fe76f77d15f401a592f6fa149958f3dfa56c428f7fd15299cb54278fb2c66a22

Analysis

max time kernel
233s
max time network
313s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jmail.dll
Size

315KB
MD5

4af612fbff91936fb2f780ea5ca307cf
SHA1

5fbc771ba729b7717278502838ac879322e2c18f
SHA256

7aca4b4e58c8092addfb1a56c665827ff04168562f6a6303d21b60e606af875f
SHA512

3863319881675dd7c42958a25af8cfcabe6f5fb5498e2f40efafe937f1d245d4da57a5e1bbc23f471fb1dff4c330938eb1d25775a2e7ca01fb75938c8d0ac9ee
SSDEEP

3072:yezWpGOdJXncK5FLCVMZVDtkOPwSYpAHYzxTDtbWzLaSxRW4bGtVHq1ySe6gVvvm:ah5FLZVDtkObHYl99WQlHq4OgVvv4

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B89D0E7A-0F5B-40EE-8AF3-08FA2ED9534F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{41DBA1FA-44F6-4BD5-82DF-1A7FDEA0475D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}\4.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.Attachment	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.Messages\Clsid\ = "{A62C8BDB-D1FC-4FDD-A2A2-EEFF73262A41}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08B9999C-DAD2-4353-B25B-8CCAFFCA4D16}\TypeLib\ = "{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{90D0A753-AD45-40FD-8C6E-555600EE5EB4}\ProgID\ = "jmail.SpeedMailer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B10BF17C-F7EC-4EE2-AD7A-6F42816AEC0F}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56930358-AD72-408F-83C4-A2B0DC8037B2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AED3A6B1-2171-11D2-B77C-0008C73ACA8F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B89D0E7A-0F5B-40EE-8AF3-08FA2ED9534F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C21B3B1-2B11-45F2-8A9E-DCC5032DE98A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08B9999C-DAD2-4353-B25B-8CCAFFCA4D16}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B1CC9084-0177-4136-9B1B-C06C061F1E1D}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53DECA78-C334-4235-9165-1FE7D8912A76}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{607A06FE-2FDA-4ADC-854D-D016D98D83DB}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AED3A6B1-2171-11D2-B77C-0008C73ACA8F}\TypeLib\ = "{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B89D0E7A-0F5B-40EE-8AF3-08FA2ED9534F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{821AAFE5-2F19-47EB-ACA9-3B4C1D64AC27}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A62C8BDB-D1FC-4FDD-A2A2-EEFF73262A41}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jmail.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B10BF17C-F7EC-4EE2-AD7A-6F42816AEC0F}\TypeLib\ = "{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B1CC9084-0177-4136-9B1B-C06C061F1E1D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jmail.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{607A06FE-2FDA-4ADC-854D-D016D98D83DB}\TypeLib\ = "{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C21B3B1-2B11-45F2-8A9E-DCC5032DE98A}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.SpeedMailer\ = "SpeedMailer Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B3A0ACB9-3D8C-4999-9E6B-3E44372E11DD}\ProgID\ = "jmail.Attachments"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E5FF9F62-0E7C-4372-8AD5-DA7D2418070C}\ = "Message Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}\4.0\ = "JMail 4.0 library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}\4.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jmail.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AED3A6B1-2171-11D2-B77C-0008C73ACA8F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E05AEA1E-BCB1-473A-8B2A-4829D9E1AD23}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81CA5571-C109-47AE-BE1C-2DF9CB8999FF}\ProgID\ = "jmail.PGPDecodeResult"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.Recipients	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E6D8684-755D-4847-BF40-68EC5E4BC1E9}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AED3A6B1-2171-11D2-B77C-0008C73ACA8F}\ = "ISMTPMail"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{90D0A753-AD45-40FD-8C6E-555600EE5EB4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jmail.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.POP3\ = "JMail POP3 Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53DECA78-C334-4235-9165-1FE7D8912A76}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56930358-AD72-408F-83C4-A2B0DC8037B2}\ = "IRecipients"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B89D0E7A-0F5B-40EE-8AF3-08FA2ED9534F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC3F1977-CD10-41B2-9977-7693A4C13377}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A62C8BDB-D1FC-4FDD-A2A2-EEFF73262A41}\ProgID\ = "jmail.Messages"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53DECA78-C334-4235-9165-1FE7D8912A76}\ = "Attachment Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{607A06FE-2FDA-4ADC-854D-D016D98D83DB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF2ED965-E0BA-4FE4-ADE2-38BD48F112E8}\TypeLib\ = "{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{10E321CC-683E-4060-B938-4F53234D9593}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{90D0A753-AD45-40FD-8C6E-555600EE5EB4}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F812B147-0E26-4222-8EE4-9F753CD2B39C}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{684130B2-2B8A-4E8D-BE71-8F4052882076}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF2ED965-E0BA-4FE4-ADE2-38BD48F112E8}\TypeLib\Version = "4.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C21B3B1-2B11-45F2-8A9E-DCC5032DE98A}\TypeLib\Version = "4.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.Message\ = "Message Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{14E61A41-8846-11D2-B7E4-0008C73ACA8F}\TypeLib\Version = "4.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.PGPDecodeResultCollection\Clsid\ = "{10E321CC-683E-4060-B938-4F53234D9593}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.PGPDecodeResults\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AED3A6B1-2171-11D2-B77C-0008C73ACA8F}\TypeLib\Version = "4.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AED3A6B3-2171-11D2-B77C-0008C73ACA8F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B1CC9084-0177-4136-9B1B-C06C061F1E1D}\ProgID\ = "jmail.Headers"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65C53BE7-ED21-4C25-B189-DA0E8FAD5231}\TypeLib\ = "{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E61A41-8846-11D2-B7E4-0008C73ACA8F}\TypeLib\ = "{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{821AAFE5-2F19-47EB-ACA9-3B4C1D64AC27}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.SpeedMailer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D821067-FCF9-4704-9287-0D8F76FE6513}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3792 wrote to memory of 1948	3792	regsvr32.exe	regsvr32.exe
PID 3792 wrote to memory of 1948	3792	regsvr32.exe	regsvr32.exe
PID 3792 wrote to memory of 1948	3792	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\jmail.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3792

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\jmail.dll
2⤵
- Modifies registry class
PID:1948

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads