darkcomet | 846d82f6f9d6b965ef683cd91724d72917263cf21e9f0f7e4ed2cb4f1ceacce8

Processes:

darknj.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe"	darknj.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

msdcsc.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 4 IoCs

Processes:

darknj.exeR-Launcher.exeNJ.EXEmsdcsc.exe

pid process

2524 darknj.exe
2660 R-Launcher.exe
200 NJ.EXE
3312 msdcsc.exe
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

darknj.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation darknj.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	msdcsc.exe

pid	process
2524	darknj.exe
2660	R-Launcher.exe
200	NJ.EXE
3312	msdcsc.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	darknj.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

darknj.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe"	darknj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2576 3248 WerFault.exe javaw.exe
Modifies registry class 1 IoCs

Processes:

darknj.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance darknj.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

1296 vlc.exe

pid	pid_target	process	target process
2576	3248	WerFault.exe	javaw.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	darknj.exe

pid	process
1296	vlc.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

WerFault.exe

pid	process
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

vlc.exemsdcsc.exe

pid process

1296 vlc.exe
3312 msdcsc.exe

pid	process
1296	vlc.exe
3312	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

darknj.exeWerFault.exemsdcsc.exeNJ.EXE

description	pid	process
Token: SeIncreaseQuotaPrivilege	2524	darknj.exe
Token: SeSecurityPrivilege	2524	darknj.exe
Token: SeTakeOwnershipPrivilege	2524	darknj.exe
Token: SeLoadDriverPrivilege	2524	darknj.exe
Token: SeSystemProfilePrivilege	2524	darknj.exe
Token: SeSystemtimePrivilege	2524	darknj.exe
Token: SeProfSingleProcessPrivilege	2524	darknj.exe
Token: SeIncBasePriorityPrivilege	2524	darknj.exe
Token: SeCreatePagefilePrivilege	2524	darknj.exe
Token: SeBackupPrivilege	2524	darknj.exe
Token: SeRestorePrivilege	2524	darknj.exe
Token: SeShutdownPrivilege	2524	darknj.exe
Token: SeDebugPrivilege	2524	darknj.exe
Token: SeSystemEnvironmentPrivilege	2524	darknj.exe
Token: SeChangeNotifyPrivilege	2524	darknj.exe
Token: SeRemoteShutdownPrivilege	2524	darknj.exe
Token: SeUndockPrivilege	2524	darknj.exe
Token: SeManageVolumePrivilege	2524	darknj.exe
Token: SeImpersonatePrivilege	2524	darknj.exe
Token: SeCreateGlobalPrivilege	2524	darknj.exe
Token: 33	2524	darknj.exe
Token: 34	2524	darknj.exe
Token: 35	2524	darknj.exe
Token: 36	2524	darknj.exe
Token: SeDebugPrivilege	2576	WerFault.exe
Token: SeIncreaseQuotaPrivilege	3312	msdcsc.exe
Token: SeSecurityPrivilege	3312	msdcsc.exe
Token: SeTakeOwnershipPrivilege	3312	msdcsc.exe
Token: SeLoadDriverPrivilege	3312	msdcsc.exe
Token: SeSystemProfilePrivilege	3312	msdcsc.exe
Token: SeSystemtimePrivilege	3312	msdcsc.exe
Token: SeProfSingleProcessPrivilege	3312	msdcsc.exe
Token: SeIncBasePriorityPrivilege	3312	msdcsc.exe
Token: SeCreatePagefilePrivilege	3312	msdcsc.exe
Token: SeBackupPrivilege	3312	msdcsc.exe
Token: SeRestorePrivilege	3312	msdcsc.exe
Token: SeShutdownPrivilege	3312	msdcsc.exe
Token: SeDebugPrivilege	3312	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	3312	msdcsc.exe
Token: SeChangeNotifyPrivilege	3312	msdcsc.exe
Token: SeRemoteShutdownPrivilege	3312	msdcsc.exe
Token: SeUndockPrivilege	3312	msdcsc.exe
Token: SeManageVolumePrivilege	3312	msdcsc.exe
Token: SeImpersonatePrivilege	3312	msdcsc.exe
Token: SeCreateGlobalPrivilege	3312	msdcsc.exe
Token: 33	3312	msdcsc.exe
Token: 34	3312	msdcsc.exe
Token: 35	3312	msdcsc.exe
Token: 36	3312	msdcsc.exe
Token: SeDebugPrivilege	200	NJ.EXE
Token: 33	200	NJ.EXE
Token: SeIncBasePriorityPrivilege	200	NJ.EXE
Token: 33	200	NJ.EXE
Token: SeIncBasePriorityPrivilege	200	NJ.EXE
Token: 33	200	NJ.EXE
Token: SeIncBasePriorityPrivilege	200	NJ.EXE
Token: 33	200	NJ.EXE
Token: SeIncBasePriorityPrivilege	200	NJ.EXE
Token: 33	200	NJ.EXE
Token: SeIncBasePriorityPrivilege	200	NJ.EXE
Token: 33	200	NJ.EXE
Token: SeIncBasePriorityPrivilege	200	NJ.EXE
Token: 33	200	NJ.EXE
Token: SeIncBasePriorityPrivilege	200	NJ.EXE

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

vlc.exe

pid process

1296 vlc.exe
1296 vlc.exe
1296 vlc.exe
1296 vlc.exe
1296 vlc.exe
1296 vlc.exe
1296 vlc.exe
1296 vlc.exe
Suspicious use of SendNotifyMessage 7 IoCs

Processes:

vlc.exe

pid process

1296 vlc.exe
1296 vlc.exe
1296 vlc.exe
1296 vlc.exe
1296 vlc.exe
1296 vlc.exe
1296 vlc.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

msdcsc.exevlc.exe

pid process

3312 msdcsc.exe
1296 vlc.exe

pid	process
1296	vlc.exe
1296	vlc.exe
1296	vlc.exe
1296	vlc.exe
1296	vlc.exe
1296	vlc.exe
1296	vlc.exe
1296	vlc.exe

pid	process
1296	vlc.exe
1296	vlc.exe
1296	vlc.exe
1296	vlc.exe
1296	vlc.exe
1296	vlc.exe
1296	vlc.exe

pid	process
3312	msdcsc.exe
1296	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

F-Launcher.exeR-Launcher.exedarknj.execmd.execmd.exemsdcsc.exe

description	pid	process	target process
PID 3492 wrote to memory of 2524	3492	F-Launcher.exe	darknj.exe
PID 3492 wrote to memory of 2524	3492	F-Launcher.exe	darknj.exe
PID 3492 wrote to memory of 2524	3492	F-Launcher.exe	darknj.exe
PID 3492 wrote to memory of 2660	3492	F-Launcher.exe	R-Launcher.exe
PID 3492 wrote to memory of 2660	3492	F-Launcher.exe	R-Launcher.exe
PID 3492 wrote to memory of 2660	3492	F-Launcher.exe	R-Launcher.exe
PID 2660 wrote to memory of 3248	2660	R-Launcher.exe	javaw.exe
PID 2660 wrote to memory of 3248	2660	R-Launcher.exe	javaw.exe
PID 2524 wrote to memory of 3224	2524	darknj.exe	cmd.exe
PID 2524 wrote to memory of 3224	2524	darknj.exe	cmd.exe
PID 2524 wrote to memory of 3224	2524	darknj.exe	cmd.exe
PID 2524 wrote to memory of 3464	2524	darknj.exe	cmd.exe
PID 2524 wrote to memory of 3464	2524	darknj.exe	cmd.exe
PID 2524 wrote to memory of 3464	2524	darknj.exe	cmd.exe
PID 2524 wrote to memory of 200	2524	darknj.exe	NJ.EXE
PID 2524 wrote to memory of 200	2524	darknj.exe	NJ.EXE
PID 2524 wrote to memory of 200	2524	darknj.exe	NJ.EXE
PID 3464 wrote to memory of 2836	3464	cmd.exe	attrib.exe
PID 3464 wrote to memory of 2836	3464	cmd.exe	attrib.exe
PID 3464 wrote to memory of 2836	3464	cmd.exe	attrib.exe
PID 3224 wrote to memory of 2988	3224	cmd.exe	attrib.exe
PID 3224 wrote to memory of 2988	3224	cmd.exe	attrib.exe
PID 3224 wrote to memory of 2988	3224	cmd.exe	attrib.exe
PID 2524 wrote to memory of 3612	2524	darknj.exe	notepad.exe
PID 2524 wrote to memory of 3612	2524	darknj.exe	notepad.exe
PID 2524 wrote to memory of 3612	2524	darknj.exe	notepad.exe
PID 2524 wrote to memory of 3612	2524	darknj.exe	notepad.exe
PID 2524 wrote to memory of 3612	2524	darknj.exe	notepad.exe
PID 2524 wrote to memory of 3612	2524	darknj.exe	notepad.exe
PID 2524 wrote to memory of 3612	2524	darknj.exe	notepad.exe
PID 2524 wrote to memory of 3612	2524	darknj.exe	notepad.exe
PID 2524 wrote to memory of 3612	2524	darknj.exe	notepad.exe
PID 2524 wrote to memory of 3612	2524	darknj.exe	notepad.exe
PID 2524 wrote to memory of 3612	2524	darknj.exe	notepad.exe
PID 2524 wrote to memory of 3612	2524	darknj.exe	notepad.exe
PID 2524 wrote to memory of 3612	2524	darknj.exe	notepad.exe
PID 2524 wrote to memory of 3612	2524	darknj.exe	notepad.exe
PID 2524 wrote to memory of 3612	2524	darknj.exe	notepad.exe
PID 2524 wrote to memory of 3612	2524	darknj.exe	notepad.exe
PID 2524 wrote to memory of 3612	2524	darknj.exe	notepad.exe
PID 2524 wrote to memory of 3312	2524	darknj.exe	msdcsc.exe
