darkcomet | b8a4e5e12ca3a804bd75173045265038dc5bba2ad908a3f00a07fd76aa21e9ed

Processes:

Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

Windows Service

T1543.003

Processes:

msdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	msdcsc.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

msdcsc.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	msdcsc.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe

Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

3944 attrib.exe
4124 attrib.exe
Executes dropped EXE 2 IoCs

Processes:

DAVUTHITTER V2.987.EXEmsdcsc.exe

pid process

4352 DAVUTHITTER V2.987.EXE
3852 msdcsc.exe

pid	process
3944	attrib.exe
4124	attrib.exe

pid	process
4352	DAVUTHITTER V2.987.EXE
3852	msdcsc.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Drops file in System32 directory 3 IoCs

Processes:

Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe

description	ioc	process
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msdcsc.exe

pid process

3852 msdcsc.exe

pid	process
3852	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exeDAVUTHITTER V2.987.EXEmsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeSecurityPrivilege	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeTakeOwnershipPrivilege	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeLoadDriverPrivilege	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeSystemProfilePrivilege	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeSystemtimePrivilege	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeProfSingleProcessPrivilege	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeIncBasePriorityPrivilege	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeCreatePagefilePrivilege	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeBackupPrivilege	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeRestorePrivilege	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeShutdownPrivilege	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeDebugPrivilege	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeSystemEnvironmentPrivilege	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeChangeNotifyPrivilege	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeRemoteShutdownPrivilege	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeUndockPrivilege	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeManageVolumePrivilege	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeImpersonatePrivilege	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeCreateGlobalPrivilege	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: 33	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: 34	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: 35	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: 36	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeIncreaseQuotaPrivilege	4352	DAVUTHITTER V2.987.EXE
Token: SeSecurityPrivilege	4352	DAVUTHITTER V2.987.EXE
Token: SeTakeOwnershipPrivilege	4352	DAVUTHITTER V2.987.EXE
Token: SeLoadDriverPrivilege	4352	DAVUTHITTER V2.987.EXE
Token: SeSystemProfilePrivilege	4352	DAVUTHITTER V2.987.EXE
Token: SeSystemtimePrivilege	4352	DAVUTHITTER V2.987.EXE
Token: SeProfSingleProcessPrivilege	4352	DAVUTHITTER V2.987.EXE
Token: SeIncBasePriorityPrivilege	4352	DAVUTHITTER V2.987.EXE
Token: SeCreatePagefilePrivilege	4352	DAVUTHITTER V2.987.EXE
Token: SeBackupPrivilege	4352	DAVUTHITTER V2.987.EXE
Token: SeRestorePrivilege	4352	DAVUTHITTER V2.987.EXE
Token: SeShutdownPrivilege	4352	DAVUTHITTER V2.987.EXE
Token: SeDebugPrivilege	4352	DAVUTHITTER V2.987.EXE
Token: SeSystemEnvironmentPrivilege	4352	DAVUTHITTER V2.987.EXE
Token: SeChangeNotifyPrivilege	4352	DAVUTHITTER V2.987.EXE
Token: SeRemoteShutdownPrivilege	4352	DAVUTHITTER V2.987.EXE
Token: SeUndockPrivilege	4352	DAVUTHITTER V2.987.EXE
Token: SeManageVolumePrivilege	4352	DAVUTHITTER V2.987.EXE
Token: SeImpersonatePrivilege	4352	DAVUTHITTER V2.987.EXE
Token: SeCreateGlobalPrivilege	4352	DAVUTHITTER V2.987.EXE
Token: 33	4352	DAVUTHITTER V2.987.EXE
Token: 34	4352	DAVUTHITTER V2.987.EXE
Token: 35	4352	DAVUTHITTER V2.987.EXE
Token: 36	4352	DAVUTHITTER V2.987.EXE
Token: SeIncreaseQuotaPrivilege	3852	msdcsc.exe
Token: SeSecurityPrivilege	3852	msdcsc.exe
Token: SeTakeOwnershipPrivilege	3852	msdcsc.exe
Token: SeLoadDriverPrivilege	3852	msdcsc.exe
Token: SeSystemProfilePrivilege	3852	msdcsc.exe
Token: SeSystemtimePrivilege	3852	msdcsc.exe
Token: SeProfSingleProcessPrivilege	3852	msdcsc.exe
Token: SeIncBasePriorityPrivilege	3852	msdcsc.exe
Token: SeCreatePagefilePrivilege	3852	msdcsc.exe
Token: SeBackupPrivilege	3852	msdcsc.exe
Token: SeRestorePrivilege	3852	msdcsc.exe
Token: SeShutdownPrivilege	3852	msdcsc.exe
Token: SeDebugPrivilege	3852	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	3852	msdcsc.exe
Token: SeChangeNotifyPrivilege	3852	msdcsc.exe
Token: SeRemoteShutdownPrivilege	3852	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

3852 msdcsc.exe

pid	process
3852	msdcsc.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.execmd.execmd.exemsdcsc.exe

description	pid	process	target process
PID 512 wrote to memory of 3872	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	cmd.exe
PID 512 wrote to memory of 3872	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	cmd.exe
PID 512 wrote to memory of 3872	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	cmd.exe
PID 512 wrote to memory of 1176	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	cmd.exe
PID 512 wrote to memory of 1176	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	cmd.exe
PID 512 wrote to memory of 1176	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	cmd.exe
PID 512 wrote to memory of 4352	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	DAVUTHITTER V2.987.EXE
PID 512 wrote to memory of 4352	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	DAVUTHITTER V2.987.EXE
PID 512 wrote to memory of 4352	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	DAVUTHITTER V2.987.EXE
PID 1176 wrote to memory of 4124	1176	cmd.exe	attrib.exe
PID 1176 wrote to memory of 4124	1176	cmd.exe	attrib.exe
PID 1176 wrote to memory of 4124	1176	cmd.exe	attrib.exe
PID 3872 wrote to memory of 3944	3872	cmd.exe	attrib.exe
PID 3872 wrote to memory of 3944	3872	cmd.exe	attrib.exe
PID 3872 wrote to memory of 3944	3872	cmd.exe	attrib.exe
PID 512 wrote to memory of 3852	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	msdcsc.exe
PID 512 wrote to memory of 3852	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	msdcsc.exe
PID 512 wrote to memory of 3852	512	Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	msdcsc.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe
PID 3852 wrote to memory of 2540	3852	msdcsc.exe	notepad.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

Processes:

msdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	msdcsc.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

3944 attrib.exe
4124 attrib.exe

pid	process
3944	attrib.exe
4124	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
"C:\Users\Admin\AppData\Local\Temp\Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:512

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:3872

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\Easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe" +s +h
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3944

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4124

C:\Users\Admin\AppData\Local\Temp\DAVUTHITTER V2.987.EXE
"C:\Users\Admin\AppData\Local\Temp\DAVUTHITTER V2.987.EXE"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4352

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3852

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:2540

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

7

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery