Overview
overview
10Static
static
10COMDLG32.dll
windows7-x64
1COMDLG32.dll
windows10-2004-x64
1MSADODC.dll
windows7-x64
1MSADODC.dll
windows10-2004-x64
1MSBIND.dll
windows7-x64
1MSBIND.dll
windows10-2004-x64
1MSCOMCT2.dll
windows7-x64
1MSCOMCT2.dll
windows10-2004-x64
1MSCOMCTL.dll
windows7-x64
1MSCOMCTL.dll
windows10-2004-x64
1MSDATGRD.dll
windows7-x64
1MSDATGRD.dll
windows10-2004-x64
1MSSTDFMT.dll
windows7-x64
1MSSTDFMT.dll
windows10-2004-x64
1MSWINSCK.dll
windows7-x64
1MSWINSCK.dll
windows10-2004-x64
1Readme-说明.htm
windows7-x64
1Readme-说明.htm
windows10-2004-x64
1jmail.dll
windows7-x64
1jmail.dll
windows10-2004-x64
1run.exe
windows7-x64
10run.exe
windows10-2004-x64
10yuren2008.exe
windows7-x64
yuren2008.exe
windows10-2004-x64
1Analysis
-
max time kernel
146s -
max time network
207s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 16:25
Behavioral task
behavioral1
Sample
COMDLG32.dll
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
COMDLG32.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
MSADODC.dll
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral4
Sample
MSADODC.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
MSBIND.dll
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral6
Sample
MSBIND.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
MSCOMCT2.dll
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral8
Sample
MSCOMCT2.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
MSCOMCTL.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral10
Sample
MSCOMCTL.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
MSDATGRD.dll
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral12
Sample
MSDATGRD.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
MSSTDFMT.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral14
Sample
MSSTDFMT.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
MSWINSCK.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral16
Sample
MSWINSCK.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Readme-说明.htm
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral18
Sample
Readme-说明.htm
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
jmail.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral20
Sample
jmail.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
run.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral22
Sample
run.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
yuren2008.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral24
Sample
yuren2008.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
MSADODC.dll
-
Size
115KB
-
MD5
d827412fc2d9c7bdc190a457206270ae
-
SHA1
14045b78fb848532b677bf8114c8107d21c28fa8
-
SHA256
d7a81a9de2c737673301d1d695bf31dfc2bc9bc5db2df18f85b4d4fa2e590a91
-
SHA512
975214f4c09295f09f3fc902fafec05d8179beccb44027851fb14177b350b65a02ba42f5f955b417e24b2bab0770070c3d6ba7254128d7eb3d1cae45c58cf266
-
SSDEEP
3072:o/jTv/fmKGte1zKjNv0+3hxW1LfqFBt1bURl/iu9pXKnfrD:QTv/fmKGtekO+3Tt1b2394D
Malware Config
Signatures
-
Modifies registry class 64 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSAdodcLib.Adodc.6\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67397AA3-7FB1-11D0-B148-00A0C922E820}\Version\ = "6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67397AA3-7FB1-11D0-B148-00A0C922E820}\ToolboxBitmap32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{67397AA1-7FB1-11D0-B148-00A0C922E820}\6.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSADODC.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67397AA3-7FB1-11D0-B148-00A0C922E820}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27F8FFB2-7406-11D1-B18C-00A0C922E820} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{67397AA1-7FB1-11D0-B148-00A0C922E820} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{47A738F1-7FAF-11D0-B148-00A0C922E820}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67397AA2-7FB1-11D0-B148-00A0C922E820}\ = "DAdodcEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67397AA2-7FB1-11D0-B148-00A0C922E820}\TypeLib\ = "{67397AA1-7FB1-11D0-B148-00A0C922E820}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSAdodcLib.Adodc\CLSID\ = "{67397AA3-7FB1-11D0-B148-00A0C922E820}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSAdodcLib.Adodc\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSAdodcLib.Adodc.6\CLSID\ = "{67397AA3-7FB1-11D0-B148-00A0C922E820}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AA2073E6-7B9C-11D0-B143-00A0C922E820}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSADODC.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{67397AA1-7FB1-11D0-B148-00A0C922E820}\6.0\ = "Microsoft ADO Data Control 6.0 (OLEDB)" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{67397AA1-7FB1-11D0-B148-00A0C922E820}\6.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{47A738F1-7FAF-11D0-B148-00A0C922E820}\TypeLib\Version = "6.