Overview
overview
3Static
static
3ASPjm-test.vbs
windows7-x64
1ASPjm-test.vbs
windows10-2004-x64
1ad-manage/...or.vbs
windows7-x64
1ad-manage/...or.vbs
windows10-2004-x64
1ad-manage/...tor.js
windows7-x64
1ad-manage/...tor.js
windows10-2004-x64
1ad-manage/...��.url
windows7-x64
1ad-manage/...��.url
windows10-2004-x64
1asp-lz/Code.vbs
windows7-x64
1asp-lz/Code.vbs
windows10-2004-x64
1config.vbs
windows7-x64
1config.vbs
windows10-2004-x64
1dbconn.vbs
windows7-x64
1dbconn.vbs
windows10-2004-x64
1department...ok.vbs
windows7-x64
1department...ok.vbs
windows10-2004-x64
1department...st.vbs
windows7-x64
1department...st.vbs
windows10-2004-x64
1dll/dc_dat..._0.dll
windows7-x64
1dll/dc_dat..._0.dll
windows10-2004-x64
1dll/jmail.dll
windows7-x64
1dll/jmail.dll
windows10-2004-x64
1dll/setup.bat
windows7-x64
1dll/setup.bat
windows10-2004-x64
1err/sql-err.html
windows7-x64
1err/sql-err.html
windows10-2004-x64
1excel/users_145.xls
windows7-x64
1excel/users_145.xls
windows10-2004-x64
1fckeditor_...mon.js
windows7-x64
1fckeditor_...mon.js
windows10-2004-x64
1fckeditor_...t.html
windows7-x64
1fckeditor_...t.html
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 18:29
Static task
static1
Behavioral task
behavioral1
Sample
ASPjm-test.vbs
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
ASPjm-test.vbs
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
ad-manage/fckeditor.vbs
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
ad-manage/fckeditor.vbs
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
ad-manage/fckeditor.js
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
ad-manage/fckeditor.js
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
ad-manage/新云软件.url
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
ad-manage/新云软件.url
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
asp-lz/Code.vbs
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
asp-lz/Code.vbs
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
config.vbs
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral12
Sample
config.vbs
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
dbconn.vbs
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
dbconn.vbs
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
department/manage/Admin_user_ok.vbs
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
department/manage/Admin_user_ok.vbs
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
department/manage/admin_list.vbs
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
department/manage/admin_list.vbs
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
dll/dc_data100_v1_0.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
dll/dc_data100_v1_0.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
dll/jmail.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
dll/jmail.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
dll/setup.bat
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
dll/setup.bat
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
err/sql-err.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
err/sql-err.html
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
excel/users_145.xls
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral28
Sample
excel/users_145.xls
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
fckeditor_2.6.2/editor/dialog/common/fck_dialog_common.js
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
fckeditor_2.6.2/editor/dialog/common/fck_dialog_common.js
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
fckeditor_2.6.2/editor/dialog/fck_about.html
Resource
win7-20240319-en
windows7-x64
Behavioral task
behavioral32
Sample
fckeditor_2.6.2/editor/dialog/fck_about.html
Resource
win10v2004-20240412-en
windows10-2004-x64
General
-
Target
dll/jmail.dll
-
Size
311KB
-
MD5
70afafa0dd89432651d7326c2f3edb4a
-
SHA1
391f53f49109d2e911c33b3edbec6d49d718e398
-
SHA256
18593e00993949e5cc3e04af9c810a8fbd4814ca4b84eff01060311d7ae0f8f7
-
SHA512
58f236be7ea0378549a96bb3b171448628faf7cab9ba58cf066032125f0c159351bef28e25d9cad5540c6852ecfaebc4d8822d9dc10356b4318447cc26956002
-
SSDEEP
3072:BHv2uGW3QZpmc93iRwVLM7RXnTqZP1JMTH/7pUaUMQJYkD7ke7ibQPhUWlzmYe6u:ep/+B+P1iHDWkohyQZdiIhVvU
Malware Config
Signatures
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F812B147-0E26-4222-8EE4-9F753CD2B39C}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AED3A6B3-2171-11D2-B77C-0008C73ACA8F}\Version\ = "4.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B10BF17C-F7EC-4EE2-AD7A-6F42816AEC0F}\TypeLib\ = "{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{821AAFE5-2F19-47EB-ACA9-3B4C1D64AC27} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{41DBA1FA-44F6-4BD5-82DF-1A7FDEA0475D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{90D0A753-AD45-40FD-8C6E-555600EE5EB4}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D821067-FCF9-4704-9287-0D8F76FE6513}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dll\\jmail.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AED3A6B1-2171-11D2-B77C-0008C73ACA8F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jmail.Recipient\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1CC9084-0177-4136-9B1B-C06C061F1E1D}\Version\ = "4.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{952F0B99-50B6-44B3-AE0D-700D5B98B416}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{81CA5571-C109-47AE-BE1C-2DF9CB8999FF}\Version\ = "4.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{607A06FE-2FDA-4ADC-854D-D016D98D83DB}\TypeLib\Version = "4.