR9cT8vn5nYBbc4g29p7:S2fO16FLVq1b2Rov88Cth
TLSH
T1EC94E61EA7A847B6D066913C8577F205E2B278105B21D2CB229C427D2E37BD46E3DBF1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD1C380-52D3-4678-AC6F-E929E480BE9E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0B89ED1D-6398-4FEA-87FC-567D8D19176F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0B89ED1D-6398-4FEA-87FC-567D8D19176F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F378D7E-E551-44f8-9F94-9DB392B03B7B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8334D5D-568E-4075-875F-9DF341506640}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CD1C380-52D3-4678-AC6F-E929E480BE9E}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B89ED1D-6398-4FEA-87FC-567D8D19176F}\TypeLib\ = "{15AE3A36-E53B-454D-A816-A7C61CBAB8A4}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8AD5D1F-3B47-4BDC-9375-7C6B1DA4ECA7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD1C380-52D3-4678-AC6F-E929E480BE9E}\ = "IProvideWinSATAssessmentInfo"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B89ED1D-6398-4FEA-87FC-567D8D19176F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F378D7E-E551-44f8-9F94-9DB392B03B7B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinSATAPI.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F8AD5D1F-3B47-4BDC-9375-7C6B1DA4ECA7}\ = "IQueryRecentWinSATAssessment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8334D5D-568E-4075-875F-9DF341506640}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B89ED1D-6398-4FEA-87FC-567D8D19176F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0B89ED1D-6398-4FEA-87FC-567D8D19176F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0B89ED1D-6398-4FEA-87FC-567D8D19176F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib\ = "{15AE3A36-E53B-454D-A816-A7C61CBAB8A4}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3C97737-76D9-4f5f-B917-4DE47FE023C8}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinsatWMI.1\CLSID\ = "{A3C97737-76D9-4f5f-B917-4DE47FE023C8}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QueryWinSAT\ = "QueryWinSAT"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F8AD5D1F-3B47-4BDC-9375-7C6B1DA4ECA7}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8AD5D1F-3B47-4BDC-9375-7C6B1DA4ECA7}\TypeLib\ = "{15AE3A36-E53B-454D-A816-A7C61CBAB8A4}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F8334D5D-568E-4075-875F-9DF341506640}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F8334D5D-568E-4075-875F-9DF341506640}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD1C380-52D3-4678-AC6F-E929E480BE9E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinsatWMI.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15AE3A36-E53B-454d-A816-A7C61CBAB8A4}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F8AD5D1F-3B47-4BDC-9375-7C6B1DA4ECA7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F8334D5D-568E-4075-875F-9DF341506640}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8334D5D-568E-4075-875F-9DF341506640}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B89ED1D-6398-4FEA-87FC-567D8D19176F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F378D7E-E551-44f8-9F94-9DB392B03B7B}\ = "CAccessiblityWinSAT Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F8AD5D1F-3B47-4BDC-9375-7C6B1DA4ECA7}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8AD5D1F-3B47-4BDC-9375-7C6B1DA4ECA7}\ = "IQueryRecentWinSATAssessment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F8334D5D-568E-4075-875F-9DF341506640}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8334D5D-568E-4075-875F-9DF341506640}\TypeLib\ = "{15AE3A36-E53B-454D-A816-A7C61CBAB8A4}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD1C380-52D3-4678-AC6F-E929E480BE9E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CD1C380-52D3-4678-AC6F-E929E480BE9E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinsatWMI	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8AD5D1F-3B47-4BDC-9375-7C6B1DA4ECA7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8334D5D-568E-4075-875F-9DF341506640}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B89ED1D-6398-4FEA-87FC-567D8D19176F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0B89ED1D-6398-4FEA-87FC-567D8D19176F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinsatWMI\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F8AD5D1F-3B47-4BDC-9375-7C6B1DA4ECA7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F8AD5D1F-3B47-4BDC-9375-7C6B1DA4ECA7}\TypeLib\ = "{15AE3A36-E53B-454D-A816-A7C61CBAB8A4}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8AD5D1F-3B47-4BDC-9375-7C6B1DA4ECA7}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD1C380-52D3-4678-AC6F-E929E480BE9E}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3C97737-76D9-4f5f-B917-4DE47FE023C8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinsatWMI.1\ = "WinsatWMI.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15AE3A36-E53B-454d-A816-A7C61CBAB8A4}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F8AD5D1F-3B47-4BDC-9375-7C6B1DA4ECA7}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8AD5D1F-3B47-4BDC-9375-7C6B1DA4ECA7}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3C97737-76D9-4f5f-B917-4DE47FE023C8}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15AE3A36-E53B-454d-A816-A7C61CBAB8A4}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8334D5D-568E-4075-875F-9DF341506640}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CD1C380-52D3-4678-AC6F-E929E480BE9E}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0B89ED1D-6398-4FEA-87FC-567D8D19176F}\ = "IQueryAllWinSATAssessments"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinsatWMI.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QueryAllWinSAT\ = "QueryAllWinSAT"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\WinSATAPI.dll
1⤵
- Modifies registry class
PID:1784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads