darkcomet | 0f8453795d064dcfed957738605d6535e6d7aed3903663f2a39c24190aeb55f0

Processes:

1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.exe"	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

Windows Service

T1543.003

Processes:

msdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	msdcsc.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

msdcsc.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	msdcsc.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Executes dropped EXE 1 IoCs

Processes:

msdcsc.exe

pid process

2604 msdcsc.exe
Loads dropped DLL 2 IoCs

Processes:

1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe

pid process

2172 1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
2172 1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe

pid	process
2604	msdcsc.exe

pid	process
2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.exe"	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: SeSecurityPrivilege	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: SeBackupPrivilege	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: SeRestorePrivilege	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: SeShutdownPrivilege	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: SeDebugPrivilege	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: SeUndockPrivilege	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: 33	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: 34	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: 35	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2604	msdcsc.exe
Token: SeSecurityPrivilege	2604	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2604	msdcsc.exe
Token: SeLoadDriverPrivilege	2604	msdcsc.exe
Token: SeSystemProfilePrivilege	2604	msdcsc.exe
Token: SeSystemtimePrivilege	2604	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2604	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2604	msdcsc.exe
Token: SeCreatePagefilePrivilege	2604	msdcsc.exe
Token: SeBackupPrivilege	2604	msdcsc.exe
Token: SeRestorePrivilege	2604	msdcsc.exe
Token: SeShutdownPrivilege	2604	msdcsc.exe
Token: SeDebugPrivilege	2604	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2604	msdcsc.exe
Token: SeChangeNotifyPrivilege	2604	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2604	msdcsc.exe
Token: SeUndockPrivilege	2604	msdcsc.exe
Token: SeManageVolumePrivilege	2604	msdcsc.exe
Token: SeImpersonatePrivilege	2604	msdcsc.exe
Token: SeCreateGlobalPrivilege	2604	msdcsc.exe
Token: 33	2604	msdcsc.exe
Token: 34	2604	msdcsc.exe
Token: 35	2604	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

2604 msdcsc.exe

pid	process
2604	msdcsc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe

description	pid	process	target process
PID 2172 wrote to memory of 2604	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe	msdcsc.exe
PID 2172 wrote to memory of 2604	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe	msdcsc.exe
PID 2172 wrote to memory of 2604	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe	msdcsc.exe
PID 2172 wrote to memory of 2604	2172	1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe	msdcsc.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

Processes:

msdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	msdcsc.exe

C:\Users\Admin\AppData\Local\Temp\1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1502da8208dab511b9a20b8bd5ca0683_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172

C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe
"C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe"
2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2604

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

7

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

System Information Discovery