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E6D8684-755D-4847-BF40-68EC5E4BC1E9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E05AEA1E-BCB1-473A-8B2A-4829D9E1AD23}\TypeLib\Version = "4.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{41DBA1FA-44F6-4BD5-82DF-1A7FDEA0475D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A037057-57F0-4904-A1E0-AD0EA2FB564E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{90D0A753-AD45-40FD-8C6E-555600EE5EB4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dll\\jmail.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A037057-57F0-4904-A1E0-AD0EA2FB564E}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{821AAFE5-2F19-47EB-ACA9-3B4C1D64AC27} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jmail.PGPDecodeResult regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DBAAEA4B-AD29-47BD-8776-C787D5BE28AA}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC3F1977-CD10-41B2-9977-7693A4C13377}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F812B147-0E26-4222-8EE4-9F753CD2B39C}\ProgID\ = "jmail.POP3" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{684130B2-2B8A-4E8D-BE71-8F4052882076} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{41DBA1FA-44F6-4BD5-82DF-1A7FDEA0475D}\ = "IPGPDecodeResultCollection" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{41DBA1FA-44F6-4BD5-82DF-1A7FDEA0475D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jmail.PGPDecodeResultCollection regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E61A41-8846-11D2-B7E4-0008C73ACA8F}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10E321CC-683E-4060-B938-4F53234D9593}\ = "PGPDecodeResultCollection Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jmail.SMTPMail\Clsid\ = "{AED3A6B3-2171-11D2-B77C-0008C73ACA8F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53DECA78-C334-4235-9165-1FE7D8912A76}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B10BF17C-F7EC-4EE2-AD7A-6F42816AEC0F}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A037057-57F0-4904-A1E0-AD0EA2FB564E}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{65C53BE7-ED21-4C25-B189-DA0E8FAD5231}\TypeLib\ = "{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jmail.POP3\ = "JMail POP3 Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A62C8BDB-D1FC-4FDD-A2A2-EEFF73262A41}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dll\\jmail.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10E321CC-683E-4060-B938-4F53234D9593}\ProgID\ = "jmail.PGPDecodeResultCollection" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{56930358-AD72-408F-83C4-A2B0DC8037B2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F812B147-0E26-4222-8EE4-9F753CD2B39C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dll\\jmail.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AED3A6B3-2171-11D2-B77C-0008C73ACA8F}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1CC9084-0177-4136-9B1B-C06C061F1E1D}\ = "Headers Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jmail.Messages\Clsid\ = "{A62C8BDB-D1FC-4FDD-A2A2-EEFF73262A41}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B10BF17C-F7EC-4EE2-AD7A-6F42816AEC0F}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CF2ED965-E0BA-4FE4-ADE2-38BD48F112E8}\TypeLib\Version = "4.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{14E61A41-8846-11D2-B7E4-0008C73ACA8F}\TypeLib\ = "{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41DBA1FA-44F6-4BD5-82DF-1A7FDEA0475D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10E321CC-683E-4060-B938-4F53234D9593}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{684130B2-2B8A-4E8D-BE71-8F4052882076}\ = "IMessages" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{952F0B99-50B6-44B3-AE0D-700D5B98B416}\ = "IAttachment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AED3A6B1-2171-11D2-B77C-0008C73ACA8F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53DECA78-C334-4235-9165-1FE7D8912A76}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DBAAEA4B-AD29-47BD-8776-C787D5BE28AA}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}\4.0\ = "JMail 4.0 library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{952F0B99-50B6-44B3-AE0D-700D5B98B416} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{821AAFE5-2F19-47EB-ACA9-3B4C1D64AC27}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E05AEA1E-BCB1-473A-8B2A-4829D9E1AD23}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{952F0B99-50B6-44B3-AE0D-700D5B98B416} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jmail.SpeedMailer\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A62C8BDB-D1FC-4FDD-A2A2-EEFF73262A41} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AED3A6B3-2171-11D2-B77C-0008C73ACA8F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dll\\jmail.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53DECA78-C334-4235-9165-1FE7D8912A76}\Version\ = "4.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{08B9999C-DAD2-4353-B25B-8CCAFFCA4D16}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{90D0A753-AD45-40FD-8C6E-555600EE5EB4}\ProgID regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1612 wrote to memory of 2344 1612 regsvr32.exe 28 PID 1612 wrote to memory of 2344 1612 regsvr32.exe 28 PID 1612 wrote to memory of 2344 1612 regsvr32.exe 28 PID 1612 wrote to memory of 2344 1612 regsvr32.exe 28 PID 1612 wrote to memory of 2344 1612 regsvr32.exe 28 PID 1612 wrote to memory of 2344 1612 regsvr32.exe 28 PID 1612 wrote to memory of 2344 1612 regsvr32.exe 28