e16ae5f26182b58be919c1f7a386c7c7465701f1f9f0a911c27f903fa5dc82f2

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e16ae5f26182b58be919c1f7a386c7c7465701f1f9f0a911c27f903fa5dc82f2.dll
Size 163KB
Sample261002-e65hhsxzby
SHA256 e16ae5f26182b58be919c1f7a386c7c7465701f1f9f0a911c27f903fa5dc82f2
MD5 4cccae7e78e9a8e6c40b096a56c741aa
SHA1 45371e258f95590252e67fb2e60cb6b0a54275b9
SHA512 d0d3ec0a6584bb97064a22b5834494480f406b543acb314507336a3f8f8f6858f25bc7abcd34b2737263a987cfd2357f77e97b06f436288c07ba3dc4c59e4f7d
SSDEEP 3072:HoFkOkrBjxkl7n26TzMttk7geh65jmwSfI8Hx5c:HoFcJGlD2oatUgehTR5
TLSH
T1FCF36C57B3A900BBE4779239C9A30606E772781507209BEF039447BA6F677D09D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7A4B2E10-9C3D-4F6A-B1E8-5D2C7F0A9B34}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7A4B2E10-9C3D-4F6A-B1E8-5D2C7F0A9B34}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e16ae5f26182b58be919c1f7a386c7c7465701f1f9f0a911c27f903fa5dc82f2.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7A4B2E10-9C3D-4F6A-B1E8-5D2C7F0A9B34}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7A4B2E10-9C3D-4F6A-B1E8-5D2C7F0A9B34}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7A4B2E10-9C3D-4F6A-B1E8-5D2C7F0A9B34}\ = "Shittim Logon Provider"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e16ae5f26182b58be919c1f7a386c7c7465701f1f9f0a911c27f903fa5dc82f2.dll
1⤵
- Modifies registry class
PID:4128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads