c4d5038d27d3ebf19646addd4841f00624bddab48da2f334adbf438b79e2149b

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

persistence privilege_escalation

Disable or Modify System Firewall

T1562.004

pid	Process
2808	NETSH.EXE
2664	NETSH.EXE

Enumerates connected drives 3 TTPs 20 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
File opened (read-only)	\??\Q:	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
File opened (read-only)	\??\P:	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
File opened (read-only)	\??\O:	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
File opened (read-only)	\??\N:	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
File opened (read-only)	\??\L:	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
File opened (read-only)	\??\W:	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
File opened (read-only)	\??\I:	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
File opened (read-only)	\??\H:	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
File opened (read-only)	\??\T:	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
File opened (read-only)	\??\V:	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
File opened (read-only)	\??\M:	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
File opened (read-only)	\??\K:	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
File opened (read-only)	\??\J:	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
File opened (read-only)	\??\Z:	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
File opened (read-only)	\??\X:	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
File opened (read-only)	\??\S:	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
File opened (read-only)	\??\R:	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
File opened (read-only)	\??\G:	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
File opened (read-only)	\??\Y:	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	NETSH.EXE
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	NETSH.EXE
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	NETSH.EXE
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	NETSH.EXE
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	NETSH.EXE
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	NETSH.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2868	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
2868	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
2868	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
Token: SeDebugPrivilege	2868	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
Token: SeBackupPrivilege	2868	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2868	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 436	2868	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe	5
PID 2868 wrote to memory of 436	2868	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe	5
PID 2868 wrote to memory of 436	2868	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe	5
PID 2868 wrote to memory of 436	2868	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe	5
PID 2868 wrote to memory of 2808	2868	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2808	2868	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2808	2868	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2808	2868	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2664	2868	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2664	2868	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2664	2868	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2664	2868	28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe	30

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Users\Admin\AppData\Local\Temp\28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe"
1⤵
- Modifies firewall policy service
- Enumerates connected drives
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\NETSH.EXE
  "C:\Windows\system32\NETSH.EXE" firewall add allowedprogram program = "C:\Users\Admin\AppData\Local\Temp\28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe" name = "LanSchool Student" mode = ENABLE scope = ALL profile = ALL
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2808
- C:\Windows\SysWOW64\NETSH.EXE
  "C:\Windows\system32\NETSH.EXE" firewall add allowedprogram program = "C:\Users\Admin\AppData\Local\Temp\28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118.exe" name = "LanSchool Student" mode = ENABLE scope = ALL profile = ALL
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery