46a8154f10cee5ed12613adee278ae790a10b359191ce045e94d0d8191f1389d

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	H46e00dG50o69X.exe

Windows security bypass 2 TTPs 4 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\H46e00dG50o69X.exe = "0"	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Documents\AhdRyd002Xk0002\svchost.exe = "0"	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe = "0"	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4832	powershell.exe
4292	powershell.exe
4200	powershell.exe
2316	powershell.exe
4772	powershell.exe
2840	powershell.exe
468	powershell.exe
4884	powershell.exe
1788	powershell.exe
2140	powershell.exe
1692	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	H46e00dG50o69X.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\H46e00dG50o69X.exe	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\H46e00dG50o69X.exe	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
3516	H46e00dG50o69X.exe
1640	H46e00dG50o69X.exe

Windows security modification 2 TTPs 5 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe = "0"	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\H46e00dG50o69X.exe = "0"	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Documents\AhdRyd002Xk0002\svchost.exe = "0"	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\H46e00dG50o69X = "C:\\Users\\Public\\Documents\\AhdRyd002Xk0002\\svchost.exe"	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\H46e00dG50o69X = "C:\\Users\\Public\\Documents\\AhdRyd002Xk0002\\svchost.exe"	H46e00dG50o69X.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	H46e00dG50o69X.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	H46e00dG50o69X.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	H46e00dG50o69X.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
4772	powershell.exe
1788	powershell.exe
2140	powershell.exe
2840	powershell.exe
4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe
4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe
468	powershell.exe
468	powershell.exe
4772	powershell.exe
4772	powershell.exe
4292	powershell.exe
4292	powershell.exe
1788	powershell.exe
1788	powershell.exe
4832	powershell.exe
4832	powershell.exe
3516	H46e00dG50o69X.exe
3516	H46e00dG50o69X.exe
4200	powershell.exe
4200	powershell.exe
2840	powershell.exe
2840	powershell.exe
2140	powershell.exe
2140	powershell.exe
468	powershell.exe
1692	powershell.exe
1692	powershell.exe
2316	powershell.exe
2316	powershell.exe
4292	powershell.exe
4884	powershell.exe
4884	powershell.exe
4832	powershell.exe
4200	powershell.exe
1692	powershell.exe
2316	powershell.exe
4884	powershell.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeDebugPrivilege	4772	powershell.exe
Token: SeDebugPrivilege	2840	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe
Token: SeDebugPrivilege	468	powershell.exe
Token: SeDebugPrivilege	4292	powershell.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeDebugPrivilege	4200	powershell.exe
Token: SeDebugPrivilege	3516	H46e00dG50o69X.exe
Token: SeDebugPrivilege	1692	powershell.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	4884	powershell.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 1788	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	85
PID 4940 wrote to memory of 1788	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	85
PID 4940 wrote to memory of 1788	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	85
PID 4940 wrote to memory of 4772	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	87
PID 4940 wrote to memory of 4772	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	87
PID 4940 wrote to memory of 4772	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	87
PID 4940 wrote to memory of 2840	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	89
PID 4940 wrote to memory of 2840	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	89
PID 4940 wrote to memory of 2840	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	89
PID 4940 wrote to memory of 2140	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	91
PID 4940 wrote to memory of 2140	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	91
PID 4940 wrote to memory of 2140	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	91
PID 4940 wrote to memory of 3516	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	93
PID 4940 wrote to memory of 3516	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	93
PID 4940 wrote to memory of 3516	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	93
PID 4940 wrote to memory of 468	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	94
PID 4940 wrote to memory of 468	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	94
PID 4940 wrote to memory of 468	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	94
PID 4940 wrote to memory of 4832	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	96
PID 4940 wrote to memory of 4832	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	96
PID 4940 wrote to memory of 4832	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	96
PID 4940 wrote to memory of 4292	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	98
PID 4940 wrote to memory of 4292	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	98
PID 4940 wrote to memory of 4292	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	98
PID 3516 wrote to memory of 4200	3516	H46e00dG50o69X.exe	100
PID 3516 wrote to memory of 4200	3516	H46e00dG50o69X.exe	100
PID 3516 wrote to memory of 4200	3516	H46e00dG50o69X.exe	100
PID 4940 wrote to memory of 3064	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	102
PID 4940 wrote to memory of 3064	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	102
PID 4940 wrote to memory of 3064	4940	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe	102
PID 3516 wrote to memory of 1692	3516	H46e00dG50o69X.exe	103
PID 3516 wrote to memory of 1692	3516	H46e00dG50o69X.exe	103
PID 3516 wrote to memory of 1692	3516	H46e00dG50o69X.exe	103
PID 3516 wrote to memory of 2316	3516	H46e00dG50o69X.exe	105
PID 3516 wrote to memory of 2316	3516	H46e00dG50o69X.exe	105
PID 3516 wrote to memory of 2316	3516	H46e00dG50o69X.exe	105
PID 3516 wrote to memory of 4884	3516	H46e00dG50o69X.exe	107
PID 3516 wrote to memory of 4884	3516	H46e00dG50o69X.exe	107
PID 3516 wrote to memory of 4884	3516	H46e00dG50o69X.exe	107
PID 3516 wrote to memory of 1640	3516	H46e00dG50o69X.exe	109
PID 3516 wrote to memory of 1640	3516	H46e00dG50o69X.exe	109
PID 3516 wrote to memory of 1640	3516	H46e00dG50o69X.exe	109

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	H46e00dG50o69X.exe

C:\Users\Admin\AppData\Local\Temp\ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe"
1⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4940
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe" -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1788
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\H46e00dG50o69X.exe" -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4772
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\H46e00dG50o69X.exe" -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe" -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2140
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\H46e00dG50o69X.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\H46e00dG50o69X.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3516
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\H46e00dG50o69X.exe" -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4200
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\AhdRyd002Xk0002\svchost.exe" -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1692
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\H46e00dG50o69X.exe" -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2316
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\AhdRyd002Xk0002\svchost.exe" -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4884
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\H46e00dG50o69X.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\H46e00dG50o69X.exe"
    3⤵
    - Executes dropped EXE
    PID:1640
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\AhdRyd002Xk0002\svchost.exe" -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:468
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe" -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4832
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\AhdRyd002Xk0002\svchost.exe" -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4292
- C:\Users\Admin\AppData\Local\Temp\ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118.exe"
  2⤵
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry