90f2ac28649c8877379014012263125fdb86489ccc8d6cc80180437dbdf3be8c

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
90f2ac28649c8877379014012263125fdb86489ccc8d6cc80180437dbdf3be8c.dll
Size 630KB
Sample260729-pfcd6afp5v
SHA256 90f2ac28649c8877379014012263125fdb86489ccc8d6cc80180437dbdf3be8c
MD5 78a6b14a7a18df5a21efacabb13b424f
SHA1 1cfc8f6bd829211dda7886ae1bb852f3a8648bf9
SHA512 131157effdd43f63ecabcc618ae603219b0fee9d079cae6ea87802fb3ce68c8097b4c43ebf0777e7c4c20d3a35fdf40447193691d855362e3ef3b7df5cf16026
SSDEEP 6144:0rNWEayAsnwbtsn60101KoavRn3xaBVTFPvt2ONzTpv5TjVTxbQnAEnOrJ/ejcxB:8NW2n7ecRxYTFP5xL2Keja/XJv3
TLSH
T1B9D47C6274D51895C133C2F2CF93E1689753FC791D64852BA2CD2E162F0AEA12D23EF6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
1492	wuaupdt.exe
3056	patchagent.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\PatchAgent = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\PatchAgent\\patchagent.exe"	wuaupdt.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{7C3A5D49-E8B2-4F1C-A6D0-3E7F8B9C2D1A}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{7C3A5D49-E8B2-4F1C-A6D0-3E7F8B9C2D1A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\90f2ac28649c8877379014012263125fdb86489ccc8d6cc80180437dbdf3be8c.dll"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{7C3A5D49-E8B2-4F1C-A6D0-3E7F8B9C2D1A}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{7C3A5D49-E8B2-4F1C-A6D0-3E7F8B9C2D1A}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 1492	4300	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\90f2ac28649c8877379014012263125fdb86489ccc8d6cc80180437dbdf3be8c.dll
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Users\Admin\AppData\Local\Temp\wuaupdt.exe
  C:\Users\Admin\AppData\Local\Temp\wuaupdt.exe -k d36deee39830bfb111b50bf8315a4de292812e0d2aafd5fc8666c9db11e8e590 -p C:\Users\Admin\AppData\Local\Temp\wuaupdt.dat
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1492

C:\Users\Admin\AppData\Roaming\Microsoft\PatchAgent\patchagent.exe
C:\Users\Admin\AppData\Roaming\Microsoft\PatchAgent\patchagent.exe
1⤵
- Executes dropped EXE
PID:3056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wuaupdt.dat

Path C:\Users\Admin\AppData\Local\Temp\wuaupdt.dat
Size 20KB
SHA256 b0c3b9a830c3c4574fe47b0c8279254c7bd984ed36c25798a17fe5fa11e17549
MD5 017a28ef2bdfea5e8233e54666743caf
SHA1 3a1fdefde20302c0da04f6ec4bf3e134ffedd690
SHA512 12b32d41b1efb68962e9a014d0ba422657941d8e92dfde0134a9ebd81aed1684e14aaecd696edd9f9f41847a4fbc2782e5b47dd2d22081c479554518527b2b41
SSDEEP 384:PipMvPq4jU3VcuDcaRrM3iFzgNqjijpVJf+qfHRkT+Ur0z8C/EnYVSF0:P/qKUlc2ca3SNq+pVJfDfxkrTBnaSF0
TLSH
T19C92E0C934B758F582C9F4E08A7F9A501534988A0D1BA45C1BAA663D28948E13E3E7CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuaupdt.exe

Path C:\Users\Admin\AppData\Local\Temp\wuaupdt.exe
Size 238KB
SHA256 dd520b36d1a99e56d340adb47bbb19846dcbc7a185e3b1f4b4e58851e1116063
MD5 b7c012cacb019ac2ee5cfbbd84e169f7
SHA1 50f1f0219c17511af5936a3426f5f4ed40e6b7c6
SHA512 7fc2a6572af2cdb21023854c10354c56b634fd9a98dfe1ccab0d02b085c1ca6f6a1c9ead19070fb68c7dadc0e79df0d9a819f9b8579209d35c96e38381e125a7
SSDEEP 3072:eVk+WKbDCYS4uqs5jELgqg5ulxfcwOoOmZhv9jXzOxovmSrxLju7LXxTjWc:etblxuqs5nqgAcwWSjXa+vmieh5
TLSH
T130347C5563B08AF9EC7781398D614506FB727A130722C7DB03A0C666AF23BE15E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

patchagent.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\PatchAgent\patchagent.ini
Size 152B
SHA256 4ea1f89d3082a55a2f9b9c846908a8654bd56f0c717ffe5c40d2fc2e106bdfa3
MD5 e0f07e47bacec5a9cce0fe5fe190675c
SHA1 d20df5baa4f6133c5cffa85cafc7987eaf312f27
SHA512 c37ce239e81c23ffc071f45ac35beb073c19856a1b902903f59ba8718602a0f9d51ff51451eb8cdafad2846476529b176afc16fc0a15301b9f30eda167a3d541
TLSH
T11EC08CB840C8BA1B6A5997932B33A588466E07AE6B2C26442A044D956F006C4EA0633E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4300-0-0x00007FFB6A57E000-0x00007FFB6A57F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads