9e5ecfff411ab51682f4f355612147d06cdc7af9d8e097ffd412da5f829be3df

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\NetStatus.exe = "C:\\Users\\Admin\\AppData\\Roaming\\NetStatus.exe:*:Enabled:Windows Messanger"	reg.exe

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe

Windows security bypass 2 TTPs 1 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe

Windows security modification 2 TTPs 1 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\{NetStatus.exe} = "C:\\Users\\Admin\\AppData\\Roaming\\NetStatus.exe"	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2052 set thread context of 2828	2052	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	29

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

pid	Process
2800	reg.exe
2952	reg.exe
2088	reg.exe
2920	reg.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: 1	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeCreateTokenPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeAssignPrimaryTokenPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeMachineAccountPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeTcbPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeSecurityPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeCreatePermanentPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeBackupPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeRestorePrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeShutdownPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeDebugPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeAuditPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeUndockPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeSyncAgentPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeEnableDelegationPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: 31	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: 32	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: 33	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: 34	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
Token: 35	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2052	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2828	2052	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	29
PID 2052 wrote to memory of 2828	2052	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	29
PID 2052 wrote to memory of 2828	2052	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	29
PID 2052 wrote to memory of 2828	2052	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	29
PID 2052 wrote to memory of 2828	2052	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	29
PID 2052 wrote to memory of 2828	2052	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	29
PID 2052 wrote to memory of 2828	2052	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	29
PID 2052 wrote to memory of 2828	2052	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	29
PID 2052 wrote to memory of 2828	2052	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	29
PID 2052 wrote to memory of 2828	2052	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	29
PID 2828 wrote to memory of 2164	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	30
PID 2828 wrote to memory of 2164	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	30
PID 2828 wrote to memory of 2164	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	30
PID 2828 wrote to memory of 2164	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	30
PID 2828 wrote to memory of 2748	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	31
PID 2828 wrote to memory of 2748	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	31
PID 2828 wrote to memory of 2748	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	31
PID 2828 wrote to memory of 2748	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	31
PID 2828 wrote to memory of 2744	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	33
PID 2828 wrote to memory of 2744	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	33
PID 2828 wrote to memory of 2744	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	33
PID 2828 wrote to memory of 2744	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	33
PID 2828 wrote to memory of 2896	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	35
PID 2828 wrote to memory of 2896	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	35
PID 2828 wrote to memory of 2896	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	35
PID 2828 wrote to memory of 2896	2828	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe	35
PID 2164 wrote to memory of 2952	2164	cmd.exe	39
PID 2164 wrote to memory of 2952	2164	cmd.exe	39
PID 2164 wrote to memory of 2952	2164	cmd.exe	39
PID 2164 wrote to memory of 2952	2164	cmd.exe	39
PID 2744 wrote to memory of 2088	2744	cmd.exe	38
PID 2744 wrote to memory of 2088	2744	cmd.exe	38
PID 2744 wrote to memory of 2088	2744	cmd.exe	38
PID 2744 wrote to memory of 2088	2744	cmd.exe	38
PID 2748 wrote to memory of 2800	2748	cmd.exe	40
PID 2748 wrote to memory of 2800	2748	cmd.exe	40
PID 2748 wrote to memory of 2800	2748	cmd.exe	40
PID 2748 wrote to memory of 2800	2748	cmd.exe	40
PID 2896 wrote to memory of 2920	2896	cmd.exe	41
PID 2896 wrote to memory of 2920	2896	cmd.exe	41
PID 2896 wrote to memory of 2920	2896	cmd.exe	41
PID 2896 wrote to memory of 2920	2896	cmd.exe	41

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe"
1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2052
- C:\Users\Admin\AppData\Local\Temp\ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2952
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2800
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2088
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\NetStatus.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\NetStatus.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\NetStatus.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\NetStatus.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry