701729262b268f9ad364f27b7ef3280287bb26b7e4387516cb52e60620a6fb50

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	432959d317a328f60449693bb2bec903_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	432959d317a328f60449693bb2bec903_JaffaCakes118.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

persistence privilege_escalation

Disable or Modify System Firewall

T1562.004

pid	Process
2204	netsh.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN	432959d317a328f60449693bb2bec903_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\OptionalComponents\MSFS	432959d317a328f60449693bb2bec903_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\OptionalComponents\MAPI	432959d317a328f60449693bb2bec903_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\OptionalComponents\IMAIL	432959d317a328f60449693bb2bec903_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\OptionalComponents	432959d317a328f60449693bb2bec903_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\PEAO.CSS	432959d317a328f60449693bb2bec903_JaffaCakes118.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 496 wrote to memory of 2204	496	432959d317a328f60449693bb2bec903_JaffaCakes118.exe	30
PID 496 wrote to memory of 2204	496	432959d317a328f60449693bb2bec903_JaffaCakes118.exe	30
PID 496 wrote to memory of 2204	496	432959d317a328f60449693bb2bec903_JaffaCakes118.exe	30
PID 496 wrote to memory of 2204	496	432959d317a328f60449693bb2bec903_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\432959d317a328f60449693bb2bec903_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\432959d317a328f60449693bb2bec903_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:496
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram C:\Users\Admin\AppData\Local\Temp\432959d317a328f60449693bb2bec903_JaffaCakes118.exe "Assitencia"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses