56f6e9a95a3b943428df241b7ff5b6c54ecf4b92c4eb1cf52a8cf4f7bcfc59fd

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Windows Reg Services = "C:\\Windows\\system32\\ffservice.exe"	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{a75aed00-d7bf-11d1-9947-00c0Cf98bbc9}	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{a75aed00-d7bf-11d1-9947-00c0Cf98bbc9}\StubPath = "C:\\Windows\\system32\\lservice.exe"	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Reg Services = "C:\\Windows\\system32\\ffservice.exe"	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Reg Services = "C:\\Windows\\system32\\ffservice.exe"	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ffservice.exe	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wservice.exe	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wservice.exe	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\lservice.exe	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\lservice.exe	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ffservice.exe	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\NotInsertable	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Ole1Class	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Ole1Class\ = "MSPowerPoint"	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ProgID	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ProgID\ = "MSPowerPoint"	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\AutoConvertTo	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\AutoConvertTo\ = "{64818D10-4F9B-11CF-86EA-00AA00B929E8}"	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2412	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2412	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2412	8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8df0ee48e5aefc9da3ad8b0b1a5de8db_JaffaCakes118.exe"
1⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Checks BIOS information in registry
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

2

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

2

Defense Evasion

Modify Registry

3

Credential Access

Discovery

Query Registry

T1012

System Information Discovery