darkcomet | 8ddf1a52cec3cb0b6973150d85d1672d5c443e10fa395edb9258fd0fa6bd9838

System Information Discovery

Processes:

fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exeexplorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	explorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe"	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exefc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exeexplorer.exe

description	pid	process	target process
PID 2272 set thread context of 2196	2272	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
PID 2196 set thread context of 2756	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe	explorer.exe
PID 2756 set thread context of 2696	2756	explorer.exe	explorer.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	explorer.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exeexplorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	explorer.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exeexplorer.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: SeSecurityPrivilege	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: SeBackupPrivilege	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: SeRestorePrivilege	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: SeShutdownPrivilege	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: SeDebugPrivilege	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: SeUndockPrivilege	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: 33	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: 34	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: 35	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2696	explorer.exe
Token: SeSecurityPrivilege	2696	explorer.exe
Token: SeTakeOwnershipPrivilege	2696	explorer.exe
Token: SeLoadDriverPrivilege	2696	explorer.exe
Token: SeSystemProfilePrivilege	2696	explorer.exe
Token: SeSystemtimePrivilege	2696	explorer.exe
Token: SeProfSingleProcessPrivilege	2696	explorer.exe
Token: SeIncBasePriorityPrivilege	2696	explorer.exe
Token: SeCreatePagefilePrivilege	2696	explorer.exe
Token: SeBackupPrivilege	2696	explorer.exe
Token: SeRestorePrivilege	2696	explorer.exe
Token: SeShutdownPrivilege	2696	explorer.exe
Token: SeDebugPrivilege	2696	explorer.exe
Token: SeSystemEnvironmentPrivilege	2696	explorer.exe
Token: SeChangeNotifyPrivilege	2696	explorer.exe
Token: SeRemoteShutdownPrivilege	2696	explorer.exe
Token: SeUndockPrivilege	2696	explorer.exe
Token: SeManageVolumePrivilege	2696	explorer.exe
Token: SeImpersonatePrivilege	2696	explorer.exe
Token: SeCreateGlobalPrivilege	2696	explorer.exe
Token: 33	2696	explorer.exe
Token: 34	2696	explorer.exe
Token: 35	2696	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exeexplorer.exe

pid process

2272 fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
2756 explorer.exe

pid	process
2272	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
2756	explorer.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exefc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exeexplorer.exe

description	pid	process	target process
PID 2272 wrote to memory of 2196	2272	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
PID 2272 wrote to memory of 2196	2272	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
PID 2272 wrote to memory of 2196	2272	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
PID 2272 wrote to memory of 2196	2272	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
PID 2272 wrote to memory of 2196	2272	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
PID 2272 wrote to memory of 2196	2272	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
PID 2272 wrote to memory of 2196	2272	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
PID 2272 wrote to memory of 2196	2272	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
PID 2272 wrote to memory of 2196	2272	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
PID 2272 wrote to memory of 2196	2272	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
PID 2272 wrote to memory of 2196	2272	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
PID 2272 wrote to memory of 2196	2272	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
PID 2272 wrote to memory of 2196	2272	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
PID 2196 wrote to memory of 2756	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe	explorer.exe
PID 2196 wrote to memory of 2756	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe	explorer.exe
PID 2196 wrote to memory of 2756	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe	explorer.exe
PID 2196 wrote to memory of 2756	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe	explorer.exe
PID 2196 wrote to memory of 2756	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe	explorer.exe
PID 2196 wrote to memory of 2756	2196	fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe	explorer.exe
PID 2756 wrote to memory of 2696	2756	explorer.exe	explorer.exe
PID 2756 wrote to memory of 2696	2756	explorer.exe	explorer.exe
PID 2756 wrote to memory of 2696	2756	explorer.exe	explorer.exe
PID 2756 wrote to memory of 2696	2756	explorer.exe	explorer.exe
PID 2756 wrote to memory of 2696	2756	explorer.exe	explorer.exe
PID 2756 wrote to memory of 2696	2756	explorer.exe	explorer.exe
PID 2756 wrote to memory of 2696	2756	explorer.exe	explorer.exe
PID 2756 wrote to memory of 2696	2756	explorer.exe	explorer.exe
PID 2756 wrote to memory of 2696	2756	explorer.exe	explorer.exe
PID 2756 wrote to memory of 2696	2756	explorer.exe	explorer.exe
PID 2756 wrote to memory of 2696	2756	explorer.exe	explorer.exe
PID 2756 wrote to memory of 2696	2756	explorer.exe	explorer.exe
PID 2756 wrote to memory of 2696	2756	explorer.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272

C:\Users\Admin\AppData\Local\Temp\fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\fc3c1f2a8c9f207ef70331cf74f44c1f_JaffaCakes118.exe
2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2696

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

3

System Information Discovery

3