8c8c4299ddf503b2c25c0905b0a0820f3e8238c252e9ace37bf25964ef4a8f6f

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
skel/parsecd-150-104a.dll
Size 5.9MB
Sample260905-e8645atvbw
SHA256 8c8c4299ddf503b2c25c0905b0a0820f3e8238c252e9ace37bf25964ef4a8f6f
MD5 9d822ea0a064147ab5a88f8ad01b3193
SHA1 7d8ebac3b2848f0dd5a7661816290c3250758b5c
SHA512 08690a3f50a894ab315fe0c5f6f94d5bd1d639b329276c42e5b325d581c0ef1116589792cc5948bb54493295b7e798b7aafd0673be11c3f8115c97fe50700cae
SSDEEP 49152:hgrPRiNAwlgvLJhhHdMSNkvGPVezddRQusF1YaVRKGxnkBeU/TTlzlAuCq3fWCC5:h2faPeaBz0ocUzKEQ
TLSH
T14D569D3763E511B8C66681388F07531BE6B17C4617F197EB02E456692F63FE00ABA732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75BC00CE-AF99-41EE-ABBC-F21099C15552}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75BC00CE-AF99-41EE-ABBC-F21099C15552}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75BC00CE-AF99-41EE-ABBC-F21099C15552}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\skel\\parsecd-150-104a.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75BC00CE-AF99-41EE-ABBC-F21099C15552}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{75BC00CE-AF99-41EE-ABBC-F21099C15552}\InprocServer32	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\skel\parsecd-150-104a.dll
1⤵
- Modifies registry class
PID:3624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads