12746cd27500b796ba3aa21a292cbbf4fa4f12f81d6b415bd73930fd5d299ede

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pcstory-V6.4.2.0/pcstory-V6.4.2.0/pcstory.exe
Size 8.4MB
Sample260930-s22sqaycrd
SHA256 12746cd27500b796ba3aa21a292cbbf4fa4f12f81d6b415bd73930fd5d299ede
MD5 9dd63a1edcd5dd6d6a85dcd8344ec1e2
SHA1 abc59b23690da2c8f3438b285b8a23c4748e5c56
SHA512 74237e6a2155f6e144283e1e12b05177f158951cb9b94da24af535850c65b8b2ec4110588c74594b1bebf795947a13e8e701790ae7295f0dfe968078dc7a1438
SSDEEP 98304:Sx1g8YFnJU4MmgtL04K1BwCxedYciCBAUZLOHm62mFLOAkGkzdnEVomFHKnP:0W8mPu6BwEe6ciCV+mqFLOyomFHKnP
TLSH
T1EB969E466BBD40E9D067C038CA978647EBB2BC612B3147DB1161776E2F376E01E7E221
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 51 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pcstory-V6.4.2.0\\pcstory-V6.4.2.0\\storyservice\\fp2psrv.exe"	fp2psrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70327066-4C2E-6269-4964-E99988E79BB4}	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70327066-4C2E-6269-4964-E99988E79BB4}\1.0\FLAGS\ = "0"	fp2psrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{70327066-492E-4D46-6772-E99988E79BB4}\ProxyStubClsid32	fp2psrv.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}\Version	fp2psrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}\LocalServer32	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}\TypeLib\ = "{70327066-4C2E-6269-4964-E99988E79BB4}"	fp2psrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}\Version	fp2psrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70327066-4C2E-6269-4964-E99988E79BB4}\1.0	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70327066-4C2E-6269-4964-E99988E79BB4}\1.0\ = "lightningLib"	fp2psrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70327066-4C2E-6269-4964-E99988E79BB4}\1.0\HELPDIR	fp2psrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{70327066-492E-4D46-6772-E99988E79BB4}\TypeLib	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{70327066-412E-7070-4964-E99988E79BB4}\LocalService = "fp2psrv"	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70327066-4C2E-6269-4964-E99988E79BB4}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pcstory-V6.4.2.0\\pcstory-V6.4.2.0\\storyservice\\fp2psrv.exe"	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70327066-492E-4D46-6772-E99988E79BB4}\TypeLib\Version = "1.0"	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}\AppID = "{70327066-412E-7070-4964-E99988E79BB4}"	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pcstory-V6.4.2.0\\pcstory-V6.4.2.0\\storyservice\\fp2psrv.exe"	fp2psrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}\TypeLib	fp2psrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}\Version	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}\Version\ = "1.0"	fp2psrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70327066-4C2E-6269-4964-E99988E79BB4}\1.0\0	fp2psrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70327066-4C2E-6269-4964-E99988E79BB4}\1.0\0\win64	fp2psrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70327066-492E-4D46-6772-E99988E79BB4}	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70327066-492E-4D46-6772-E99988E79BB4}\TypeLib\ = "{70327066-4C2E-6269-4964-E99988E79BB4}"	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{70327066-492E-4D46-6772-E99988E79BB4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	fp2psrv.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}\LocalServer32	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}\TypeLib\ = "{70327066-4C2E-6269-4964-E99988E79BB4}"	fp2psrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}\TypeLib	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70327066-4C2E-6269-4964-E99988E79BB4}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pcstory-V6.4.2.0\\pcstory-V6.4.2.0\\storyservice"	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70327066-492E-4D46-6772-E99988E79BB4}\ = "IFolderManager"	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70327066-492E-4D46-6772-E99988E79BB4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}\ = "FolderManager Class"	fp2psrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}\LocalServer32	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}\ = "FolderManager Class"	fp2psrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70327066-4C2E-6269-4964-E99988E79BB4}\1.0\FLAGS	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{70327066-492E-4D46-6772-E99988E79BB4}\TypeLib\ = "{70327066-4C2E-6269-4964-E99988E79BB4}"	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}\Version\ = "1.0"	fp2psrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{70327066-412E-7070-4964-E99988E79BB4}	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\pcstory-V6.4.2.0\\pcstory-V6.4.2.0\\storyservice\\fp2psrv.exe\""	fp2psrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70327066-492E-4D46-6772-E99988E79BB4}\ProxyStubClsid32	fp2psrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{70327066-412E-7070-4964-E99988E79BB4}	fp2psrv.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}\AppID = "{70327066-412E-7070-4964-E99988E79BB4}"	fp2psrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70327066-492E-4D46-6772-E99988E79BB4}\TypeLib	fp2psrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{70327066-492E-4D46-6772-E99988E79BB4}	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{70327066-492E-4D46-6772-E99988E79BB4}\ = "IFolderManager"	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{70327066-492E-4D46-6772-E99988E79BB4}\TypeLib\Version = "1.0"	fp2psrv.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}\TypeLib	fp2psrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}	fp2psrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{70327066-432E-4D46-6772-E99988E79BB4}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\pcstory-V6.4.2.0\\pcstory-V6.4.2.0\\storyservice\\fp2psrv.exe\""	fp2psrv.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
956	pcstory.exe
956	pcstory.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2260	fp2psrv.exe
Token: SeManageVolumePrivilege	2260	fp2psrv.exe
Token: SeManageVolumePrivilege	4748	fp2psrv.exe
Token: SeManageVolumePrivilege	4748	fp2psrv.exe
Token: SeManageVolumePrivilege	2640	fp2psrv.exe
Token: SeManageVolumePrivilege	2640	fp2psrv.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
956	pcstory.exe
956	pcstory.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 2260	956	pcstory.exe	88
PID 956 wrote to memory of 4748	956	pcstory.exe	89

