Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 15:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f9121d2f8e37a41b88edf7d772ada62a6fddd0b9920f5c0d82510df1bdae2f52.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
f9121d2f8e37a41b88edf7d772ada62a6fddd0b9920f5c0d82510df1bdae2f52.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target f9121d2f8e37a41b88edf7d772ada62a6fddd0b9920f5c0d82510df1bdae2f52.dll
- Size 2.1MB
- Sample260820-tfb6lsfk41
- SHA256 f9121d2f8e37a41b88edf7d772ada62a6fddd0b9920f5c0d82510df1bdae2f52
- MD5 9224152bbf8891f52d9157a1e381bbaf
- SHA1 9a3d6f357d3a88313ac9da8149dc2db747d81d9b
- SHA512 0a28f69a5d0af8709373027804d89de0005bf137cf5e6f17c49f8001d250203cecab4d3ff475a27122e954f2a90e55199edfee8c4b58b06e1d54acc4db80c17d
- SSDEEP 24576:ybquqe0gnVDteUYYbquqe0gnVDteUYYbquqe0gnVDteUY1:y2uqLgnlt2Y2uqLgnlt2Y2uqLgnlt21
- TLSH T16DA56A22F1D09AADC83A86701F2F3532F67DB8815D34FCAA34BC91391FB5B541999B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{79EAC9E4-BAF9-11CE-8C82-00AA004BA90B}\ = "gopher: Asynchronous Pluggable Protocol Handler" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\cdl\ = "CDL: Asynchronous Pluggable Protocol Handler" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F164EDF1-CC7C-4F0D-9A94-34222625C393}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD45F185-1B21-48E2-967B-EAD743A8914E}\NumMethods\ = "6" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\local regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D8-BAFA-11CE-8C82-00AA004BA90B}\ = "IWinInetHttpInfo" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9EE-BAF9-11CE-8C82-00AA004BA90B}\ = "IInternetSecurityManager" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C0-BAF9-11CE-8C82-00AA004BA90B}\ = "IBinding" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\cdl regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http\ = "http: Asynchronous Pluggable Protocol Handler" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D2-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "5" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D8-BAFA-11CE-8C82-00AA004BA90B}\NumMethods\ = "5" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1E50292-A795-4117-8E09-2B560A72AC60}\ = "IInternetSecurityManagerEx2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F9F9FCB-E0F4-48EB-B7AB-FA2EA9365CB4}\NumMethods\ = "6" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC4801A1-2BA9-11CF-A229-00AA003D7352}\ = "IBindHost" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{79EAC9E4-BAF9-11CE-8C82-00AA004BA90B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f9121d2f8e37a41b88edf7d772ada62a6fddd0b9920f5c0d82510df1bdae2f52.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\local\ = "file:, local: Asynchronous Pluggable Protocol Handler" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\gzip\CLSID = "{8f6b0360-b80d-11d0-a9b3-006097942311}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2AD1EDAF-D83D-48B5-9ADF-03DBE19F53BD}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C0-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "9" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F164EDF1-CC7C-4F0D-9A94-34222625C393}\NumMethods\ = "12" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F6B0360-B80D-11D0-A9B3-006097942311} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ftp\CLSID = "{79eac9e3-baf9-11ce-8c82-00aa004ba90b}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\mk regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\deflate\ = "AP Deflate Encoding/Decoding Filter" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\gzip regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C0-BAF9-11CE-8C82-00AA004BA90B}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F9F9FCB-E0F4-48EB-B7AB-FA2EA9365CB4}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D6-BAFA-11CE-8C82-00AA004BA90B}\NumMethods\ = "4" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C9-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D8-BAFA-11CE-8C82-00AA004BA90B}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C9-BAF9-11CE-8C82-00AA004BA90B}\ = "IPersistMoniker" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1E50292-A795-4117-8E09-2B560A72AC60}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A39EE748-6A27-4817-A6F2-13914BEF5890}\NumMethods\ = "28" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\file regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\local\CLSID = "{79eac9e7-baf9-11ce-8c82-00aa004ba90b}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "4" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\deflate regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\lzdhtml\ = "AP Deflate Encoding/Decoding Filter" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{79EAC9E4-BAF9-11CE-8C82-00AA004BA90B}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D2-BAF9-11CE-8C82-00AA004BA90B}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC4801A1-2BA9-11CF-A229-00AA003D7352}\NumMethods\ = "6" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A39EE748-6A27-4817-A6F2-13914BEF5890}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F6B0360-B80D-11D0-A9B3-006097942311}\ = "AP lzdhtml encoding/decoding Filter" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C1-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "11" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5CA5F7F-1847-4D87-9C5B-918509F7511D}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A39EE748-6A27-4817-A6F2-13914BEF5890}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\gopher regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\mk\ = "mk: Asynchronous Pluggable Protocol Handler" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C1-BAF9-11CE-8C82-00AA004BA90B}\ = "IBindStatusCallback" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\lzdhtml regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F6B0360-B80D-11D0-A9B3-006097942311}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F6B0360-B80D-11D0-A9B3-006097942311}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F9F9FCB-E0F4-48EB-B7AB-FA2EA9365CB4}\ = "IHttpNegotiate2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC4801A1-2BA9-11CF-A229-00AA003D7352}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC4801A1-2BA9-11CF-A229-00AA003D7352}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C9-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "9" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A39EE748-6A27-4817-A6F2-13914BEF5890}\ = "IUri" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAA74EF9-8EE7-4659-88D9-F8C504DA73CC}\NumMethods regsvr32.exe