80c2095f819bbe7ab05a28cd798652052c3bf3e114d466bfb14fb23053d43f91

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 05:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RemoveDeviceElevated.dll
Size 36KB
Sample260812-gnc2nabk2w
SHA256 80c2095f819bbe7ab05a28cd798652052c3bf3e114d466bfb14fb23053d43f91
MD5 68e93710282d93afde59f4a686c10f2c
SHA1 e3ce9f03aef4325a1f5251827d58d65bdc37f377
SHA512 fc7a6a3b9dcaac759d451975f7fc1d067b0648b58f56ddb253453bd08df06b34e03f3e3a39a1d11790ec035c421fbd9d5ab35668e25bf06f1336e793ee7dbb14
SSDEEP 192:NZKRQD0Tz/lx4DfoPLt3UiFE4snsAE2L+7p+POBVN5KcRWeJWT:NZh0Tz/lx4Df8t3DFS+gYRWeJWT
TLSH
T15EF2E582FBB24E9CFD25067848EB1E066639F60493529BDB1230168D1C7BBC19E38FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{304FC8AB-6643-4DAA-9027-4B21389DCB2D}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Interface	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{304FC8AB-6643-4DAA-9027-4B21389DCB2D}	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\RemoveDeviceElevated.dll
1⤵
- Modifies registry class
PID:4172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads