darkcomet | 95969e3e0c1793e6177d5c5d20c9a667c9f28bb64907ad489682c41668efc29d

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	A1DB2JVWGG.CNT.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	msdcsc.exe

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Disables Task Manager via registry modification
evasion

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

pid	Process
1864	attrib.exe
3532	attrib.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	A1DB2JVWGG.CNT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	A1DB2JVWGG.CNT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	msdcsc.exe

Executes dropped EXE 4 IoCs

pid	Process
4408	JUNE STUB.EXE
3248	msdcsc.exe
4884	msdcsc.exe
2024	JUNE STUB.EXE

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	A1DB2JVWGG.CNT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Host = "C:\\Program Files (x86)\\DPI Host\\dpihost.exe"	JUNE STUB.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	JUNE STUB.EXE

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5068 set thread context of 4180	5068	A1DB2JVWGG.CNT.exe	97
PID 3248 set thread context of 4884	3248	msdcsc.exe	113

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DPI Host\dpihost.exe	JUNE STUB.EXE
File opened for modification	C:\Program Files (x86)\DPI Host\dpihost.exe	JUNE STUB.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
4764	schtasks.exe
2332	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	A1DB2JVWGG.CNT.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5068	A1DB2JVWGG.CNT.exe
5068	A1DB2JVWGG.CNT.exe
5068	A1DB2JVWGG.CNT.exe
5068	A1DB2JVWGG.CNT.exe
5068	A1DB2JVWGG.CNT.exe
5068	A1DB2JVWGG.CNT.exe
5068	A1DB2JVWGG.CNT.exe
5068	A1DB2JVWGG.CNT.exe
5068	A1DB2JVWGG.CNT.exe
4344	powershell.exe
1344	powershell.exe
1344	powershell.exe
5068	A1DB2JVWGG.CNT.exe
4344	powershell.exe
4408	JUNE STUB.EXE
4408	JUNE STUB.EXE
4408	JUNE STUB.EXE
4408	JUNE STUB.EXE
4408	JUNE STUB.EXE
4408	JUNE STUB.EXE
3248	msdcsc.exe
3248	msdcsc.exe
3248	msdcsc.exe
3248	msdcsc.exe
3248	msdcsc.exe
3248	msdcsc.exe
3248	msdcsc.exe
3248	msdcsc.exe
336	powershell.exe
1324	powershell.exe
3248	msdcsc.exe
3248	msdcsc.exe
336	powershell.exe
1324	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4408	JUNE STUB.EXE

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeDebugPrivilege	5068	A1DB2JVWGG.CNT.exe
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeIncreaseQuotaPrivilege	4180	A1DB2JVWGG.CNT.exe
Token: SeSecurityPrivilege	4180	A1DB2JVWGG.CNT.exe
Token: SeTakeOwnershipPrivilege	4180	A1DB2JVWGG.CNT.exe
Token: SeLoadDriverPrivilege	4180	A1DB2JVWGG.CNT.exe
Token: SeSystemProfilePrivilege	4180	A1DB2JVWGG.CNT.exe
Token: SeSystemtimePrivilege	4180	A1DB2JVWGG.CNT.exe
Token: SeProfSingleProcessPrivilege	4180	A1DB2JVWGG.CNT.exe
Token: SeIncBasePriorityPrivilege	4180	A1DB2JVWGG.CNT.exe
Token: SeCreatePagefilePrivilege	4180	A1DB2JVWGG.CNT.exe
Token: SeBackupPrivilege	4180	A1DB2JVWGG.CNT.exe
Token: SeRestorePrivilege	4180	A1DB2JVWGG.CNT.exe
Token: SeShutdownPrivilege	4180	A1DB2JVWGG.CNT.exe
Token: SeDebugPrivilege	4180	A1DB2JVWGG.CNT.exe
Token: SeSystemEnvironmentPrivilege	4180	A1DB2JVWGG.CNT.exe
Token: SeChangeNotifyPrivilege	4180	A1DB2JVWGG.CNT.exe
Token: SeRemoteShutdownPrivilege	4180	A1DB2JVWGG.CNT.exe
Token: SeUndockPrivilege	4180	A1DB2JVWGG.CNT.exe
Token: SeManageVolumePrivilege	4180	A1DB2JVWGG.CNT.exe
Token: SeImpersonatePrivilege	4180	A1DB2JVWGG.CNT.exe
Token: SeCreateGlobalPrivilege	4180	A1DB2JVWGG.CNT.exe
Token: 33	4180	A1DB2JVWGG.CNT.exe
Token: 34	4180	A1DB2JVWGG.CNT.exe
Token: 35	4180	A1DB2JVWGG.CNT.exe
Token: 36	4180	A1DB2JVWGG.CNT.exe
Token: SeDebugPrivilege	4408	JUNE STUB.EXE
Token: SeDebugPrivilege	3248	msdcsc.exe
Token: SeDebugPrivilege	336	powershell.exe
Token: SeDebugPrivilege	1324	powershell.exe
Token: SeIncreaseQuotaPrivilege	4884	msdcsc.exe
Token: SeSecurityPrivilege	4884	msdcsc.exe
Token: SeTakeOwnershipPrivilege	4884	msdcsc.exe
Token: SeLoadDriverPrivilege	4884	msdcsc.exe
Token: SeSystemProfilePrivilege	4884	msdcsc.exe
Token: SeSystemtimePrivilege	4884	msdcsc.exe
Token: SeProfSingleProcessPrivilege	4884	msdcsc.exe
Token: SeIncBasePriorityPrivilege	4884	msdcsc.exe
Token: SeCreatePagefilePrivilege	4884	msdcsc.exe
Token: SeBackupPrivilege	4884	msdcsc.exe
Token: SeRestorePrivilege	4884	msdcsc.exe
Token: SeShutdownPrivilege	4884	msdcsc.exe
Token: SeDebugPrivilege	4884	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	4884	msdcsc.exe
Token: SeChangeNotifyPrivilege	4884	msdcsc.exe
Token: SeRemoteShutdownPrivilege	4884	msdcsc.exe
Token: SeUndockPrivilege	4884	msdcsc.exe
Token: SeManageVolumePrivilege	4884	msdcsc.exe
Token: SeImpersonatePrivilege	4884	msdcsc.exe
Token: SeCreateGlobalPrivilege	4884	msdcsc.exe
Token: 33	4884	msdcsc.exe
Token: 34	4884	msdcsc.exe
Token: 35	4884	msdcsc.exe
Token: 36	4884	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4884	msdcsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 4344	5068	A1DB2JVWGG.CNT.exe	91
PID 5068 wrote to memory of 4344	5068	A1DB2JVWGG.CNT.exe	91
PID 5068 wrote to memory of 4344	5068	A1DB2JVWGG.CNT.exe	91
PID 5068 wrote to memory of 1344	5068	A1DB2JVWGG.CNT.exe	93
PID 5068 wrote to memory of 1344	5068	A1DB2JVWGG.CNT.exe	93
PID 5068 wrote to memory of 1344	5068	A1DB2JVWGG.CNT.exe	93
PID 5068 wrote to memory of 4764	5068	A1DB2JVWGG.CNT.exe	95
PID 5068 wrote to memory of 4764	5068	A1DB2JVWGG.CNT.exe	95
PID 5068 wrote to memory of 4764	5068	A1DB2JVWGG.CNT.exe	95
PID 5068 wrote to memory of 4180	5068	A1DB2JVWGG.CNT.exe	97
PID 5068 wrote to memory of 4180	5068	A1DB2JVWGG.CNT.exe	97
PID 5068 wrote to memory of 4180	5068	A1DB2JVWGG.CNT.exe	97
PID 5068 wrote to memory of 4180	5068	A1DB2JVWGG.CNT.exe	97
PID 5068 wrote to memory of 4180	5068	A1DB2JVWGG.CNT.exe	97
PID 5068 wrote to memory of 4180	5068	A1DB2JVWGG.CNT.exe	97
PID 5068 wrote to memory of 4180	5068	A1DB2JVWGG.CNT.exe	97
PID 5068 wrote to memory of 4180	5068	A1DB2JVWGG.CNT.exe	97
PID 5068 wrote to memory of 4180	5068	A1DB2JVWGG.CNT.exe	97
PID 5068 wrote to memory of 4180	5068	A1DB2JVWGG.CNT.exe	97
PID 5068 wrote to memory of 4180	5068	A1DB2JVWGG.CNT.exe	97
PID 5068 wrote to memory of 4180	5068	A1DB2JVWGG.CNT.exe	97
PID 4180 wrote to memory of 2340	4180	A1DB2JVWGG.CNT.exe	98
PID 4180 wrote to memory of 2340	4180	A1DB2JVWGG.CNT.exe	98
PID 4180 wrote to memory of 2340	4180	A1DB2JVWGG.CNT.exe	98
PID 4180 wrote to memory of 4412	4180	A1DB2JVWGG.CNT.exe	100
PID 4180 wrote to memory of 4412	4180	A1DB2JVWGG.CNT.exe	100
PID 4180 wrote to memory of 4412	4180	A1DB2JVWGG.CNT.exe	100
PID 4180 wrote to memory of 4408	4180	A1DB2JVWGG.CNT.exe	102
PID 4180 wrote to memory of 4408	4180	A1DB2JVWGG.CNT.exe	102
PID 4180 wrote to memory of 4408	4180	A1DB2JVWGG.CNT.exe	102
PID 4412 wrote to memory of 1864	4412	cmd.exe	103
PID 4412 wrote to memory of 1864	4412	cmd.exe	103
PID 4412 wrote to memory of 1864	4412	cmd.exe	103
PID 2340 wrote to memory of 3532	2340	cmd.exe	104
PID 2340 wrote to memory of 3532	2340	cmd.exe	104
PID 2340 wrote to memory of 3532	2340	cmd.exe	104
PID 4180 wrote to memory of 1592	4180	A1DB2JVWGG.CNT.exe	105
PID 4180 wrote to memory of 1592	4180	A1DB2JVWGG.CNT.exe	105
PID 4180 wrote to memory of 1592	4180	A1DB2JVWGG.CNT.exe	105
PID 4180 wrote to memory of 1592	4180	A1DB2JVWGG.CNT.exe	105
PID 4180 wrote to memory of 1592	4180	A1DB2JVWGG.CNT.exe	105
PID 4180 wrote to memory of 1592	4180	A1DB2JVWGG.CNT.exe	105
PID 4180 wrote to memory of 1592	4180	A1DB2JVWGG.CNT.exe	105
PID 4180 wrote to memory of 1592	4180	A1DB2JVWGG.CNT.exe	105
PID 4180 wrote to memory of 1592	4180	A1DB2JVWGG.CNT.exe	105
PID 4180 wrote to memory of 1592	4180	A1DB2JVWGG.CNT.exe	105
PID 4180 wrote to memory of 1592	4180	A1DB2JVWGG.CNT.exe	105
PID 4180 wrote to memory of 1592	4180	A1DB2JVWGG.CNT.exe	105
PID 4180 wrote to memory of 1592	4180	A1DB2JVWGG.CNT.exe	105
PID 4180 wrote to memory of 1592	4180	A1DB2JVWGG.CNT.exe	105
PID 4180 wrote to memory of 1592	4180	A1DB2JVWGG.CNT.exe	105
PID 4180 wrote to memory of 1592	4180	A1DB2JVWGG.CNT.exe	105
PID 4180 wrote to memory of 1592	4180	A1DB2JVWGG.CNT.exe	105
PID 4180 wrote to memory of 3248	4180	A1DB2JVWGG.CNT.exe	106
PID 4180 wrote to memory of 3248	4180	A1DB2JVWGG.CNT.exe	106
PID 4180 wrote to memory of 3248	4180	A1DB2JVWGG.CNT.exe	106
PID 3248 wrote to memory of 1324	3248	msdcsc.exe	107
PID 3248 wrote to memory of 1324	3248	msdcsc.exe	107
PID 3248 wrote to memory of 1324	3248	msdcsc.exe	107
PID 3248 wrote to memory of 336	3248	msdcsc.exe	109
PID 3248 wrote to memory of 336	3248	msdcsc.exe	109
PID 3248 wrote to memory of 336	3248	msdcsc.exe	109
PID 3248 wrote to memory of 2332	3248	msdcsc.exe	111
PID 3248 wrote to memory of 2332	3248	msdcsc.exe	111

