Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/09/2026, 09:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6a4ee8983cfd8ce062f474300de01d6b9a75792ba5d51115d87d6698ffbcc628.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6a4ee8983cfd8ce062f474300de01d6b9a75792ba5d51115d87d6698ffbcc628.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 6a4ee8983cfd8ce062f474300de01d6b9a75792ba5d51115d87d6698ffbcc628.dll
- Size 10.0MB
- Sample260922-llm63ada74
- SHA256 6a4ee8983cfd8ce062f474300de01d6b9a75792ba5d51115d87d6698ffbcc628
- MD5 9fcf5ead1ace5ee7f99de8b46ee14c70
- SHA1 6111b732b90c29d21885e229feaf10118e7449ab
- SHA512 9956ebcef0eec6588b6f4a4f5fb4325e1a6067fd3dce0031b623efb7e3541700e61d6b301a9c7ef697901cb6d2d3ffa3c7a8292f8accd73a0847e99e6d08e39b
- SSDEEP 196608:jDKMqgfc2qhjIYKHf6CQKfGLNgdyje2abTCp4HtIlwrW6HZQBx:mhj5C7fGZg0K2abWQWSZUx
- TLSH T157B6029F2C8781F6D88118F4D71B7AE707B296B54B8D4CB72AC1354DA0A1FF5603E886
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 37 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jh.jiahao\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{365F7A47-8A1C-3D11-B78B-E9F3B76CCEF9}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{094ADB0E-DABB-A864-4926-F777AB5710A5} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jh.jiahao\CurVer\ = "jh.jiahao" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{365F7A47-8A1C-3D11-B78B-E9F3B76CCEF9}\ = "jh.jiahao" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{88F20EC0-266A-4B5D-D386-7F0588BAD7B4}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{88F20EC0-266A-4B5D-D386-7F0588BAD7B4}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{094ADB0E-DABB-A864-4926-F777AB5710A5}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{094ADB0E-DABB-A864-4926-F777AB5710A5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{094ADB0E-DABB-A864-4926-F777AB5710A5}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{88F20EC0-266A-4B5D-D386-7F0588BAD7B4}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{094ADB0E-DABB-A864-4926-F777AB5710A5}\ = "Ijiahao" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{094ADB0E-DABB-A864-4926-F777AB5710A5}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{88F20EC0-266A-4B5D-D386-7F0588BAD7B4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jh.jiahao\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{365F7A47-8A1C-3D11-B78B-E9F3B76CCEF9} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{365F7A47-8A1C-3D11-B78B-E9F3B76CCEF9}\ProgID\ = "jh.jiahao" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{88F20EC0-266A-4B5D-D386-7F0588BAD7B4}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{094ADB0E-DABB-A864-4926-F777AB5710A5} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{365F7A47-8A1C-3D11-B78B-E9F3B76CCEF9}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{88F20EC0-266A-4B5D-D386-7F0588BAD7B4}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{094ADB0E-DABB-A864-4926-F777AB5710A5}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{365F7A47-8A1C-3D11-B78B-E9F3B76CCEF9}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jh.jiahao regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{88F20EC0-266A-4B5D-D386-7F0588BAD7B4}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6a4ee8983cfd8ce062f474300de01d6b9a75792ba5d51115d87d6698ffbcc628.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{094ADB0E-DABB-A864-4926-F777AB5710A5}\ = "Ijiahao" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{094ADB0E-DABB-A864-4926-F777AB5710A5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{094ADB0E-DABB-A864-4926-F777AB5710A5}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{88F20EC0-266A-4B5D-D386-7F0588BAD7B4}\1.0\ = "jh" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{88F20EC0-266A-4B5D-D386-7F0588BAD7B4}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{094ADB0E-DABB-A864-4926-F777AB5710A5}\TypeLib\ = "{88F20EC0-266A-4B5D-D386-7F0588BAD7B4}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{88F20EC0-266A-4B5D-D386-7F0588BAD7B4}\1.0\HELPDIR\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{094ADB0E-DABB-A864-4926-F777AB5710A5}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{365F7A47-8A1C-3D11-B78B-E9F3B76CCEF9}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6a4ee8983cfd8ce062f474300de01d6b9a75792ba5d51115d87d6698ffbcc628.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jh.jiahao\ = "jh.jiahao" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jh.jiahao\CLSID\ = "{365F7A47-8A1C-3D11-B78B-E9F3B76CCEF9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{094ADB0E-DABB-A864-4926-F777AB5710A5}\TypeLib\ = "{88F20EC0-266A-4B5D-D386-7F0588BAD7B4}" regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2812 wrote to memory of 4112 2812 regsvr32.exe 89
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\6a4ee8983cfd8ce062f474300de01d6b9a75792ba5d51115d87d6698ffbcc628.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\6a4ee8983cfd8ce062f474300de01d6b9a75792ba5d51115d87d6698ffbcc628.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4112
-