2d280b703f567beb3f4dd5d80233cd41b231826451a83157d75f93097a0c6490

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

MSMAPI32.dll
Size

133KB
MD5

d329085a88a9019ed5700c0f04b3176e
SHA1

ab504f7cc07889057513f4916248bd4910360090
SHA256

60e841057cbbf33e10c5169cc328330d11838636002670cb9e8a7a09bab321ab
SHA512

badf8a50f78c8cb08538ae47c1fd660baa6dda6276dc355e3141b3a202b5041e9a685241935de597eb93a9caf1ab08099c686ad203ea79d7a37796bef5212b2a
SSDEEP

3072:R80WAViXxnCcg9t52SUF/V6MkWJtR7Zd/zDQJw+BF5E7gW0jfrx:R89iiXxnG527kytRNdDYa8x

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CAB-15DA-101B-B9A8-444553540000}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CA0-15DA-101B-B9A8-444553540000}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CA0-15DA-101B-B9A8-444553540000}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20C62CA2-15DA-101B-B9A8-444553540000}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F49AC0B2-DF74-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20C62CAD-15DA-101B-B9A8-444553540000}\ = "MAPIMessagesEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20C62CAD-15DA-101B-B9A8-444553540000}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSMAPI.MAPIMessages.1\ = "Microsoft MAPI Messages Control, version 6.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CAB-15DA-101B-B9A8-444553540000}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSMAPI32.dll, 1000"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSMAPI.MAPISession.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CA0-15DA-101B-B9A8-444553540000}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F49AC0B0-DF74-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F49AC0B0-DF74-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20C62CAD-15DA-101B-B9A8-444553540000}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CAB-15DA-101B-B9A8-444553540000}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB1AE0D1-634E-11CF-8996-00AA00688B10}\ = "MAPIMessages General Property Page Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20C62CA2-15DA-101B-B9A8-444553540000}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20C62CA2-15DA-101B-B9A8-444553540000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSMAPI.MAPIMessages\CurVer\ = "MSMAPI.MAPIMessages.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CA0-15DA-101B-B9A8-444553540000}\Version\ = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20C62CA2-15DA-101B-B9A8-444553540000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F49AC0B2-DF74-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSMAPI.MAPISession\ = "Microsoft MAPI Session Control, version 6.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20C62CA2-15DA-101B-B9A8-444553540000}\TypeLib\Version = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20C62CAD-15DA-101B-B9A8-444553540000}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CA0-15DA-101B-B9A8-444553540000}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CA0-15DA-101B-B9A8-444553540000}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20C62CAE-15DA-101B-B9A8-444553540000}\1.1\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CAB-15DA-101B-B9A8-444553540000}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CAB-15DA-101B-B9A8-444553540000}\TypeLib\ = "{20C62CAE-15DA-101B-B9A8-444553540000}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSMAPI.MAPISession	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSMAPI.MAPISession\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CA0-15DA-101B-B9A8-444553540000}\TypeLib\ = "{20C62CAE-15DA-101B-B9A8-444553540000}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20C62CAD-15DA-101B-B9A8-444553540000}\TypeLib\ = "{20C62CAE-15DA-101B-B9A8-444553540000}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CAB-15DA-101B-B9A8-444553540000}\VersionIndependentProgID\ = "MSMAPI.MAPIMessages"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CA0-15DA-101B-B9A8-444553540000}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB1AE0D1-634E-11CF-8996-00AA00688B10}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F49AC0B2-DF74-11CF-8E74-00A0C90F26F8}\ = "IMapiMessages"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F49AC0B2-DF74-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CAB-15DA-101B-B9A8-444553540000}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CAB-15DA-101B-B9A8-444553540000}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CA0-15DA-101B-B9A8-444553540000}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F49AC0B0-DF74-11CF-8E74-00A0C90F26F8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CAB-15DA-101B-B9A8-444553540000}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CA0-15DA-101B-B9A8-444553540000}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CA0-15DA-101B-B9A8-444553540000}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CA0-15DA-101B-B9A8-444553540000}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CA0-15DA-101B-B9A8-444553540000}\MiscStatus\1\ = "132497"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20C62CAE-15DA-101B-B9A8-444553540000}\1.1\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSMAPI32.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20C62CAD-15DA-101B-B9A8-444553540000}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20C62CA2-15DA-101B-B9A8-444553540000}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSMAPI.MAPIMessages\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSMAPI.MAPIMessages.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CAB-15DA-101B-B9A8-444553540000}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CAB-15DA-101B-B9A8-444553540000}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CA0-15DA-101B-B9A8-444553540000}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CA0-15DA-101B-B9A8-444553540000}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20C62CA2-15DA-101B-B9A8-444553540000}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20C62CA2-15DA-101B-B9A8-444553540000}\ = "MAPISessionEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CAB-15DA-101B-B9A8-444553540000}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSMAPI.MAPIMessages	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CAB-15DA-101B-B9A8-444553540000}\MiscStatus	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CA0-15DA-101B-B9A8-444553540000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C62CA0-15DA-101B-B9A8-444553540000}\ProgID\ = "MSMAPI.MAPISession.1"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2916	2036	regsvr32.exe	30
PID 2036 wrote to memory of 2916	2036	regsvr32.exe	30
PID 2036 wrote to memory of 2916	2036	regsvr32.exe	30
PID 2036 wrote to memory of 2916	2036	regsvr32.exe	30
PID 2036 wrote to memory of 2916	2036	regsvr32.exe	30
PID 2036 wrote to memory of 2916	2036	regsvr32.exe	30
PID 2036 wrote to memory of 2916	2036	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\MSMAPI32.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\MSMAPI32.dll
  2⤵
  - Modifies registry class
  PID:2916

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads