Overview
overview
7Static
static
7IER.exe
windows7-x64
7IER.exe
windows10-2004-x64
7//...ll.exe
windows7-x64
//...ll.exe
windows10-2004-x64
/AdMon.dll
windows7-x64
/AdMon.dll
windows10-2004-x64
/IERbar.htm
windows7-x64
/IERbar.htm
windows10-2004-x64
/IE....exe
windows7-x64
/IE....exe
windows10-2004-x64
/LiveU...on.dll
windows7-x64
/LiveU...on.dll
windows10-2004-x64
/config.dll
windows7-x64
/config.dll
windows10-2004-x64
/gr18.exe
windows7-x64
/gr18.exe
windows10-2004-x64
/login.htm
windows7-x64
/login.htm
windows10-2004-x64
/...rl.url
windows7-x64
/...rl.url
windows10-2004-x64
/...Ӱ.url
windows7-x64
/...Ӱ.url
windows10-2004-x64
/Insta...ns.dll
windows7-x64
/Insta...ns.dll
windows10-2004-x64
$_4741_/IERBar.dll
windows7-x64
6$_4741_/IERBar.dll
windows10-2004-x64
6$_4741_/flash9h.dll
windows7-x64
6$_4741_/flash9h.dll
windows10-2004-x64
6新云软件.url
windows7-x64
1新云软件.url
windows10-2004-x64
1Analysis
-
max time kernel
139s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 22:08
Behavioral task
behavioral1
Sample
IER.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
IER.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
//uninstall.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
//uninstall.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
/AdMon.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
/AdMon.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
/IERbar.htm
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
/IERbar.htm
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
/IEר.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
/IEר.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
/LiveUpdate/AdMon.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
/LiveUpdate/AdMon.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
/config.dll
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
/config.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
/gr18.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
/gr18.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
/login.htm
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
/login.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
/ɽ$(LSTR_6014)url.url
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
/ɽ$(LSTR_6014)url.url
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
/»ȵӰ.url
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
/»ȵӰ.url
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
/InstallOptions.dll
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
/InstallOptions.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
$_4741_/IERBar.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$_4741_/IERBar.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral27
Sample
$_4741_/flash9h.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
$_4741_/flash9h.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
新云软件.url
Resource
win7-20240220-en
Behavioral task
behavioral30
Sample
新云软件.url
Resource
win10v2004-20240412-en
General
-
Target
$_4741_/IERBar.dll
-
Size
213KB
-
MD5
9e166c73aa9816c4b6ac49229955e29a
-
SHA1
d3df2afe4eed9ad0d2a3d2693158bf3d8595f5da
-
SHA256
9ef8b102c57316cadba77864bbe183e084b7346a6f994c8a32c519247f21dd12
-
SHA512
78b440da36b73830cbfa9988dba99836a65d48eff8ba4e203f5de563d3afe7a613546291ec91e83c3ac44700c9317eef7fcdfb41811a07c912c80e0609c25214
-
SSDEEP
6144:077lHwhDMaw7RPBYmDzH0AIj6lIyWkLPkBvcEtdaY:0/RKX2P+mDzH0noIbkLt9Y
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB} regsvr32.exe -
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{123249EB-F891-44C4-946F-450064F9080E} = "IEÐÞ¸´×¨¼Ò" regsvr32.exe -
Modifies registry class 22 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IERBar.AdSwpr\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{123249EB-F891-44C4-946F-450064F9080E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{123249EB-F891-44C4-946F-450064F9080E}\ = "&IEÐÞ¸´×¨¼Ò" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{123249EB-F891-44C4-946F-450064F9080E}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{123249EB-F891-44C4-946F-450064F9080E}\Implemented Categories\{00021492-0000-0000-C000-000000000046} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{123249EB-F891-44C4-946F-450064F9080E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$_4741_\\IERBar.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$_4741_\\IERBar.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IERBar.AdSwpr\Clsid\ = "{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{123249EB-F891-44C4-946F-450064F9080E}\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IERBar.AdSwpr regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IERBar.AdSwpr\ = "AdSwpr" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}\ProgID\ = "IERBar.AdSwpr" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{123249EB-F891-44C4-946F-450064F9080E}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{123249EB-F891-44C4-946F-450064F9080E}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}\ = "AdSwpr" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{123249EB-F891-44C4-946F-450064F9080E}\Implemented Categories regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 4376 wrote to memory of 3352 4376 regsvr32.exe regsvr32.exe PID 4376 wrote to memory of 3352 4376 regsvr32.exe regsvr32.exe PID 4376 wrote to memory of 3352 4376 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\$_4741_\IERBar.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\$_4741_\IERBar.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class