f0f537e92dc1537179d533990bd79b4416eeadd033d850fd2f387d8d9143ab0d

Analysis

max time kernel
140s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IA2ComProxy.dll
Size

26KB
MD5

8f725d3b249378a00eb9e8f3f526b223
SHA1

cb8d4281e7c81ed8952fcf12df1f01d044c909c3
SHA256

f0f537e92dc1537179d533990bd79b4416eeadd033d850fd2f387d8d9143ab0d
SHA512

b8273eff49941da7aebbaa3dfe9af00f8c71dd8bb70beebf921744a706e4a3ea63d15835989b1b2837227375b5a4e817960b1503c0cb7ea387625e664c2633ee
SSDEEP

384:vd1Q8ZV8kP6nPKSBUZZkgmNZ+q9ZrOLhQdrtEZFWwWWIQ:vd1QUVxChBO/mVFchCmZJ

Score

1^/10

Malware Config

Signatures

Modifies registry class 61 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6167F295-06F0-4CDD-A1FA-02E25153D869}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1546D4B0-4C98-4BDA-89AE-9A64748BDDE4}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C9430E9-299D-4E6F-BD01-A82A1E88D3FF}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{01C20F2B-3DD2-400F-949F-AD00BDAB1D41}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B4F8BBF-F1F2-418A-B35E-A195BC4103B9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C48C7FCF-4AB5-4056-AFA6-902D6E1D1149}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01C20F2B-3DD2-400F-949F-AD00BDAB1D41}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35855B5B-C566-4FD0-A7B1-E65465600394}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35855B5B-C566-4FD0-A7B1-E65465600394}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CF64D89F-8287-4B44-8501-A827453A6077}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1546D4B0-4C98-4BDA-89AE-9A64748BDDE4}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{594116B1-C99F-4847-AD06-0A7A86ECE645}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B4F8BBF-F1F2-418A-B35E-A195BC4103B9}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C9430E9-299D-4E6F-BD01-A82A1E88D3FF}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\WOW6432Node\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{01C20F2B-3DD2-400F-949F-AD00BDAB1D41}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35855B5B-C566-4FD0-A7B1-E65465600394}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35AD8070-C20C-4FB4-B094-F4F7275DD469}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C48C7FCF-4AB5-4056-AFA6-902D6E1D1149}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE5ABB3D-615E-4F7B-909F-5F0EDA9E8DDE}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6167F295-06F0-4CDD-A1FA-02E25153D869}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A59AA09A-7011-4B65-939D-32B1FB5547E3}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7CDF86EE-C3DA-496A-BDA4-281B336E1FDC}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE5ABB3D-615E-4F7B-909F-5F0EDA9E8DDE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D49DED83-5B25-43F4-9B95-93B44595979E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6167F295-06F0-4CDD-A1FA-02E25153D869}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CF64D89F-8287-4B44-8501-A827453A6077}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1546D4B0-4C98-4BDA-89AE-9A64748BDDE4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{24FD2FFB-3AAD-4A08-8335-A3AD89C0FB4B}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D49DED83-5B25-43F4-9B95-93B44595979E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CF64D89F-8287-4B44-8501-A827453A6077}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{594116B1-C99F-4847-AD06-0A7A86ECE645}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9690A9CC-5C80-4DF5-852E-2D5AE4189A54}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{24FD2FFB-3AAD-4A08-8335-A3AD89C0FB4B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A59AA09A-7011-4B65-939D-32B1FB5547E3}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B4F8BBF-F1F2-418A-B35E-A195BC4103B9}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C48C7FCF-4AB5-4056-AFA6-902D6E1D1149}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D49DED83-5B25-43F4-9B95-93B44595979E}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35AD8070-C20C-4FB4-B094-F4F7275DD469}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9690A9CC-5C80-4DF5-852E-2D5AE4189A54}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B70D9F59-3B5A-4DBA-AB9E-22012F607DF5}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E89F726E-C4F4-4C19-BB19-B647D7FA8478}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E89F726E-C4F4-4C19-BB19-B647D7FA8478}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35AD8070-C20C-4FB4-B094-F4F7275DD469}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A59AA09A-7011-4B65-939D-32B1FB5547E3}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C9430E9-299D-4E6F-BD01-A82A1E88D3FF}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{24FD2FFB-3AAD-4A08-8335-A3AD89C0FB4B}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE5ABB3D-615E-4F7B-909F-5F0EDA9E8DDE}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{594116B1-C99F-4847-AD06-0A7A86ECE645}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7CDF86EE-C3DA-496A-BDA4-281B336E1FDC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01C20F2B-3DD2-400F-949F-AD00BDAB1D41}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B70D9F59-3B5A-4DBA-AB9E-22012F607DF5}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B70D9F59-3B5A-4DBA-AB9E-22012F607DF5}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E89F726E-C4F4-4C19-BB19-B647D7FA8478}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{01C20F2B-3DD2-400F-949F-AD00BDAB1D41}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9690A9CC-5C80-4DF5-852E-2D5AE4189A54}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7CDF86EE-C3DA-496A-BDA4-281B336E1FDC}\NumMethods	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 244	3388	regsvr32.exe	90
PID 3388 wrote to memory of 244	3388	regsvr32.exe	90
PID 3388 wrote to memory of 244	3388	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\IA2ComProxy.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\IA2ComProxy.dll
  2⤵
  - Modifies registry class
  PID:244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3608,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:8
1⤵
PID:1136

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads