9388464615cd8b99a3025429ba1e96c74c818f5e967ffd2afc43c347c211ecb3

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\msqmx\ImagePath = "system32\\drivers\\msqmx.sys"	kb20060926a.exe

Executes dropped EXE 5 IoCs

pid	Process
3200	Program Files (x86)f2.exe
3972	rundllfromwin2000.exe
732	rundllfromwin2000.exe
3976	RUNDLLFROMWIN2000.EXE
4368	kb20060926a.exe

Loads dropped DLL 5 IoCs

pid	Process
3972	rundllfromwin2000.exe
732	rundllfromwin2000.exe
3976	RUNDLLFROMWIN2000.EXE
4704	rundll32.exe
4660	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Program Files (x86)\\Common Files\\System\\Update.exe"	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	RUNDLLFROMWIN2000.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	RUNDLLFROMWIN2000.EXE
File opened for modification	C:\Windows\SysWOW64\advport.dll	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\icxsnb47.dll	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\icxsnb47.dll	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\kb20060926a.exe	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\weadvz60.dll	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ocmor.dll	RUNDLLFROMWIN2000.EXE
File opened for modification	C:\WINDOWS\SysWOW64\WBEM\ocmor.dll	RUNDLLFROMWIN2000.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	RUNDLLFROMWIN2000.EXE
File created	C:\Windows\SysWOW64\advport.dll	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wbem\ocmor.dll	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wbem\weadvz60.dll	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\ocmor.dll	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Score.txt	RUNDLLFROMWIN2000.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	RUNDLLFROMWIN2000.EXE
File created	C:\Windows\SysWOW64\rundllfromwin2000.exe	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rundllfromwin2000.exe	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\System\Update.exe	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Update.exe	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
File created	C:\Program Files (x86)\coolsign\coolsign.dll	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\coolsign\coolsign.dll	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
File created	C:\Program Files (x86)\coolsign\uninst.exe	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\coolsign\uninst.exe	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\Update.dat	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Update.dat	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{1D901067-2529-4A9B-9B6B-7A1DB3A44CB5}\HotIcon = "C:\\Program Files (x86)\\coolsign\\coolsign.dll,207"	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main	kb20060926a.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Extensions\{1D901067-2529-4A9B-9B6B-7A1DB3A44CB5}	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{1D901067-2529-4A9B-9B6B-7A1DB3A44CB5}\CLSID = "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}"	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{1D901067-2529-4A9B-9B6B-7A1DB3A44CB5}\ClsidExtension = "{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}"	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url5 = "http://www.3839.com/index.html"	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{1D901067-2529-4A9B-9B6B-7A1DB3A44CB5}\Default Visible = "Yes"	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{1D901067-2529-4A9B-9B6B-7A1DB3A44CB5}\ButtonText = "¿á±ê"	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{1D901067-2529-4A9B-9B6B-7A1DB3A44CB5}\Icon = "C:\\Program Files (x86)\\coolsign\\coolsign.dll,209"	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.kzdh.com/"	kb20060926a.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	RUNDLLFROMWIN2000.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	RUNDLLFROMWIN2000.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	RUNDLLFROMWIN2000.EXE

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\InprocServer32	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sss1.sss2.1\CLSID\ = "{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}"	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QuickButton.QuickBtn\CurVer	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\InprocServer32\ThreadingModel = "Apartment"	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\ = "QuickBtn"	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\ProgID\ = "sss1.sss2.1"	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\ProgID	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\TypeLib	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sss1.sss2.1\CLSID	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\InprocServer32\ = "C:\\Program Files (x86)\\coolsign\\coolsign.dll"	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QuickButton.QuickBtn	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QuickButton.QuickBtn\CLSID	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\Programmable	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\TypeLib\ = "{933DB9D6-9447-4EFE-ABA2-EAF3B309B44C}"	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\VersionIndependentProgID	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}\VersionIndependentProgID\ = "QuickButton.QuickBtn"	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sss1.sss2.1\ = "QuickBtn"	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sss1.sss2.1	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QuickButton.QuickBtn\ = "QuickBtn"	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QuickButton.QuickBtn\CLSID\ = "{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}"	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QuickButton.QuickBtn\CurVer\ = "QuickButton.QuickBtn.1"	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 3200	4660	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe	83
PID 4660 wrote to memory of 3200	4660	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe	83
PID 4660 wrote to memory of 3200	4660	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe	83
PID 4660 wrote to memory of 3972	4660	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe	84
PID 4660 wrote to memory of 3972	4660	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe	84
PID 4660 wrote to memory of 3972	4660	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe	84
PID 4660 wrote to memory of 732	4660	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe	91
PID 4660 wrote to memory of 732	4660	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe	91
PID 4660 wrote to memory of 732	4660	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe	91
PID 4660 wrote to memory of 4704	4660	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe	95
PID 4660 wrote to memory of 4704	4660	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe	95
PID 4660 wrote to memory of 4704	4660	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe	95
PID 4660 wrote to memory of 4368	4660	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe	101
PID 4660 wrote to memory of 4368	4660	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe	101
PID 4660 wrote to memory of 4368	4660	08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe	101

C:\Users\Admin\AppData\Local\Temp\08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08c8f7e3cb8e150c9d3a96931918903a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Program Files (x86)f2.exe
  "C:\Program Files (x86)f2.exe"
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\SysWOW64\rundllfromwin2000.exe
  "C:\Windows\system32\rundllfromwin2000.exe" "C:\Windows\system32\wbem\weadvz60.dll",Export @install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3972
- C:\Windows\SysWOW64\rundllfromwin2000.exe
  "C:\Windows\system32\rundllfromwin2000.exe" "C:\Windows\system32\wbem\weadvz60.dll",Export @start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:732
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\icxsnb47.dll",ExportFunc 1001
  2⤵
  - Server Software Component: Terminal Services DLL
  - Loads dropped DLL
  PID:4704
- C:\Windows\SysWOW64\kb20060926a.exe
  C:\Windows\system32\kb20060926a.exe
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:4368

C:\WINDOWS\SysWOW64\RUNDLLFROMWIN2000.EXE
C:\WINDOWS\SysWOW64\RUNDLLFROMWIN2000.EXE C:\WINDOWS\SYSTEM32\WBEM\WEADVZ60.DLL,Export 1087
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

4