7f67900079cccf640f8d777af4ac68973c2f48506d833557ef4dce11f5aa0c70

Analysis

max time kernel
92s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dll/jmail.dll
Size

311KB
MD5

70afafa0dd89432651d7326c2f3edb4a
SHA1

391f53f49109d2e911c33b3edbec6d49d718e398
SHA256

18593e00993949e5cc3e04af9c810a8fbd4814ca4b84eff01060311d7ae0f8f7
SHA512

58f236be7ea0378549a96bb3b171448628faf7cab9ba58cf066032125f0c159351bef28e25d9cad5540c6852ecfaebc4d8822d9dc10356b4318447cc26956002
SSDEEP

3072:BHv2uGW3QZpmc93iRwVLM7RXnTqZP1JMTH/7pUaUMQJYkD7ke7ibQPhUWlzmYe6u:ep/+B+P1iHDWkohyQZdiIhVvU

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B10BF17C-F7EC-4EE2-AD7A-6F42816AEC0F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBAAEA4B-AD29-47BD-8776-C787D5BE28AA}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dll\\jmail.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B89D0E7A-0F5B-40EE-8AF3-08FA2ED9534F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C21B3B1-2B11-45F2-8A9E-DCC5032DE98A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC3F1977-CD10-41B2-9977-7693A4C13377}\TypeLib\ = "{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.PGPDecodeResult\Clsid\ = "{81CA5571-C109-47AE-BE1C-2DF9CB8999FF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A62C8BDB-D1FC-4FDD-A2A2-EEFF73262A41}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.Attachments	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AED3A6B1-2171-11D2-B77C-0008C73ACA8F}\TypeLib\Version = "4.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{821AAFE5-2F19-47EB-ACA9-3B4C1D64AC27}\TypeLib\Version = "4.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E05AEA1E-BCB1-473A-8B2A-4829D9E1AD23}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D821067-FCF9-4704-9287-0D8F76FE6513}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}\4.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{10E321CC-683E-4060-B938-4F53234D9593}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC3F1977-CD10-41B2-9977-7693A4C13377}\ = "PGPDecodeResults Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B10BF17C-F7EC-4EE2-AD7A-6F42816AEC0F}\ = "Recipients Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B89D0E7A-0F5B-40EE-8AF3-08FA2ED9534F}\ = "IPGPKeyInfo"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08B9999C-DAD2-4353-B25B-8CCAFFCA4D16}\TypeLib\Version = "4.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A037057-57F0-4904-A1E0-AD0EA2FB564E}\TypeLib\Version = "4.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AED3A6B1-2171-11D2-B77C-0008C73ACA8F}\TypeLib\ = "{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{23E86816-772B-4B28-A924-A135CFF6469A}\TypeLib\Version = "4.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{23E86816-772B-4B28-A924-A135CFF6469A}\ = "IPGPKeys"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{684130B2-2B8A-4E8D-BE71-8F4052882076}\TypeLib\ = "{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56930358-AD72-408F-83C4-A2B0DC8037B2}\ = "IRecipients"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65C53BE7-ED21-4C25-B189-DA0E8FAD5231}\ = "IRecipient"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.PGPDecodeResultCollection\ = "PGPDecodeResultCollection Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{23E86816-772B-4B28-A924-A135CFF6469A}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C21B3B1-2B11-45F2-8A9E-DCC5032DE98A}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B10BF17C-F7EC-4EE2-AD7A-6F42816AEC0F}\Version\ = "4.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{10E321CC-683E-4060-B938-4F53234D9593}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D821067-FCF9-4704-9287-0D8F76FE6513}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.POP3\Clsid\ = "{F812B147-0E26-4222-8EE4-9F753CD2B39C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65C53BE7-ED21-4C25-B189-DA0E8FAD5231}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{821AAFE5-2F19-47EB-ACA9-3B4C1D64AC27}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC3F1977-CD10-41B2-9977-7693A4C13377}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A62C8BDB-D1FC-4FDD-A2A2-EEFF73262A41}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{56930358-AD72-408F-83C4-A2B0DC8037B2}\ = "IRecipients"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E05AEA1E-BCB1-473A-8B2A-4829D9E1AD23}\ = "IPGPDecodeResult"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A62C8BDB-D1FC-4FDD-A2A2-EEFF73262A41}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E5FF9F62-0E7C-4372-8AD5-DA7D2418070C}\ProgID\ = "jmail.Message"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF2ED965-E0BA-4FE4-ADE2-38BD48F112E8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{821AAFE5-2F19-47EB-ACA9-3B4C1D64AC27}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65C53BE7-ED21-4C25-B189-DA0E8FAD5231}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E5FF9F62-0E7C-4372-8AD5-DA7D2418070C}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.Recipient\Clsid\ = "{DBAAEA4B-AD29-47BD-8776-C787D5BE28AA}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF2ED965-E0BA-4FE4-ADE2-38BD48F112E8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.Recipients\Clsid\ = "{B10BF17C-F7EC-4EE2-AD7A-6F42816AEC0F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBAAEA4B-AD29-47BD-8776-C787D5BE28AA}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B1CC9084-0177-4136-9B1B-C06C061F1E1D}\Version\ = "4.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{607A06FE-2FDA-4ADC-854D-D016D98D83DB}\ = "IPOP3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B89D0E7A-0F5B-40EE-8AF3-08FA2ED9534F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E6D8684-755D-4847-BF40-68EC5E4BC1E9}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41DBA1FA-44F6-4BD5-82DF-1A7FDEA0475D}\TypeLib\ = "{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41DBA1FA-44F6-4BD5-82DF-1A7FDEA0475D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{90D0A753-AD45-40FD-8C6E-555600EE5EB4}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B10BF17C-F7EC-4EE2-AD7A-6F42816AEC0F}\ProgID\ = "jmail.Recipients"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CF2ED965-E0BA-4FE4-ADE2-38BD48F112E8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E6D8684-755D-4847-BF40-68EC5E4BC1E9}\ = "IAttachments"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{14E61A41-8846-11D2-B7E4-0008C73ACA8F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08B9999C-DAD2-4353-B25B-8CCAFFCA4D16}\ = "IPGPDecodeResults"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}\4.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AED3A6B1-2171-11D2-B77C-0008C73ACA8F}\TypeLib\ = "{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B3A0ACB9-3D8C-4999-9E6B-3E44372E11DD}\Version\ = "4.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{821AAFE5-2F19-47EB-ACA9-3B4C1D64AC27}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 4708	4672	regsvr32.exe	84
PID 4672 wrote to memory of 4708	4672	regsvr32.exe	84
PID 4672 wrote to memory of 4708	4672	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dll\jmail.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dll\jmail.dll
  2⤵
  - Modifies registry class
  PID:4708

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads