darkcomet | 14d44c2ac475e13bbe43de5ac7e1bd3ffb45c4d7886d4429949ab57e7eefaa98

Processes:

e1f41131a5909b59e2126a98b5a15139.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	e1f41131a5909b59e2126a98b5a15139.exe

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

Windows Service

T1543.003

Processes:

msdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	msdcsc.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

msdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	msdcsc.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e1f41131a5909b59e2126a98b5a15139.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	e1f41131a5909b59e2126a98b5a15139.exe

Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

1436 notepad.exe
Executes dropped EXE 1 IoCs

Processes:

msdcsc.exe

pid process

4664 msdcsc.exe
Loads dropped DLL 2 IoCs

Processes:

MsiExec.exe

pid process

568 MsiExec.exe
568 MsiExec.exe

pid	process
1436	notepad.exe

pid	process
4664	msdcsc.exe

pid	process
568	MsiExec.exe
568	MsiExec.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2084-0-0x0000000000400000-0x00000000005DD000-memory.dmp	upx
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe	upx
behavioral2/memory/2084-80-0x0000000000400000-0x00000000005DD000-memory.dmp	upx
behavioral2/memory/4664-82-0x0000000000400000-0x00000000005DD000-memory.dmp	upx
behavioral2/memory/4664-83-0x0000000000400000-0x00000000005DD000-memory.dmp	upx
behavioral2/memory/4664-84-0x0000000000400000-0x00000000005DD000-memory.dmp	upx
behavioral2/memory/4664-85-0x0000000000400000-0x00000000005DD000-memory.dmp	upx
behavioral2/memory/4664-86-0x0000000000400000-0x00000000005DD000-memory.dmp	upx
behavioral2/memory/4664-87-0x0000000000400000-0x00000000005DD000-memory.dmp	upx
behavioral2/memory/4664-89-0x0000000000400000-0x00000000005DD000-memory.dmp	upx
behavioral2/memory/4664-90-0x0000000000400000-0x00000000005DD000-memory.dmp	upx
behavioral2/memory/4664-91-0x0000000000400000-0x00000000005DD000-memory.dmp	upx
behavioral2/memory/4664-92-0x0000000000400000-0x00000000005DD000-memory.dmp	upx
behavioral2/memory/4664-93-0x0000000000400000-0x00000000005DD000-memory.dmp	upx
behavioral2/memory/4664-94-0x0000000000400000-0x00000000005DD000-memory.dmp	upx
behavioral2/memory/4664-95-0x0000000000400000-0x00000000005DD000-memory.dmp	upx
behavioral2/memory/4664-96-0x0000000000400000-0x00000000005DD000-memory.dmp	upx
behavioral2/memory/4664-97-0x0000000000400000-0x00000000005DD000-memory.dmp	upx

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

e1f41131a5909b59e2126a98b5a15139.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	e1f41131a5909b59e2126a98b5a15139.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

e1f41131a5909b59e2126a98b5a15139.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings	e1f41131a5909b59e2126a98b5a15139.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	e1f41131a5909b59e2126a98b5a15139.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msdcsc.exe

pid process

4664 msdcsc.exe

pid	process
4664	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e1f41131a5909b59e2126a98b5a15139.exemsiexec.exemsiexec.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: SeSecurityPrivilege	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: SeTakeOwnershipPrivilege	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: SeLoadDriverPrivilege	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: SeSystemProfilePrivilege	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: SeSystemtimePrivilege	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: SeProfSingleProcessPrivilege	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: SeIncBasePriorityPrivilege	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: SeCreatePagefilePrivilege	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: SeBackupPrivilege	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: SeRestorePrivilege	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: SeShutdownPrivilege	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: SeDebugPrivilege	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: SeSystemEnvironmentPrivilege	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: SeChangeNotifyPrivilege	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: SeRemoteShutdownPrivilege	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: SeUndockPrivilege	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: SeManageVolumePrivilege	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: SeImpersonatePrivilege	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: SeCreateGlobalPrivilege	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: 33	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: 34	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: 35	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: 36	2084	e1f41131a5909b59e2126a98b5a15139.exe
Token: SeShutdownPrivilege	2364	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2364	msiexec.exe
Token: SeSecurityPrivilege	2268	msiexec.exe
Token: SeCreateTokenPrivilege	2364	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2364	msiexec.exe
Token: SeLockMemoryPrivilege	2364	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2364	msiexec.exe
Token: SeMachineAccountPrivilege	2364	msiexec.exe
Token: SeTcbPrivilege	2364	msiexec.exe
Token: SeSecurityPrivilege	2364	msiexec.exe
Token: SeTakeOwnershipPrivilege	2364	msiexec.exe
Token: SeLoadDriverPrivilege	2364	msiexec.exe
Token: SeSystemProfilePrivilege	2364	msiexec.exe
Token: SeSystemtimePrivilege	2364	msiexec.exe
Token: SeProfSingleProcessPrivilege	2364	msiexec.exe
Token: SeIncBasePriorityPrivilege	2364	msiexec.exe
Token: SeCreatePagefilePrivilege	2364	msiexec.exe
Token: SeCreatePermanentPrivilege	2364	msiexec.exe
Token: SeBackupPrivilege	2364	msiexec.exe
Token: SeRestorePrivilege	2364	msiexec.exe
Token: SeShutdownPrivilege	2364	msiexec.exe
Token: SeDebugPrivilege	2364	msiexec.exe
Token: SeAuditPrivilege	2364	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2364	msiexec.exe
Token: SeChangeNotifyPrivilege	2364	msiexec.exe
Token: SeRemoteShutdownPrivilege	2364	msiexec.exe
Token: SeUndockPrivilege	2364	msiexec.exe
Token: SeSyncAgentPrivilege	2364	msiexec.exe
Token: SeEnableDelegationPrivilege	2364	msiexec.exe
Token: SeManageVolumePrivilege	2364	msiexec.exe
Token: SeImpersonatePrivilege	2364	msiexec.exe
Token: SeCreateGlobalPrivilege	2364	msiexec.exe
Token: SeCreateTokenPrivilege	2364	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2364	msiexec.exe
Token: SeLockMemoryPrivilege	2364	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2364	msiexec.exe
Token: SeMachineAccountPrivilege	2364	msiexec.exe
Token: SeTcbPrivilege	2364	msiexec.exe
Token: SeSecurityPrivilege	2364	msiexec.exe
Token: SeTakeOwnershipPrivilege	2364	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

