Overview
overview
6Static
static
39553绿色...��.htm
windows7-x64
39553绿色...��.htm
windows10-2004-x64
3setup_iesuper.exe
windows7-x64
3setup_iesuper.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3MicroBlog.exe
windows7-x64
3MicroBlog.exe
windows10-2004-x64
3iesuper.dll
windows7-x64
6iesuper.dll
windows10-2004-x64
6template.htm
windows7-x64
3template.htm
windows10-2004-x64
3淘宝特�...��.url
windows7-x64
1淘宝特�...��.url
windows10-2004-x64
1Analysis
-
max time kernel
139s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/10/2024, 23:25
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
9553绿色软件站.htm
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
9553绿色软件站.htm
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
setup_iesuper.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
setup_iesuper.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
MicroBlog.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
MicroBlog.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
iesuper.dll
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
iesuper.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral11
Sample
template.htm
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
template.htm
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral13
Sample
淘宝特价打折区.url
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
淘宝特价打折区.url
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
iesuper.dll
-
Size
335KB
-
MD5
b304bb557fd6e915668df2e3c78317a2
-
SHA1
43fa4b9c2546a4c0785b93bc3db97a28915893fc
-
SHA256
7247854b9d379d7a779a065f2b08806606f6e5cfa6abd3b040cc1f5ee8a7e91b
-
SHA512
8fff1a734617b5df8f754f97aa7fe2c2720112d150d29a4ee2e540f185153e8385c358968468654f4774c28af648b21ca25cf6477044e76f2142a23dc7ef22a2
-
SSDEEP
6144:ooVvrBgUR4SE0sDhbe6DlrM/dABCcHOY91jvtpGow6cZIbJ:oQZE04e2rMYuYHjfbJ
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC2}\ = "IESuper" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC2}\NoExplorer = "1" regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\SearchScopes\baidu regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\baidu\URL = "http://www.baidu.com/baidu?word={searchTerms}&tn=wmkillsoft_dg" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\baidu\DisplayName = "baidu" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\baidu\Codepage = "936" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "baidu" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "1" regsvr32.exe -
Modifies registry class 51 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41A5-9080-0F41D1A3AEC2} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IESuper.Obj.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IESuper.Obj.1\CLSID\ = "{1A49F431-2A2E-41a5-9080-0F41D1A3AEC2}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IESuperHelper.Obj regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC1}\ProgID\ = "IESuperHelper.Obj.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC1}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC1}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC2}\TypeLib\ = "{15BDF1BD-B1E5-4816-A17E-35F5A2554289}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IESuperHelper.Obj\ = "IESuperHelper" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IESuper.Obj.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IESuper.Obj regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IESuper.Obj\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC2}\ProgID\ = "IESuper.Obj.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC2}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iesuper.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IESuperHelper.Obj\CurVer\ = "IESuperHelper.Obj.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC1} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC1}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC1}\TypeLib\ = "{15BDF1BD-B1E5-4816-A17E-35F5A2554288}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41A5-9080-0F41D1A3AEC2}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC2}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41A5-9080-0F41D1A3AEC2}\ = "IESuper" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41A5-9080-0F41D1A3AEC2}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41A5-9080-0F41D1A3AEC2}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IESuper.Obj.1\ = "IESuper" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IESuper.Obj\ = "IESuper" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IESuper.Obj\CurVer\ = "IESuper.Obj.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC2}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IESuperHelper.Obj.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IESuperHelper.Obj\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC1}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC1}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41A5-9080-0F41D1A3AEC2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iesuper.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC2}\VersionIndependentProgID\ = "IESuper.Obj" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC2}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IESuperHelper.Obj.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC1}\ = "IESuperHelper" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IESuper.Obj\CLSID\ = "{1A49F431-2A2E-41a5-9080-0F41D1A3AEC2}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IESuper.Obj\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC1}\VersionIndependentProgID\ = "IESuperHelper.Obj" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41A5-9080-0F41D1A3AEC2} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC2}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IESuperHelper.Obj.1\ = "IESuperHelper" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IESuperHelper.Obj\CLSID\ = "{1A49F431-2A2E-41a5-9080-0F41D1A3AEC1}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IESuperHelper.Obj\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC2}\ = "IESuper" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC2}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IESuperHelper.Obj.1\CLSID\ = "{1A49F431-2A2E-41a5-9080-0F41D1A3AEC1}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC1}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A49F431-2A2E-41a5-9080-0F41D1A3AEC1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iesuper.dll" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4760 wrote to memory of 3256 4760 regsvr32.exe 84 PID 4760 wrote to memory of 3256 4760 regsvr32.exe 84 PID 4760 wrote to memory of 3256 4760 regsvr32.exe 84
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\iesuper.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\iesuper.dll2⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:3256
-