c83f4c842477d38509ae96f737ff0d21e247ba39125e78c3c3c6c390a9f2fbe0

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tech\Parameters\ServiceDll = "C:\\Windows\\system32\\guqitd44.dll"	rundll32.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\paraudio\ImagePath = "system32\\drivers\\paraudio.sys"	kb20060926a.exe

Executes dropped EXE 4 IoCs

pid	Process
4624	rundllfromwin2000.exe
1760	rundllfromwin2000.exe
4516	RUNDLLFROMWIN2000.EXE
4740	kb20060926a.exe

Loads dropped DLL 5 IoCs

pid	Process
4624	rundllfromwin2000.exe
1760	rundllfromwin2000.exe
4516	RUNDLLFROMWIN2000.EXE
2668	rundll32.exe
1764	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Program Files (x86)\\Common Files\\System\\Update.exe"	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\advport.dll	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\guqitd44.dll	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\guqitd44.dll	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rundllfromwin2000.exe	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wbem\ocmor.dll	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\rxsoud65.dll	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	RUNDLLFROMWIN2000.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	RUNDLLFROMWIN2000.EXE
File opened for modification	C:\Windows\SysWOW64\ocmor.dll	RUNDLLFROMWIN2000.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	RUNDLLFROMWIN2000.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	RUNDLLFROMWIN2000.EXE
File created	C:\Windows\SysWOW64\wbem\ocmor.dll	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\SysWOW64\WBEM\ocmor.dll	RUNDLLFROMWIN2000.EXE
File opened for modification	C:\Windows\SysWOW64\advport.dll	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\kb20060926a.exe	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\rundllfromwin2000.exe	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wbem\rxsoud65.dll	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Score.txt	RUNDLLFROMWIN2000.EXE

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\coolsign\uninst.exe	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\coolsign\uninst.exe	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\Update.dat	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Update.dat	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\Update.exe	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Update.exe	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
File created	C:\Program Files (x86)\coolsign\coolsign.dll	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\coolsign\coolsign.dll	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{1D901067-2529-4A9B-9B6B-7A1DB3A44CB5}\Icon = "C:\\Program Files (x86)\\coolsign\\coolsign.dll,209"	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url5 = "http://www.3839.com/index.html"	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{1D901067-2529-4A9B-9B6B-7A1DB3A44CB5}\CLSID = "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}"	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{1D901067-2529-4A9B-9B6B-7A1DB3A44CB5}\Default Visible = "Yes"	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{1D901067-2529-4A9B-9B6B-7A1DB3A44CB5}\ButtonText = "¿á±ê"	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Internet Explorer\Main	kb20060926a.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Extensions\{1D901067-2529-4A9B-9B6B-7A1DB3A44CB5}	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{1D901067-2529-4A9B-9B6B-7A1DB3A44CB5}\ClsidExtension = "{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}"	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{1D901067-2529-4A9B-9B6B-7A1DB3A44CB5}\HotIcon = "C:\\Program Files (x86)\\coolsign\\coolsign.dll,207"	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.kzdh.com/"	kb20060926a.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	RUNDLLFROMWIN2000.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	RUNDLLFROMWIN2000.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	RUNDLLFROMWIN2000.EXE

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\TypeLib	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sss1.sss2.1\ = "QuickBtn"	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QuickButton.QuickBtn\CurVer	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\InprocServer32	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\InprocServer32\ = "C:\\Program Files (x86)\\coolsign\\coolsign.dll"	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\InprocServer32\ThreadingModel = "Apartment"	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\ = "QuickBtn"	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QuickButton.QuickBtn\CLSID	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QuickButton.QuickBtn\CurVer\ = "QuickButton.QuickBtn.1"	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\VersionIndependentProgID\ = "QuickButton.QuickBtn"	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\TypeLib\ = "{933DB9D6-9447-4EFE-ABA2-EAF3B309B44C}"	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QuickButton.QuickBtn\CLSID\ = "{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}"	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\Programmable	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sss1.sss2.1\CLSID\ = "{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}"	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QuickButton.QuickBtn	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QuickButton.QuickBtn\ = "QuickBtn"	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\ProgID	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\VersionIndependentProgID	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sss1.sss2.1	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sss1.sss2.1\CLSID	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\ProgID\ = "sss1.sss2.1"	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 4624	1764	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe	85
PID 1764 wrote to memory of 4624	1764	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe	85
PID 1764 wrote to memory of 4624	1764	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe	85
PID 1764 wrote to memory of 1760	1764	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe	86
PID 1764 wrote to memory of 1760	1764	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe	86
PID 1764 wrote to memory of 1760	1764	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe	86
PID 1764 wrote to memory of 2668	1764	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe	90
PID 1764 wrote to memory of 2668	1764	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe	90
PID 1764 wrote to memory of 2668	1764	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe	90
PID 1764 wrote to memory of 4740	1764	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe	96
PID 1764 wrote to memory of 4740	1764	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe	96
PID 1764 wrote to memory of 4740	1764	ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe	96

C:\Users\Admin\AppData\Local\Temp\ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ec2b20becef5e1f5f15b87bc9d88a4b8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\rundllfromwin2000.exe
  "C:\Windows\system32\rundllfromwin2000.exe" "C:\Windows\system32\wbem\rxsoud65.dll",Export @install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4624
- C:\Windows\SysWOW64\rundllfromwin2000.exe
  "C:\Windows\system32\rundllfromwin2000.exe" "C:\Windows\system32\wbem\rxsoud65.dll",Export @start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1760
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\guqitd44.dll",ExportFunc 1001
  2⤵
  - Sets DLL path for service in the registry
  - Loads dropped DLL
  PID:2668
- C:\Windows\SysWOW64\kb20060926a.exe
  C:\Windows\system32\kb20060926a.exe
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:4740

C:\WINDOWS\SysWOW64\RUNDLLFROMWIN2000.EXE
C:\WINDOWS\SysWOW64\RUNDLLFROMWIN2000.EXE C:\WINDOWS\SYSTEM32\WBEM\RXSOUD65.DLL,Export 1087
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

5