PID 2524 wrote to memory of 3312	2524	darknj.exe	msdcsc.exe
PID 2524 wrote to memory of 3312	2524	darknj.exe	msdcsc.exe
PID 3312 wrote to memory of 1308	3312	msdcsc.exe	notepad.exe
PID 3312 wrote to memory of 1308	3312	msdcsc.exe	notepad.exe
PID 3312 wrote to memory of 1308	3312	msdcsc.exe	notepad.exe
PID 3312 wrote to memory of 1308	3312	msdcsc.exe	notepad.exe
PID 3312 wrote to memory of 1308	3312	msdcsc.exe	notepad.exe
PID 3312 wrote to memory of 1308	3312	msdcsc.exe	notepad.exe
PID 3312 wrote to memory of 1308	3312	msdcsc.exe	notepad.exe
PID 3312 wrote to memory of 1308	3312	msdcsc.exe	notepad.exe
PID 3312 wrote to memory of 1308	3312	msdcsc.exe	notepad.exe
PID 3312 wrote to memory of 1308	3312	msdcsc.exe	notepad.exe
PID 3312 wrote to memory of 1308	3312	msdcsc.exe	notepad.exe
PID 3312 wrote to memory of 1308	3312	msdcsc.exe	notepad.exe
PID 3312 wrote to memory of 1308	3312	msdcsc.exe	notepad.exe
PID 3312 wrote to memory of 1308	3312	msdcsc.exe	notepad.exe
PID 3312 wrote to memory of 1308	3312	msdcsc.exe	notepad.exe
PID 3312 wrote to memory of 1308	3312	msdcsc.exe	notepad.exe
PID 3312 wrote to memory of 1308	3312	msdcsc.exe	notepad.exe
PID 3312 wrote to memory of 1308	3312	msdcsc.exe	notepad.exe
PID 3312 wrote to memory of 1308	3312	msdcsc.exe	notepad.exe
PID 3312 wrote to memory of 1308	3312	msdcsc.exe	notepad.exe
PID 3312 wrote to memory of 1308	3312	msdcsc.exe	notepad.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

Processes:

msdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	msdcsc.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

2836 attrib.exe
2988 attrib.exe

pid	process
2836	attrib.exe
2988	attrib.exe

C:\Users\Admin\AppData\Local\Temp\F-Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\F-Launcher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3492

C:\Users\Admin\AppData\Local\Temp\darknj.exe
"C:\Users\Admin\AppData\Local\Temp\darknj.exe"
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\darknj.exe" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:3224

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\darknj.exe" +s +h
4⤵
- Views/modifies file attributes
PID:2988

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:3464

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
4⤵
- Views/modifies file attributes
PID:2836

C:\Users\Admin\AppData\Local\Temp\NJ.EXE
"C:\Users\Admin\AppData\Local\Temp\NJ.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:200

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:3612

C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"
3⤵
- Modifies security service
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3312

C:\Windows\SysWOW64\notepad.exe
notepad
4⤵
PID:1308

C:\Users\Admin\AppData\Local\Temp\R-Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\R-Launcher.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\R-Launcher.exe"
3⤵
PID:3248

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3248 -s 360
4⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\DenyUndo.mpe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1296

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Modify Existing Service

T1031

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

6

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

System Information Discovery