Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 13:38
Static task
static1
Behavioral task
behavioral1
Sample
jmrj/软件杂编/sys/VB40032.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
jmrj/软件杂编/sys/VB40032.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
jmrj/软件杂编/sys/rjzb1.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
jmrj/软件杂编/sys/rjzb1.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
jmrj/软件杂编/开始运行.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
jmrj/软件杂编/开始运行.exe
Resource
win10v2004-20231215-en
General
-
Target
jmrj/软件杂编/sys/rjzb1.exe
-
Size
168KB
-
MD5
51518e5a8a0c414714cd86ec808b6c93
-
SHA1
5017c315a4c6320cdd83a5ce096a67ac5735aa62
-
SHA256
42fda779758901a3fb9b783eb1dd0cebeb4e5d505f7e9f7643cc624c1e2ff689
-
SHA512
5ddae072e72b2332d9eff223d12cb3bc3db1454d8eaa3ac409cc15636149ef2be7758ddf8b9aae5a1eda7da4729a54a8feaada074c3206c19b6847ba87a74d8a
-
SSDEEP
3072:VM4+uicw+nzNZWh3G39OiSJzKqKwTGttk3khe:u3u/w+7W8OiSJUSmKp
Malware Config
Signatures
-
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4C4671C-499F-101B-BB78-00AA00383CBB} rjzb1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4C4671C-499F-101B-BB78-00AA00383CBB}\ = "VBA Collection Object" rjzb1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4C4671C-499F-101B-BB78-00AA00383CBB}\InprocServer32 rjzb1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4C4671C-499F-101B-BB78-00AA00383CBB}\InprocServer32\ rjzb1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2988 rjzb1.exe