dba145f2f0e0b777aa2bd52454e1f6b4a23198da0716ff5d2a4621dc3c8d52ac

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dba145f2f0e0b777aa2bd52454e1f6b4a23198da0716ff5d2a4621dc3c8d52ac.dll
Size 374KB
Sample261113-ce9xtae19j
SHA256 dba145f2f0e0b777aa2bd52454e1f6b4a23198da0716ff5d2a4621dc3c8d52ac
MD5 027e48505be80b464ed4d8c8c141e847
SHA1 2bc18d571bed1e2b2c5a039b7889d04aea4e0c18
SHA512 70734afc916dd9763c60e6624a000dfff23f9a8a88b67bdf37fa804504e354df11c807eb89ae885d19acd2ff1808cd19e3a73d50104bc9e9ff88ce91f0633a2a
SSDEEP 6144:YCs6UfUtar/2y+BQNqDM4rjvWiCnRo51JAWdSLNopCN08MiP:YCs6UfUuwQNqbqG51JZILUCN0t4
TLSH
T1FE842A67A79445B9D61169B0E3670BA6E3F954E4072487C7B3280E6B6D333C6EFB3180
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 17 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{01AB6ABC-1119-1976-B308-20251222748D}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{01AB6ABC-1119-1976-B308-20251222748D}\FilterData = 02000000000020000100000000000000307069330a00000000000000010000000000000000000000307479330000000038000000480000007669647300001000800000aa00389b717deb36e44f52ce119f530020af0ba770	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{01AB6ABC-1119-1976-B308-20251222748D}\FriendlyName = "Kandao Virtual Camera"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{01AB6ABC-1119-1976-B308-20251222748D}\CLSID = "{01AB6ABC-1119-1976-B308-20251222748D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{01AB6ABC-1119-1976-B308-20251222748D}\CLSID = "{01AB6ABC-1119-1976-B308-20251222748D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{01AB6ABC-1119-1976-B308-20251222748D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dba145f2f0e0b777aa2bd52454e1f6b4a23198da0716ff5d2a4621dc3c8d52ac.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{01AB6ABC-1119-1976-B308-20251222748D}\FriendlyName = "Kandao Virtual Camera"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\Instance\{01AB6ABC-1119-1976-B308-20251222748D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{01AB6ABC-1119-1976-B308-20251222748D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{01AB6ABC-1119-1976-B308-20251222748D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{01AB6ABC-1119-1976-B308-20251222748D}\ = "Kandao Virtual Camera"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{01AB6ABC-1119-1976-B308-20251222748D}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{01AB6ABC-1119-1976-B308-20251222748D}	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{01AB6ABC-1119-1976-B308-20251222748D}\FilterData = 02000000000060000100000000000000307069330a00000000000000010000000000000000000000307479330000000038000000480000007669647300001000800000aa00389b717deb36e44f52ce119f530020af0ba770	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dba145f2f0e0b777aa2bd52454e1f6b4a23198da0716ff5d2a4621dc3c8d52ac.dll
1⤵
- Modifies registry class
PID:2532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads