a158dd198ba19871384f0e2d77d52ec07d06ba6de2447cb91f616724cfb9d068

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a158dd198ba19871384f0e2d77d52ec07d06ba6de2447cb91f616724cfb9d068.dll
Size 492KB
Sample260930-npfmhatfng
SHA256 a158dd198ba19871384f0e2d77d52ec07d06ba6de2447cb91f616724cfb9d068
MD5 294537d9de69e25917a44285c242ed85
SHA1 179ac57a93868c1bf57aa5d08850931b75fc9de5
SHA512 3572a10a1eff30eadbb41bb4f6d390f7f2849a5fd3e3dbab56786fb48725e9cf89c5421bfb033f4ff0e6895c089c252c18c43884c7ee70ee64a5ce01abb8b54e
SSDEEP 6144:gjJn/9rjMmNlQn2r0FnSiOdtDYJtF+fh0qhgK6KXJu+:gjJn/9TNl/rinSiODDYJv+fh0qhgKzX
TLSH
T1FCB43A2A62E255DCE07B82348A37A372F975BC508074FA6F3D4CDA391F64F609539B24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C0-BAF9-11CE-8C82-00AA004BA90B}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1E50292-A795-4117-8E09-2B560A72AC60}\ = "IInternetSecurityManagerEx2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\gopher	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\lzdhtml	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C0-BAF9-11CE-8C82-00AA004BA90B}\ = "IBinding"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A39EE748-6A27-4817-A6F2-13914BEF5890}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{79EAC9E4-BAF9-11CE-8C82-00AA004BA90B}\ = "gopher: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C1-BAF9-11CE-8C82-00AA004BA90B}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAA74EF9-8EE7-4659-88D9-F8C504DA73CC}\NumMethods\ = "12"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D2-BAF9-11CE-8C82-00AA004BA90B}\ = "IHttpNegotiate"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F9F9FCB-E0F4-48EB-B7AB-FA2EA9365CB4}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9EE-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\mk	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9EE-BAF9-11CE-8C82-00AA004BA90B}\ = "IInternetSecurityManager"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\gopher\ = "gopher: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D8-BAFA-11CE-8C82-00AA004BA90B}\ = "IWinInetHttpInfo"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{79EAC9E4-BAF9-11CE-8C82-00AA004BA90B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{79EAC9E4-BAF9-11CE-8C82-00AA004BA90B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a158dd198ba19871384f0e2d77d52ec07d06ba6de2447cb91f616724cfb9d068.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\deflate\CLSID = "{8f6b0360-b80d-11d0-a9b3-006097942311}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\cdl\CLSID = "{3dd53d40-7b8b-11d0-b013-00aa0059ce02}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C9-BAF9-11CE-8C82-00AA004BA90B}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2AD1EDAF-D83D-48B5-9ADF-03DBE19F53BD}\NumMethods\ = "5"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1E50292-A795-4117-8E09-2B560A72AC60}\NumMethods\ = "16"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\file	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\local	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\local\ = "file:, local: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D2-BAF9-11CE-8C82-00AA004BA90B}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F164EDF1-CC7C-4F0D-9A94-34222625C393}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{79EAC9E4-BAF9-11CE-8C82-00AA004BA90B}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\cdl	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ftp\CLSID = "{79eac9e3-baf9-11ce-8c82-00aa004ba90b}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\ = "IAuthenticate"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D8-BAFA-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F6B0360-B80D-11D0-A9B3-006097942311}\ = "AP lzdhtml encoding/decoding Filter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ftp\ = "ftp: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5CA5F7F-1847-4D87-9C5B-918509F7511D}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F6B0360-B80D-11D0-A9B3-006097942311}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9EE-BAF9-11CE-8C82-00AA004BA90B}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F6B0360-B80D-11D0-A9B3-006097942311}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F6B0360-B80D-11D0-A9B3-006097942311}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http\ = "http: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https\CLSID = "{79eac9e5-baf9-11ce-8c82-00aa004ba90b}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2AD1EDAF-D83D-48B5-9ADF-03DBE19F53BD}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC4801A1-2BA9-11CF-A229-00AA003D7352}\ = "IBindHost"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D6-BAFA-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9D2-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F164EDF1-CC7C-4F0D-9A94-34222625C393}\NumMethods\ = "12"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\file\CLSID = "{79eac9e7-baf9-11ce-8c82-00aa004ba90b}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\local\CLSID = "{79eac9e7-baf9-11ce-8c82-00aa004ba90b}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1E50292-A795-4117-8E09-2B560A72AC60}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http\CLSID = "{79eac9e2-baf9-11ce-8c82-00aa004ba90b}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\gopher\CLSID = "{79eac9e4-baf9-11ce-8c82-00aa004ba90b}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C1-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\mk\ = "mk: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\deflate\ = "AP Deflate Encoding/Decoding Filter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C0-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "9"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC4801A1-2BA9-11CF-A229-00AA003D7352}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC4801A1-2BA9-11CF-A229-00AA003D7352}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A39EE748-6A27-4817-A6F2-13914BEF5890}\NumMethods\ = "28"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\lzdhtml\CLSID = "{8f6b0360-b80d-11d0-a9b3-006097942311}"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a158dd198ba19871384f0e2d77d52ec07d06ba6de2447cb91f616724cfb9d068.dll
1⤵
- Modifies registry class
PID:844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RGI818A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RGI818A.tmp
Size 19KB
SHA256 b061dd92908df66167762db5afb191dcabaeba9be5b223e4640944986badc215
MD5 70bd2c5f31a55546d2213d53f154e540
SHA1 4eaee9261d09e43ae6c396f61e90d48f49adb4b6
SHA512 410ee8d2b63a10b1864b8bf9f64624f71b8773cb5e39f413939e7b550a2bdeb725c1a1dacac90e7ef07631f052c98329466101b02f98864fe2f25f8b00463835
SSDEEP 384:XY/qNHA2BtKwX+9+6Z9Z6L9L6bMZ9Z6P9P6+9+67976k9k6o9o6L9L60906zkO9h:YYA7WJ/76ljYGZNyRuWJdiYIUH+RlKY+
TLSH
T187925339A068EF0DA00F3229629F3061F1DC28F9D15CFD6669DFA7BB5D88D494072786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/844-0-0x00007FFF7B3B6000-0x00007FFF7B3B7000-memory.dmp

Download