494f496834290f80e63e0f5701d887bbde0e2ebc336de626ac5957577e1101d5

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
06_Touchpad/WinWDF/x64/SynTPCpl.dll
Size 1.5MB
Sample261030-phlevadt8p
SHA256 494f496834290f80e63e0f5701d887bbde0e2ebc336de626ac5957577e1101d5
MD5 dd4ebb34414f9f4aaf8e98078692173b
SHA1 6e280951cb97b82ea79c167d523a970f8a3a8a55
SHA512 9c7fe5fc45962235040088d2812b66320497bb0f51cb71d081f8b4b0c4d4322ac58ff8015e3496c7625a5613672c78931d450dd8c0d266c08cbb2f0a65bb4f85
SSDEEP 24576:usyhpFSGao8qXbkg0SeKTxPNZkpKH8eeiWbU:usyhpFrrkKeebkreeXY
TLSH
T15F654A57BA64C165D1BFD17DCA928E6BD6B234004720DBCB12648B3A1F63BE54A3E730
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SYNTPCPL.SYNPROPS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2F603045-309F-11CF-9774-0020AFD0CFF6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2F603045-309F-11CF-9774-0020AFD0CFF6}\ = "SYNTPCPL.SYNPROPS"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2F603045-309F-11CF-9774-0020AFD0CFF6}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2F603045-309F-11CF-9774-0020AFD0CFF6}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2F603045-309F-11CF-9774-0020AFD0CFF6}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\06_TOU~1\\WinWDF\\x64\\SynTPCpl.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SYNTPCPL.SYNPROPS\ = "SYNTPCPL.SYNPROPS"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SYNTPCPL.SYNPROPS\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SYNTPCPL.SYNPROPS\CLSID\ = "{2F603045-309F-11CF-9774-0020AFD0CFF6}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2F603045-309F-11CF-9774-0020AFD0CFF6}\ProgID\ = "SYNTPCPL.SYNPROPS"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\06_Touchpad\WinWDF\x64\SynTPCpl.dll
1⤵
- Modifies registry class
PID:4868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads