darkcomet | 748a3f4500b4184fff913426710b7469bd0879847e101281474e65d0b9b951c6

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	syshost.exe

Executes dropped EXE 1 IoCs

pid	Process
3032	syshost.exe

Loads dropped DLL 2 IoCs

pid	Process
2852	eb2b67ed7492c18927170a54fc5146cd_JaffaCakes118.exe
2852	eb2b67ed7492c18927170a54fc5146cd_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2852 set thread context of 3032	2852	eb2b67ed7492c18927170a54fc5146cd_JaffaCakes118.exe	28
PID 3032 set thread context of 2476	3032	syshost.exe	29

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	syshost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	syshost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	syshost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	syshost.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	syshost.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3032	syshost.exe
Token: SeSecurityPrivilege	3032	syshost.exe
Token: SeTakeOwnershipPrivilege	3032	syshost.exe
Token: SeLoadDriverPrivilege	3032	syshost.exe
Token: SeSystemProfilePrivilege	3032	syshost.exe
Token: SeSystemtimePrivilege	3032	syshost.exe
Token: SeProfSingleProcessPrivilege	3032	syshost.exe
Token: SeIncBasePriorityPrivilege	3032	syshost.exe
Token: SeCreatePagefilePrivilege	3032	syshost.exe
Token: SeBackupPrivilege	3032	syshost.exe
Token: SeRestorePrivilege	3032	syshost.exe
Token: SeShutdownPrivilege	3032	syshost.exe
Token: SeDebugPrivilege	3032	syshost.exe
Token: SeSystemEnvironmentPrivilege	3032	syshost.exe
Token: SeChangeNotifyPrivilege	3032	syshost.exe
Token: SeRemoteShutdownPrivilege	3032	syshost.exe
Token: SeUndockPrivilege	3032	syshost.exe
Token: SeManageVolumePrivilege	3032	syshost.exe
Token: SeImpersonatePrivilege	3032	syshost.exe
Token: SeCreateGlobalPrivilege	3032	syshost.exe
Token: 33	3032	syshost.exe
Token: 34	3032	syshost.exe
Token: 35	3032	syshost.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 3032	2852	eb2b67ed7492c18927170a54fc5146cd_JaffaCakes118.exe	28
PID 2852 wrote to memory of 3032	2852	eb2b67ed7492c18927170a54fc5146cd_JaffaCakes118.exe	28
PID 2852 wrote to memory of 3032	2852	eb2b67ed7492c18927170a54fc5146cd_JaffaCakes118.exe	28
PID 2852 wrote to memory of 3032	2852	eb2b67ed7492c18927170a54fc5146cd_JaffaCakes118.exe	28
PID 2852 wrote to memory of 3032	2852	eb2b67ed7492c18927170a54fc5146cd_JaffaCakes118.exe	28
PID 2852 wrote to memory of 3032	2852	eb2b67ed7492c18927170a54fc5146cd_JaffaCakes118.exe	28
PID 2852 wrote to memory of 3032	2852	eb2b67ed7492c18927170a54fc5146cd_JaffaCakes118.exe	28
PID 2852 wrote to memory of 3032	2852	eb2b67ed7492c18927170a54fc5146cd_JaffaCakes118.exe	28
PID 2852 wrote to memory of 3032	2852	eb2b67ed7492c18927170a54fc5146cd_JaffaCakes118.exe	28
PID 2852 wrote to memory of 3032	2852	eb2b67ed7492c18927170a54fc5146cd_JaffaCakes118.exe	28
PID 2852 wrote to memory of 3032	2852	eb2b67ed7492c18927170a54fc5146cd_JaffaCakes118.exe	28
PID 2852 wrote to memory of 3032	2852	eb2b67ed7492c18927170a54fc5146cd_JaffaCakes118.exe	28
PID 2852 wrote to memory of 3032	2852	eb2b67ed7492c18927170a54fc5146cd_JaffaCakes118.exe	28
PID 3032 wrote to memory of 2476	3032	syshost.exe	29
PID 3032 wrote to memory of 2476	3032	syshost.exe	29
PID 3032 wrote to memory of 2476	3032	syshost.exe	29
PID 3032 wrote to memory of 2476	3032	syshost.exe	29
PID 3032 wrote to memory of 2476	3032	syshost.exe	29
PID 3032 wrote to memory of 2476	3032	syshost.exe	29

C:\Users\Admin\AppData\Local\Temp\eb2b67ed7492c18927170a54fc5146cd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb2b67ed7492c18927170a54fc5146cd_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2852
- C:\ProgramData\syshost.exe
  C:\ProgramData\syshost.exe
  2⤵
  - Modifies firewall policy service
  - Disables RegEdit via registry modification
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

3

System Information Discovery

3