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{47A738F1-7FAF-11D0-B148-00A0C922E820}\ = "IAdodc" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{67397AA2-7FB1-11D0-B148-00A0C922E820}\TypeLib\ = "{67397AA1-7FB1-11D0-B148-00A0C922E820}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67397AA3-7FB1-11D0-B148-00A0C922E820} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67397AA3-7FB1-11D0-B148-00A0C922E820}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSADODC.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67397AA3-7FB1-11D0-B148-00A0C922E820}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67397AA3-7FB1-11D0-B148-00A0C922E820}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{47A738F1-7FAF-11D0-B148-00A0C922E820} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{67397AA2-7FB1-11D0-B148-00A0C922E820}\ = "DAdodcEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{67397AA2-7FB1-11D0-B148-00A0C922E820}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67397AA2-7FB1-11D0-B148-00A0C922E820}\TypeLib\Version = "6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSAdodcLib.Adodc.6 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AA2073E6-7B9C-11D0-B143-00A0C922E820}\ = "Adodc General Property Page Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AA2073E6-7B9C-11D0-B143-00A0C922E820}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67397AA3-7FB1-11D0-B148-00A0C922E820} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67397AA3-7FB1-11D0-B148-00A0C922E820}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27F8FFB2-7406-11D1-B18C-00A0C922E820}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSADODC.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{67397AA1-7FB1-11D0-B148-00A0C922E820}\6.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{67397AA2-7FB1-11D0-B148-00A0C922E820}\TypeLib\Version = "6.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSAdodcLib.Adodc\CurVer\ = "MSAdodcLib.Adodc.6" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67397AA3-7FB1-11D0-B148-00A0C922E820}\ProgID\ = "MSAdodcLib.Adodc.6" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67397AA3-7FB1-11D0-B148-00A0C922E820}\MiscStatus\1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27F8FFB2-7406-11D1-B18C-00A0C922E820}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{47A738F1-7FAF-11D0-B148-00A0C922E820}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67397AA3-7FB1-11D0-B148-00A0C922E820}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSAdodcLib.Adodc regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67397AA3-7FB1-11D0-B148-00A0C922E820}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{47A738F1-7FAF-11D0-B148-00A0C922E820}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{47A738F1-7FAF-11D0-B148-00A0C922E820}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67397AA2-7FB1-11D0-B148-00A0C922E820}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSAdodcLib.Adodc\ = "Microsoft ADO Data Control, version 6.0 (OLEDB)" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67397AA3-7FB1-11D0-B148-00A0C922E820}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67397AA3-7FB1-11D0-B148-00A0C922E820}\MiscStatus\1\ = "180625" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27F8FFB1-7406-11D1-B18C-00A0C922E820} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27F8FFB1-7406-11D1-B18C-00A0C922E820}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27F8FFB1-7406-11D1-B18C-00A0C922E820}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSADODC.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27F8FFB2-7406-11D1-B18C-00A0C922E820}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{47A738F1-7FAF-11D0-B148-00A0C922E820}\ = "IAdodc" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{47A738F1-7FAF-11D0-B148-00A0C922E820}\TypeLib\ = "{67397AA1-7FB1-11D0-B148-00A0C922E820}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{67397AA2-7FB1-11D0-B148-00A0C922E820}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67397AA3-7FB1-11D0-B148-00A0C922E820}\VersionIndependentProgID\ = "MSAdodcLib.Adodc" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67397AA3-7FB1-11D0-B148-00A0C922E820}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AA2073E6-7B9C-11D0-B143-00A0C922E820} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67397AA2-7FB1-11D0-B148-00A0C922E820}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67397AA3-7FB1-11D0-B148-00A0C922E820}\MiscStatus\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27F8FFB1-7406-11D1-B18C-00A0C922E820} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{67397AA1-7FB1-11D0-B148-00A0C922E820}\6.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{47A738F1-7FAF-11D0-B148-00A0C922E820} regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 4348 wrote to memory of 3920 4348 regsvr32.exe regsvr32.exe PID 4348 wrote to memory of 3920 4348 regsvr32.exe regsvr32.exe PID 4348 wrote to memory of 3920 4348 regsvr32.exe regsvr32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3920-132-0x0000000000000000-mapping.dmp