2364 msiexec.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

4664 msdcsc.exe

pid	process
2364	msiexec.exe

pid	process
4664	msdcsc.exe

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

e1f41131a5909b59e2126a98b5a15139.exemsiexec.exemsdcsc.exe

description	pid	process	target process
PID 2084 wrote to memory of 2364	2084	e1f41131a5909b59e2126a98b5a15139.exe	msiexec.exe
PID 2084 wrote to memory of 2364	2084	e1f41131a5909b59e2126a98b5a15139.exe	msiexec.exe
PID 2084 wrote to memory of 2364	2084	e1f41131a5909b59e2126a98b5a15139.exe	msiexec.exe
PID 2084 wrote to memory of 1436	2084	e1f41131a5909b59e2126a98b5a15139.exe	notepad.exe
PID 2084 wrote to memory of 1436	2084	e1f41131a5909b59e2126a98b5a15139.exe	notepad.exe
PID 2084 wrote to memory of 1436	2084	e1f41131a5909b59e2126a98b5a15139.exe	notepad.exe
PID 2084 wrote to memory of 1436	2084	e1f41131a5909b59e2126a98b5a15139.exe	notepad.exe
PID 2084 wrote to memory of 1436	2084	e1f41131a5909b59e2126a98b5a15139.exe	notepad.exe
PID 2084 wrote to memory of 1436	2084	e1f41131a5909b59e2126a98b5a15139.exe	notepad.exe
PID 2084 wrote to memory of 1436	2084	e1f41131a5909b59e2126a98b5a15139.exe	notepad.exe
PID 2084 wrote to memory of 1436	2084	e1f41131a5909b59e2126a98b5a15139.exe	notepad.exe
PID 2084 wrote to memory of 1436	2084	e1f41131a5909b59e2126a98b5a15139.exe	notepad.exe
PID 2084 wrote to memory of 1436	2084	e1f41131a5909b59e2126a98b5a15139.exe	notepad.exe
PID 2084 wrote to memory of 1436	2084	e1f41131a5909b59e2126a98b5a15139.exe	notepad.exe
PID 2084 wrote to memory of 1436	2084	e1f41131a5909b59e2126a98b5a15139.exe	notepad.exe
PID 2084 wrote to memory of 1436	2084	e1f41131a5909b59e2126a98b5a15139.exe	notepad.exe
PID 2084 wrote to memory of 1436	2084	e1f41131a5909b59e2126a98b5a15139.exe	notepad.exe
PID 2084 wrote to memory of 1436	2084	e1f41131a5909b59e2126a98b5a15139.exe	notepad.exe
PID 2084 wrote to memory of 1436	2084	e1f41131a5909b59e2126a98b5a15139.exe	notepad.exe
PID 2084 wrote to memory of 1436	2084	e1f41131a5909b59e2126a98b5a15139.exe	notepad.exe
PID 2268 wrote to memory of 568	2268	msiexec.exe	MsiExec.exe
PID 2268 wrote to memory of 568	2268	msiexec.exe	MsiExec.exe
PID 2268 wrote to memory of 568	2268	msiexec.exe	MsiExec.exe
PID 2084 wrote to memory of 4664	2084	e1f41131a5909b59e2126a98b5a15139.exe	msdcsc.exe
PID 2084 wrote to memory of 4664	2084	e1f41131a5909b59e2126a98b5a15139.exe	msdcsc.exe
PID 2084 wrote to memory of 4664	2084	e1f41131a5909b59e2126a98b5a15139.exe	msdcsc.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe
PID 4664 wrote to memory of 1084	4664	msdcsc.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\e1f41131a5909b59e2126a98b5a15139.exe
"C:\Users\Admin\AppData\Local\Temp\e1f41131a5909b59e2126a98b5a15139.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\POOL5.0 SETUP.MSI"
2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2364

C:\Windows\SysWOW64\notepad.exe
notepad
2⤵
- Deletes itself
PID:1436

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
2⤵
- Modifies firewall policy service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4664

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:1084

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 6A13D1E41B3EA56BEDCDBDE8D18373C8 C
2⤵
- Loads dropped DLL
PID:568

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

5

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

3

T1082

Peripheral Device Discovery