I'm testing malware that built from single EXE file and it doesn't load any other DLLs.
I can see that EXE is register as COM object (I don't know how EXE can be COM object...). But when I run it and looking in procmon, I can see that it writes values to the registry.
I tried to open the EXE file with IDA Pro 6.8 / OllyDbg, and I can't see any
RegSetValue call or even reference (there is no load of Advapi32.dll).
I suspect that there is some hidden code that I can't see in these disassembles.
If there is such hidden code how can I see it? And btw, how EXE can register as COM object at all?