585a9cbdd27f5a8dcd755605832f292d525024e2daa401887cb9c78975eb4f2b | Triage

Analysis

max time kernel
138s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:53

Sharing

Report Analysis Logs

General

Target

comuid.dll
Size

571KB
MD5

40e947f18137a41d36858cdab4bfc1b3
SHA1

c7fbbdb448876174d28df35d8099241567edb221
SHA256

585a9cbdd27f5a8dcd755605832f292d525024e2daa401887cb9c78975eb4f2b
SHA512

8a716fe1da96103a49d4879dce6b17864a2dc6bd562f554698c86e77a541f6d28cdedb6b1c7d008802bd4f316a31a3408cb3f57fdc3cac50c6a645ebf9487dfa
SSDEEP

12288:dgDIsVpVP8L472n2ppjCjnicOGl6osrMs51Kn2nAMO:dlCVP+4722ppgicOTNMs51K2nAb

Score

1^/10

Malware Config

Signatures

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{016FD94E-B02A-4AB8-94C6-149FDAB56B8D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{016fd94e-b02a-4ab8-94c6-149fdab56b8d}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\WOW6432Node\Interface	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{016fd94e-b02a-4ab8-94c6-149fdab56b8d}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{016FD94E-B02A-4AB8-94C6-149FDAB56B8D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{016fd94e-b02a-4ab8-94c6-149fdab56b8d}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{016fd94e-b02a-4ab8-94c6-149fdab56b8d}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{016fd94e-b02a-4ab8-94c6-149fdab56b8d}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 4736	3428	regsvr32.exe	92
PID 3428 wrote to memory of 4736	3428	regsvr32.exe	92
PID 3428 wrote to memory of 4736	3428	regsvr32.exe	92

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\comuid.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\comuid.dll
  2⤵
  - Modifies registry class
  PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3444,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:8
1⤵
PID:4076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads