fbefbd142aa9e842754ad914e9a3b14a60129fe8b9863db23e2c8c697b5923aa

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fbefbd142aa9e842754ad914e9a3b14a60129fe8b9863db23e2c8c697b5923aa.dll
Size 347KB
Sample260729-pfy8xstdpe
SHA256 fbefbd142aa9e842754ad914e9a3b14a60129fe8b9863db23e2c8c697b5923aa
MD5 5f338809e1174ab79e5063ccad569ebf
SHA1 e7c10454339bfcd3e7f35183dac4c61e642f848f
SHA512 8c054b6893c77cf4772b3504485ae941355d5fd153f497b91822a4edf7f3f9158d1a499954ed9de64d32a2fd92d99f2234c33f5e6a318d85a52ca7c3b66732ed
SSDEEP 6144:/6gK/APsjrh+9bETi0zMThBjH5RNLBFwCJKq9RKa6wVF1u1+gbu11MUrjFzNLWWE:yg8jrEtmiIMThBjHdBFQqjK2VF1uIPMi
TLSH
T1D574CFD5E75134E5F25B89708EB34F4396223E0F8A21D27B1295450FAE63FC61E34BA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
4832	wuaupdt.exe
5724	svcmon.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemHealth = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemHealth\\svcmon.exe"	wuaupdt.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svcmon.log	svcmon.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{7C3A5D49-E8B2-4F1C-A6D0-3E7F8B9C2D1A}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{7C3A5D49-E8B2-4F1C-A6D0-3E7F8B9C2D1A}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{7C3A5D49-E8B2-4F1C-A6D0-3E7F8B9C2D1A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fbefbd142aa9e842754ad914e9a3b14a60129fe8b9863db23e2c8c697b5923aa.dll"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{7C3A5D49-E8B2-4F1C-A6D0-3E7F8B9C2D1A}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 4832	4748	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fbefbd142aa9e842754ad914e9a3b14a60129fe8b9863db23e2c8c697b5923aa.dll
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Users\Admin\AppData\Local\Temp\wuaupdt.exe
  C:\Users\Admin\AppData\Local\Temp\wuaupdt.exe -k d36deee39830bfb111b50bf8315a4de292812e0d2aafd5fc8666c9db11e8e590 -p C:\Users\Admin\AppData\Local\Temp\wuaupdt.dat
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4832

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemHealth\svcmon.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemHealth\svcmon.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wuaupdt.dat

Path C:\Users\Admin\AppData\Local\Temp\wuaupdt.dat
Size 19KB
SHA256 8d217ad2ff7ed9e162cbd20bd207562f7e4f50d3e4d1f36ab01d653380176d16
MD5 d4a0b5b1f5d4f43ff01360d2f16f171b
SHA1 4dc61875f53c58fbdfae8db3e9d5e66c7f5f7db5
SHA512 a719b5e766abdb445523a11c4631d33b093eafc6f9a15ec6565e4da23926efd84bfce63df315a4a2dfb0f11136c4db016de6cd4d015346528984f8f6b846f5fc
SSDEEP 384:GCn1ZJSNWt3tgHichNiZssurAN1fwK1rssfFYEIepFV6Qs/blkuP:GK1ZsQFaHlrCurAX3rssfFqepFVVuP
TLSH
T12E92E18B1AEF6930A77623B0B4920B164513E24E6869584E321227F5C93D7E2CF6477D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuaupdt.exe

Path C:\Users\Admin\AppData\Local\Temp\wuaupdt.exe
Size 226KB
SHA256 28e55dc62f9a9c9938c3b48b2d17a33d6fa96e74c1e9d31f5c685fef8c39b217
MD5 230bb7c97fbb1e96d9ebee43cfa09024
SHA1 8ef97a15935e269c02416f79c4316b6ee81f9d00
SHA512 4e9ecff43c7ff6123b1cd4d3d4ec53f914c8d2f50b7aa14059982b8be0a19efd809445bb685688d595f00a517e7bef51c7b5e9ea641ae16d6117fc0e1357bf74
SSDEEP 3072:JhM3eH6r0m5wksg0mzZMvsuvRuUlHG9+aLSWvy6PP+Yalj1TuKubf5Ql9Tx8:xHfUwksg0gMviUlSSWvywTarI1w9TG
TLSH
T182346C5573B58AF5ECA781398D624606F7727B170722D7DB03A0C266AF13AE04E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4748-2-0x00007FFB5D5FE000-0x00007FFB5D5FF000-memory.dmp

Download

memory/4832-8-0x000001AF23950000-0x000001AF23955000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads