Overview
overview
10Static
static
7IESecurity.dll
windows7-x64
6IESecurity.dll
windows10-2004-x64
6ProcMon.dll
windows7-x64
1ProcMon.dll
windows10-2004-x64
1SpySheriff.exe
windows7-x64
8SpySheriff.exe
windows10-2004-x64
7Uninstall.exe
windows7-x64
1Uninstall.exe
windows10-2004-x64
1heur000.dll
windows7-x64
1heur000.dll
windows10-2004-x64
1heur001.dll
windows7-x64
1heur001.dll
windows10-2004-x64
1heur002.dll
windows7-x64
4heur002.dll
windows10-2004-x64
4heur003.dll
windows7-x64
10heur003.dll
windows10-2004-x64
10Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 20:23
Behavioral task
behavioral1
Sample
IESecurity.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
IESecurity.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
ProcMon.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
ProcMon.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
SpySheriff.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
SpySheriff.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
Uninstall.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
Uninstall.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
heur000.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
heur000.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
heur001.dll
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
heur001.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
heur002.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
heur002.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
heur003.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
heur003.dll
Resource
win10v2004-20240508-en
General
-
Target
IESecurity.dll
-
Size
41KB
-
MD5
04ea7f07722c9c03cf932876a841183a
-
SHA1
cfb77d3970be7037dcdd887e862d7bbbf4855640
-
SHA256
f407f96d71d6fa7597ce85abb9ba4bdd95d02fe7f2ef46f0c343a4a0d6115c0d
-
SHA512
bc70b4a7fc5cf8a6edc01a53e8a0c216ea3c7c81daa6020b35326dfe2db28d1851b7d558e023af2295aa58ab10285ba016aea9fe950f9bbc3a3722f3ae5beea9
-
SSDEEP
768:VgTrL1xJddyW9QtPW1pVHkmTHzHtCo9vQDbUGTO:VS/JGUQtPWhEmTHzHAo1QDbUGTO
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B85BB239-F685-4547-B0AC-E8835CD8ED24} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\ = "OneSecurity" regsvr32.exe -
Modifies registry class 46 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4EEAFD15-6A8A-4957-8932-259100D9C18B}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\ = "IGopher" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OneSecurity.IESecurity.1\CLSID\ = "{B85BB239-F685-4547-B0AC-E8835CD8ED24}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OneSecurity.IESecurity\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4EEAFD15-6A8A-4957-8932-259100D9C18B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\TypeLib\ = "{4EEAFD15-6A8A-4957-8932-259100D9C18B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OneSecurity.IESecurity.1\ = "One Security IE Security Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OneSecurity.IESecurity\CLSID\ = "{B85BB239-F685-4547-B0AC-E8835CD8ED24}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\VersionIndependentProgID\ = "OneSecurity.IESecurity" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4EEAFD15-6A8A-4957-8932-259100D9C18B}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OneSecurity.IESecurity.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\ = "One Security IE Security Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\TypeLib\ = "{4EEAFD15-6A8A-4957-8932-259100D9C18B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4EEAFD15-6A8A-4957-8932-259100D9C18B}\1.0\ = "SpywareNo IE Security 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4EEAFD15-6A8A-4957-8932-259100D9C18B}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4EEAFD15-6A8A-4957-8932-259100D9C18B}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OneSecurity.IESecurity.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OneSecurity.IESecurity regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\TypeLib\ = "{4EEAFD15-6A8A-4957-8932-259100D9C18B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IESecurity.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OneSecurity.IESecurity\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\ = "IGopher" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4EEAFD15-6A8A-4957-8932-259100D9C18B}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4EEAFD15-6A8A-4957-8932-259100D9C18B}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IESecurity.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OneSecurity.IESecurity\CurVer\ = "OneSecurity.IESecurity.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4EEAFD15-6A8A-4957-8932-259100D9C18B}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4EEAFD15-6A8A-4957-8932-259100D9C18B}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OneSecurity.IESecurity\ = "One Security IE Security Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\ProgID\ = "OneSecurity.IESecurity.1" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2788 wrote to memory of 2792 2788 regsvr32.exe regsvr32.exe PID 2788 wrote to memory of 2792 2788 regsvr32.exe regsvr32.exe PID 2788 wrote to memory of 2792 2788 regsvr32.exe regsvr32.exe PID 2788 wrote to memory of 2792 2788 regsvr32.exe regsvr32.exe PID 2788 wrote to memory of 2792 2788 regsvr32.exe regsvr32.exe PID 2788 wrote to memory of 2792 2788 regsvr32.exe regsvr32.exe PID 2788 wrote to memory of 2792 2788 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\IESecurity.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\IESecurity.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2792-0-0x0000000010000000-0x0000000010207000-memory.dmpFilesize
2.0MB