C:\Users\Admin\AppData\Local\Temp\pcstory-V6.4.2.0\pcstory-V6.4.2.0\pcstory.exe
"C:\Users\Admin\AppData\Local\Temp\pcstory-V6.4.2.0\pcstory-V6.4.2.0\pcstory.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956
- C:\Users\Admin\AppData\Local\Temp\pcstory-V6.4.2.0\pcstory-V6.4.2.0\storyservice\fp2psrv.exe
  "C:\Users\Admin\AppData\Local\Temp\pcstory-V6.4.2.0\pcstory-V6.4.2.0\storyservice\fp2psrv.exe" -RegServer
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:2260
- C:\Users\Admin\AppData\Local\Temp\pcstory-V6.4.2.0\pcstory-V6.4.2.0\storyservice\fp2psrv.exe
  "C:\Users\Admin\AppData\Local\Temp\pcstory-V6.4.2.0\pcstory-V6.4.2.0\storyservice\fp2psrv.exe" -Service
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4748

C:\Users\Admin\AppData\Local\Temp\pcstory-V6.4.2.0\pcstory-V6.4.2.0\storyservice\fp2psrv.exe
"C:\Users\Admin\AppData\Local\Temp\pcstory-V6.4.2.0\pcstory-V6.4.2.0\storyservice\fp2psrv.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vnet.ini

Path C:\Users\Admin\AppData\Local\Temp\pcstory-V6.4.2.0\pcstory-V6.4.2.0\storyservice\appdata\conf\vnet.ini
Size 40B
SHA256 248471c7f6cb0863a5572b40bf25b81d1a18c999436eca435e508b795d45a82f
MD5 79ad9118a0acf5bd169ad6be5a90e845
SHA1 8fc9c88ec86d63989f045cceaa474ce6a6983eb5
SHA512 70fdae9e9040b7889a4f9090824be14ef34d3ec9acae9fcf816c0090a79020c7431eb4103340a66e353b2214bde8e6b34fa51a41315a5a173e079ac36a391665
MD5 SHA1 SHA512

Submit Download