darkcomet | 629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\system32\\isass.exe"	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	isass.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1"	isass.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	isass.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	isass.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	isass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	isass.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
4876	isass.exe
3708	isass.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3600-141-0x0000000000400000-0x00000000004F7000-memory.dmp	upx
behavioral2/memory/3600-142-0x0000000000400000-0x00000000004F7000-memory.dmp	upx
behavioral2/memory/3600-143-0x0000000000400000-0x00000000004F7000-memory.dmp	upx
behavioral2/memory/3600-144-0x0000000000400000-0x00000000004F7000-memory.dmp	upx
behavioral2/memory/3600-150-0x0000000000400000-0x00000000004F7000-memory.dmp	upx
behavioral2/memory/3708-161-0x0000000000400000-0x00000000004F7000-memory.dmp	upx
behavioral2/memory/3708-162-0x0000000000400000-0x00000000004F7000-memory.dmp	upx
behavioral2/memory/3708-163-0x0000000000400000-0x00000000004F7000-memory.dmp	upx
behavioral2/memory/3708-164-0x0000000000400000-0x00000000004F7000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	isass.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	isass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	isass.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\isass = "C:\\system32\\isass.exe"	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	isass.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1792 set thread context of 3600	1792	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe	80
PID 4876 set thread context of 3708	4876	isass.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4916	1792	WerFault.exe	79
4476	4876	WerFault.exe	84
4556	1792	WerFault.exe	79
64	4876	WerFault.exe	84

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	isass.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	isass.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	isass.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	isass.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	isass.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3708	isass.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: SeSecurityPrivilege	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: SeTakeOwnershipPrivilege	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: SeLoadDriverPrivilege	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: SeSystemProfilePrivilege	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: SeSystemtimePrivilege	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: SeProfSingleProcessPrivilege	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: SeIncBasePriorityPrivilege	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: SeCreatePagefilePrivilege	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: SeBackupPrivilege	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: SeRestorePrivilege	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: SeShutdownPrivilege	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: SeDebugPrivilege	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: SeSystemEnvironmentPrivilege	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: SeChangeNotifyPrivilege	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: SeRemoteShutdownPrivilege	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: SeUndockPrivilege	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: SeManageVolumePrivilege	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: SeImpersonatePrivilege	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: SeCreateGlobalPrivilege	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: 33	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: 34	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: 35	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: 36	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
Token: SeIncreaseQuotaPrivilege	3708	isass.exe
Token: SeSecurityPrivilege	3708	isass.exe
Token: SeTakeOwnershipPrivilege	3708	isass.exe
Token: SeLoadDriverPrivilege	3708	isass.exe
Token: SeSystemProfilePrivilege	3708	isass.exe
Token: SeSystemtimePrivilege	3708	isass.exe
Token: SeProfSingleProcessPrivilege	3708	isass.exe
Token: SeIncBasePriorityPrivilege	3708	isass.exe
Token: SeCreatePagefilePrivilege	3708	isass.exe
Token: SeBackupPrivilege	3708	isass.exe
Token: SeRestorePrivilege	3708	isass.exe
Token: SeShutdownPrivilege	3708	isass.exe
Token: SeDebugPrivilege	3708	isass.exe
Token: SeSystemEnvironmentPrivilege	3708	isass.exe
Token: SeChangeNotifyPrivilege	3708	isass.exe
Token: SeRemoteShutdownPrivilege	3708	isass.exe
Token: SeUndockPrivilege	3708	isass.exe
Token: SeManageVolumePrivilege	3708	isass.exe
Token: SeImpersonatePrivilege	3708	isass.exe
Token: SeCreateGlobalPrivilege	3708	isass.exe
Token: 33	3708	isass.exe
Token: 34	3708	isass.exe
Token: 35	3708	isass.exe
Token: 36	3708	isass.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1792	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
1792	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
4876	isass.exe
4876	isass.exe
3708	isass.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 3600	1792	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe	80
PID 1792 wrote to memory of 3600	1792	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe	80
PID 1792 wrote to memory of 3600	1792	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe	80
PID 1792 wrote to memory of 3600	1792	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe	80
PID 1792 wrote to memory of 3600	1792	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe	80
PID 1792 wrote to memory of 3600	1792	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe	80
PID 1792 wrote to memory of 3600	1792	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe	80
PID 1792 wrote to memory of 3600	1792	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe	80
PID 3600 wrote to memory of 4876	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe	84
PID 3600 wrote to memory of 4876	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe	84
PID 3600 wrote to memory of 4876	3600	629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe	84
PID 4876 wrote to memory of 3708	4876	isass.exe	85
PID 4876 wrote to memory of 3708	4876	isass.exe	85
PID 4876 wrote to memory of 3708	4876	isass.exe	85
PID 4876 wrote to memory of 3708	4876	isass.exe	85
PID 4876 wrote to memory of 3708	4876	isass.exe	85
PID 4876 wrote to memory of 3708	4876	isass.exe	85
PID 4876 wrote to memory of 3708	4876	isass.exe	85
PID 4876 wrote to memory of 3708	4876	isass.exe	85

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	isass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	isass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	isass.exe

C:\Users\Admin\AppData\Local\Temp\629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
"C:\Users\Admin\AppData\Local\Temp\629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Users\Admin\AppData\Local\Temp\629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
  C:\Users\Admin\AppData\Local\Temp\629dc4304f9c36caf5cae2c23bba026298f40de00e87a2f3116488f642cac4bc.exe
  2⤵
  - Modifies WinLogon for persistence
  - Checks BIOS information in registry
  - Checks computer location settings
  - Adds Run key to start application
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\system32\isass.exe
    "C:\system32\isass.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\system32\isass.exe
      C:\system32\isass.exe
      4⤵
      Modifies firewall policy service
      Modifies security service
      Windows security bypass
      Executes dropped EXE
      Checks BIOS information in registry
      Windows security modification
      Adds Run key to start application
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:3708
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 600
      4⤵
      Program crash
      PID:4476
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 600
      4⤵
      Program crash
      PID:64
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 596
  2⤵
  - Program crash
  PID:4916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 596
  2⤵
  - Program crash
  PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1792 -ip 1792
1⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4876 -ip 4876
1⤵
PID:3296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1792 -ip 1792
1⤵
PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4876 -ip 4876
1⤵
PID:1828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery