darkcomet | 1a722652518e589be34613b12d419efee2235ff0b0a37556fbb9cda5eb27b1d2

Processes:

PCS.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	PCS.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

msdcsc.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Executes dropped EXE 2 IoCs

Processes:

msdcsc.exemsdcsc.exe

pid process

2212 msdcsc.exe
488 msdcsc.exe
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

PCS.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation PCS.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	msdcsc.exe

pid	process
2212	msdcsc.exe
488	msdcsc.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	PCS.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

PCS.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microdapt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	PCS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microdapt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

PCS.exemsdcsc.exe

description pid process target process

PID 992 set thread context of 2952 992 PCS.exe PCS.exe
PID 2212 set thread context of 488 2212 msdcsc.exe msdcsc.exe

description	pid	process	target process
PID 992 set thread context of 2952	992	PCS.exe	PCS.exe
PID 2212 set thread context of 488	2212	msdcsc.exe	msdcsc.exe

autoit_exe 3 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

PCS.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance PCS.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	PCS.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

PCS.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2952	PCS.exe
Token: SeSecurityPrivilege	2952	PCS.exe
Token: SeTakeOwnershipPrivilege	2952	PCS.exe
Token: SeLoadDriverPrivilege	2952	PCS.exe
Token: SeSystemProfilePrivilege	2952	PCS.exe
Token: SeSystemtimePrivilege	2952	PCS.exe
Token: SeProfSingleProcessPrivilege	2952	PCS.exe
Token: SeIncBasePriorityPrivilege	2952	PCS.exe
Token: SeCreatePagefilePrivilege	2952	PCS.exe
Token: SeBackupPrivilege	2952	PCS.exe
Token: SeRestorePrivilege	2952	PCS.exe
Token: SeShutdownPrivilege	2952	PCS.exe
Token: SeDebugPrivilege	2952	PCS.exe
Token: SeSystemEnvironmentPrivilege	2952	PCS.exe
Token: SeChangeNotifyPrivilege	2952	PCS.exe
Token: SeRemoteShutdownPrivilege	2952	PCS.exe
Token: SeUndockPrivilege	2952	PCS.exe
Token: SeManageVolumePrivilege	2952	PCS.exe
Token: SeImpersonatePrivilege	2952	PCS.exe
Token: SeCreateGlobalPrivilege	2952	PCS.exe
Token: 33	2952	PCS.exe
Token: 34	2952	PCS.exe
Token: 35	2952	PCS.exe
Token: 36	2952	PCS.exe
Token: SeIncreaseQuotaPrivilege	488	msdcsc.exe
Token: SeSecurityPrivilege	488	msdcsc.exe
Token: SeTakeOwnershipPrivilege	488	msdcsc.exe
Token: SeLoadDriverPrivilege	488	msdcsc.exe
Token: SeSystemProfilePrivilege	488	msdcsc.exe
Token: SeSystemtimePrivilege	488	msdcsc.exe
Token: SeProfSingleProcessPrivilege	488	msdcsc.exe
Token: SeIncBasePriorityPrivilege	488	msdcsc.exe
Token: SeCreatePagefilePrivilege	488	msdcsc.exe
Token: SeBackupPrivilege	488	msdcsc.exe
Token: SeRestorePrivilege	488	msdcsc.exe
Token: SeShutdownPrivilege	488	msdcsc.exe
Token: SeDebugPrivilege	488	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	488	msdcsc.exe
Token: SeChangeNotifyPrivilege	488	msdcsc.exe
Token: SeRemoteShutdownPrivilege	488	msdcsc.exe
Token: SeUndockPrivilege	488	msdcsc.exe
Token: SeManageVolumePrivilege	488	msdcsc.exe
Token: SeImpersonatePrivilege	488	msdcsc.exe
Token: SeCreateGlobalPrivilege	488	msdcsc.exe
Token: 33	488	msdcsc.exe
Token: 34	488	msdcsc.exe
Token: 35	488	msdcsc.exe
Token: 36	488	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

488 msdcsc.exe

pid	process
488	msdcsc.exe

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

PCS.exePCS.execmd.execmd.exemsdcsc.exemsdcsc.exe

description	pid	process	target process
PID 992 wrote to memory of 2952	992	PCS.exe	PCS.exe
PID 992 wrote to memory of 2952	992	PCS.exe	PCS.exe
PID 992 wrote to memory of 2952	992	PCS.exe	PCS.exe
PID 992 wrote to memory of 2952	992	PCS.exe	PCS.exe
PID 992 wrote to memory of 2952	992	PCS.exe	PCS.exe
PID 2952 wrote to memory of 3692	2952	PCS.exe	cmd.exe
PID 2952 wrote to memory of 3692	2952	PCS.exe	cmd.exe
PID 2952 wrote to memory of 3692	2952	PCS.exe	cmd.exe
PID 2952 wrote to memory of 496	2952	PCS.exe	cmd.exe
PID 2952 wrote to memory of 496	2952	PCS.exe	cmd.exe
PID 2952 wrote to memory of 496	2952	PCS.exe	cmd.exe
PID 496 wrote to memory of 2100	496	cmd.exe	attrib.exe
PID 496 wrote to memory of 2100	496	cmd.exe	attrib.exe
PID 3692 wrote to memory of 2108	3692	cmd.exe	attrib.exe
PID 496 wrote to memory of 2100	496	cmd.exe	attrib.exe
PID 3692 wrote to memory of 2108	3692	cmd.exe	attrib.exe
PID 3692 wrote to memory of 2108	3692	cmd.exe	attrib.exe
PID 2952 wrote to memory of 2212	2952	PCS.exe	msdcsc.exe
PID 2952 wrote to memory of 2212	2952	PCS.exe	msdcsc.exe
PID 2952 wrote to memory of 2212	2952	PCS.exe	msdcsc.exe
PID 2212 wrote to memory of 488	2212	msdcsc.exe	msdcsc.exe
PID 2212 wrote to memory of 488	2212	msdcsc.exe	msdcsc.exe
PID 2212 wrote to memory of 488	2212	msdcsc.exe	msdcsc.exe
PID 2212 wrote to memory of 488	2212	msdcsc.exe	msdcsc.exe
PID 2212 wrote to memory of 488	2212	msdcsc.exe	msdcsc.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe
PID 488 wrote to memory of 2800	488	msdcsc.exe	notepad.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

2108 attrib.exe
2100 attrib.exe

pid	process
2108	attrib.exe
2100	attrib.exe

C:\Users\Admin\AppData\Local\Temp\PCS.exe
"C:\Users\Admin\AppData\Local\Temp\PCS.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:992

C:\Users\Admin\AppData\Local\Temp\PCS.exe
"C:\Users\Admin\AppData\Local\Temp\PCS.exe"
2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\PCS.exe" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:3692

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\PCS.exe" +s +h
4⤵
- Views/modifies file attributes
PID:2108

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:496

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
4⤵
- Views/modifies file attributes
PID:2100

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2212

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"
4⤵
- Modifies security service
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:488

C:\Windows\SysWOW64\notepad.exe
notepad
5⤵
PID:2800

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Modify Existing Service

T1031

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

5

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

System Information Discovery