946e205ec9956cfbd6366d50df18462b077289cd35f3b5478fdf7bb001f81501

Resubmissions

24/08/2026, 00:20

260824-am723sbq6v9

24/08/2026, 00:17

260824-ak9swsbq4v7

24/08/2026, 00:16

260824-akyevsbq219

24/08/2026, 00:11

260824-ag12ksbf349

Analysis

user interaction
yes
max time kernel
14s
max time network
16s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 34KB
Sample260824-akyevsbq21
SHA256 946e205ec9956cfbd6366d50df18462b077289cd35f3b5478fdf7bb001f81501
MD5 7cbc92070d125641267703b8797da08c
SHA1 796ed021daaab15613adfa11c23189849565ea82
SHA512 25277992f24483b2b892519f9bbac0670f99426d5f89700eed05df348012f093cbd0cf16686519534606cd3736401a017a5956180f89a5b689a2778d80492801
SSDEEP 768:Y0UYTAT59oE06/XRoKC54MzFVetoqBSZzB:LAd9oERPCKW4MvetoF
TLSH
T1D5F2F84F739358EDC91AD178E5FA8371E9B1FC6209745E3E8350C2760E34A908A7DA4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 9 IoCs

pid	Process
2296	Process not Found
2296	Process not Found
2296	Process not Found
2296	Process not Found
2296	Process not Found
2296	Process not Found
2296	Process not Found
2296	Process not Found
2296	Process not Found

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\spool\PRINTERS\PP6xe4e9a9ma59cgb4jhx87_nuc.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\System32\spool\drivers\color\evil_com.dll	loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2388	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32\ThreadingModel = "Apartment"	loader.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}	loader.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32	loader.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID	loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32\ = "C:\\Windows\\System32\\spool\\drivers\\color\\evil_com.dll"	loader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	rundll32.exe

Runs net.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2984	rundll32.exe
2984	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 2388	4928	loader.exe	86
PID 2388 wrote to memory of 2984	2388	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rundll32 printui.dll,PrintUIEntry /k /n "Microsoft Print to PDF"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\system32\rundll32.exe
    rundll32 printui.dll,PrintUIEntry /k /n "Microsoft Print to PDF"
    3⤵
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:2984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1684

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
- Drops file in System32 directory
PID:4544

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:4316
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:4840

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:1056
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:4672

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:4944
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:1876

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:4896
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:3680

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:4772
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:3356

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:4448
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:3096

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:1836
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:4332

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:1716
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:2500

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:4248
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:3336

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:3332

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:960

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:3056

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:3372

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:3348

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:2028

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:1840

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:3708

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Account Manipulation

T1098

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Account Manipulation

T1098

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

evil_com.dll

Path C:\Windows\System32\spool\drivers\color\evil_com.dll
Size 14KB
SHA256 80c6b7c05c1a52194bed2b0fe08a55c783ac34fa996eb201c442e29073132924
MD5 9677e6b0061c4f2e91fce9cfbae1d91b
SHA1 1bb5ba4a6aee0b44f672867dc943cbd167c572a0
SHA512 a717d5f5ffcd101072b0c6acddb6ef4a7d325d4bea11d6c3a5d3f95dc7f198dd511d135bc4dcc8b26e5878b888bb1be9e99293331c4af809d186af16f4a6d69c
SSDEEP 192:4Rn/lZ806KQ4wQAyyXRJKHG8ye6TjM+g46aYiCdWR3yX:0E06t48XRUj0AcCdWRC
TLSH
T15062C68FB7D3A8B9CE1AD274D5FB4735F5B1BC6108286E3F01A9C2724E74640423DA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4928-9-0x00007FF7E9C10000-0x00007FF7E9C1F000-memory.dmp

Download