94242abd9c111214a95958515e4f617ade8b3928baddfa69b7816173185fde9f

Modify Registry

Processes:

f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Windows Reg Services = "C:\\Windows\\system32\\ffservice.exe"	f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{a75aed00-d7bf-11d1-9947-00c0Cf98bbc9}	f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{a75aed00-d7bf-11d1-9947-00c0Cf98bbc9}\StubPath = "C:\\Windows\\system32\\lservice.exe"	f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Reg Services = "C:\\Windows\\system32\\ffservice.exe"	f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Reg Services = "C:\\Windows\\system32\\ffservice.exe"	f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe

description ioc process

File opened for modification \??\PhysicalDrive0 f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe

Drops file in System32 directory 6 IoCs

Processes:

f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\wservice.exe	f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wservice.exe	f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\lservice.exe	f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\lservice.exe	f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ffservice.exe	f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ffservice.exe	f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe

Modifies registry class 3 IoCs

Processes:

f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe

pid process

2080 f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe

pid	process
2080	f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f9ed12e9fd67c2bb6529310116ae8abb_JaffaCakes118.exe"
1⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2080

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Pre-OS Boot

T1542

Bootkit