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

pid	Process
1864	attrib.exe
3532	attrib.exe

C:\Users\Admin\AppData\Local\Temp\A1DB2JVWGG.CNT.exe
"C:\Users\Admin\AppData\Local\Temp\A1DB2JVWGG.CNT.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\A1DB2JVWGG.CNT.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4344
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JXayEzy.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1344
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JXayEzy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp61A8.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4764
- C:\Users\Admin\AppData\Local\Temp\A1DB2JVWGG.CNT.exe
  "C:\Users\Admin\AppData\Local\Temp\A1DB2JVWGG.CNT.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\A1DB2JVWGG.CNT.exe" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp\A1DB2JVWGG.CNT.exe" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:3532
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1864
- - C:\Users\Admin\AppData\Local\Temp\JUNE STUB.EXE
    "C:\Users\Admin\AppData\Local\Temp\JUNE STUB.EXE"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:1592
- - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1324
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JXayEzy.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:336
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JXayEzy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4764.tmp"
      4⤵
      Creates scheduled task(s)
      PID:2332
  - - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
      4⤵
      Modifies security service
      Windows security bypass
      Checks computer location settings
      Executes dropped EXE
      Windows security modification
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\JUNE STUB.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\JUNE STUB.EXE"
        5⤵
        Executes dropped EXE
        
        PID:2024
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        
        PID:3416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Hidden Files and Directories

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

Modify Registry