b6854965fab46c51a0350a8d9fb21f0797f872ae3e96198829306373d594dd71

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\License\Parameters\ServiceDll = "C:\\Windows\\system32\\kubtz.dll"	rundll32.exe

Executes dropped EXE 3 IoCs

pid	Process
3852	rundll2kxp.exe
3344	rundll2kxp.exe
4084	RUNDLL2KXP.EXE

Loads dropped DLL 4 IoCs

pid	Process
3852	rundll2kxp.exe
3344	rundll2kxp.exe
4084	RUNDLL2KXP.EXE
2064	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Program Files (x86)\\Common Files\\system\\Updaterun.exe"	0f5069dff53423ea4e5f591a4fe819ed.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll2kxp.exe	0f5069dff53423ea4e5f591a4fe819ed.exe
File opened for modification	C:\Windows\SysWOW64\rundll2kxp.exe	0f5069dff53423ea4e5f591a4fe819ed.exe
File created	C:\Windows\SysWOW64\wbem\jedik.dll	0f5069dff53423ea4e5f591a4fe819ed.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	RUNDLL2KXP.EXE
File opened for modification	C:\Windows\SysWOW64\advport.dll	0f5069dff53423ea4e5f591a4fe819ed.exe
File opened for modification	C:\Windows\SysWOW64\wbem\jedik.dll	0f5069dff53423ea4e5f591a4fe819ed.exe
File opened for modification	C:\Windows\SysWOW64\ocmor.dll	RUNDLL2KXP.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	RUNDLL2KXP.EXE
File created	C:\Windows\SysWOW64\advport.dll	0f5069dff53423ea4e5f591a4fe819ed.exe
File opened for modification	C:\Windows\SysWOW64\kubtz.dll	0f5069dff53423ea4e5f591a4fe819ed.exe
File created	C:\Windows\SysWOW64\wbem\ocmor.dll	0f5069dff53423ea4e5f591a4fe819ed.exe
File opened for modification	C:\Windows\SysWOW64\wbem\ocmor.dll	0f5069dff53423ea4e5f591a4fe819ed.exe
File opened for modification	C:\WINDOWS\SysWOW64\WBEM\ocmor.dll	RUNDLL2KXP.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	RUNDLL2KXP.EXE
File created	C:\Windows\SysWOW64\kubtz.dll	0f5069dff53423ea4e5f591a4fe819ed.exe
File created	C:\Windows\SysWOW64\Score.txt	RUNDLL2KXP.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	RUNDLL2KXP.EXE

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\system\Updaterun.exe	0f5069dff53423ea4e5f591a4fe819ed.exe
File opened for modification	C:\Program Files (x86)\Common Files\system\Updaterun.exe	0f5069dff53423ea4e5f591a4fe819ed.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url5 = "http://www.3839.com/index.html"	0f5069dff53423ea4e5f591a4fe819ed.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	RUNDLL2KXP.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	RUNDLL2KXP.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	RUNDLL2KXP.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 3852	5100	0f5069dff53423ea4e5f591a4fe819ed.exe	91
PID 5100 wrote to memory of 3852	5100	0f5069dff53423ea4e5f591a4fe819ed.exe	91
PID 5100 wrote to memory of 3852	5100	0f5069dff53423ea4e5f591a4fe819ed.exe	91
PID 5100 wrote to memory of 3344	5100	0f5069dff53423ea4e5f591a4fe819ed.exe	97
PID 5100 wrote to memory of 3344	5100	0f5069dff53423ea4e5f591a4fe819ed.exe	97
PID 5100 wrote to memory of 3344	5100	0f5069dff53423ea4e5f591a4fe819ed.exe	97
PID 5100 wrote to memory of 2064	5100	0f5069dff53423ea4e5f591a4fe819ed.exe	99
PID 5100 wrote to memory of 2064	5100	0f5069dff53423ea4e5f591a4fe819ed.exe	99
PID 5100 wrote to memory of 2064	5100	0f5069dff53423ea4e5f591a4fe819ed.exe	99

C:\Users\Admin\AppData\Local\Temp\0f5069dff53423ea4e5f591a4fe819ed.exe
"C:\Users\Admin\AppData\Local\Temp\0f5069dff53423ea4e5f591a4fe819ed.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\rundll2kxp.exe
  "C:\Windows\system32\rundll2kxp.exe" "C:\Windows\system32\wbem\jedik.dll",Export @install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3852
- C:\Windows\SysWOW64\rundll2kxp.exe
  "C:\Windows\system32\rundll2kxp.exe" "C:\Windows\system32\wbem\jedik.dll",Export @start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3344
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\kubtz.dll",ExportFunc 1001
  2⤵
  - Sets DLL path for service in the registry
  - Loads dropped DLL
  PID:2064

C:\WINDOWS\SysWOW64\RUNDLL2KXP.EXE
C:\WINDOWS\SysWOW64\RUNDLL2KXP.EXE C:\WINDOWS\SYSTEM32\WBEM\JEDIK.DLL,Export 1087
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

3