darkcomet | 998d98fbca6ae5d844debade10eeb73f58dbbf9f0f47eeffa0c05fcaa0dffb55

Processes:

CRACKED.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\IDMAN.exe"	CRACKED.EXE

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

Windows Service

T1543.003

Processes:

IDMAN.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	IDMAN.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	IDMAN.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	IDMAN.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

NanoCore.exeCRACKED.EXE

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	NanoCore.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	CRACKED.EXE

Executes dropped EXE 3 IoCs

Processes:

CRACKED.EXENANOCORE.EXEIDMAN.exe

pid process

5548 CRACKED.EXE
700 NANOCORE.EXE
2224 IDMAN.exe

pid	process
5548	CRACKED.EXE
700	NANOCORE.EXE
2224	IDMAN.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

IDMAN.exeCRACKED.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMAN = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\IDMAN.exe"	IDMAN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMAN = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\IDMAN.exe"	CRACKED.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

dw20.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

dw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

IDMAN.exe

pid process

2224 IDMAN.exe

pid	process
2224	IDMAN.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

Processes:

CRACKED.EXEIDMAN.exedw20.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	5548	CRACKED.EXE
Token: SeSecurityPrivilege	5548	CRACKED.EXE
Token: SeTakeOwnershipPrivilege	5548	CRACKED.EXE
Token: SeLoadDriverPrivilege	5548	CRACKED.EXE
Token: SeSystemProfilePrivilege	5548	CRACKED.EXE
Token: SeSystemtimePrivilege	5548	CRACKED.EXE
Token: SeProfSingleProcessPrivilege	5548	CRACKED.EXE
Token: SeIncBasePriorityPrivilege	5548	CRACKED.EXE
Token: SeCreatePagefilePrivilege	5548	CRACKED.EXE
Token: SeBackupPrivilege	5548	CRACKED.EXE
Token: SeRestorePrivilege	5548	CRACKED.EXE
Token: SeShutdownPrivilege	5548	CRACKED.EXE
Token: SeDebugPrivilege	5548	CRACKED.EXE
Token: SeSystemEnvironmentPrivilege	5548	CRACKED.EXE
Token: SeChangeNotifyPrivilege	5548	CRACKED.EXE
Token: SeRemoteShutdownPrivilege	5548	CRACKED.EXE
Token: SeUndockPrivilege	5548	CRACKED.EXE
Token: SeManageVolumePrivilege	5548	CRACKED.EXE
Token: SeImpersonatePrivilege	5548	CRACKED.EXE
Token: SeCreateGlobalPrivilege	5548	CRACKED.EXE
Token: 33	5548	CRACKED.EXE
Token: 34	5548	CRACKED.EXE
Token: 35	5548	CRACKED.EXE
Token: 36	5548	CRACKED.EXE
Token: SeIncreaseQuotaPrivilege	2224	IDMAN.exe
Token: SeSecurityPrivilege	2224	IDMAN.exe
Token: SeTakeOwnershipPrivilege	2224	IDMAN.exe
Token: SeLoadDriverPrivilege	2224	IDMAN.exe
Token: SeSystemProfilePrivilege	2224	IDMAN.exe
Token: SeSystemtimePrivilege	2224	IDMAN.exe
Token: SeProfSingleProcessPrivilege	2224	IDMAN.exe
Token: SeIncBasePriorityPrivilege	2224	IDMAN.exe
Token: SeCreatePagefilePrivilege	2224	IDMAN.exe
Token: SeBackupPrivilege	2224	IDMAN.exe
Token: SeRestorePrivilege	2224	IDMAN.exe
Token: SeShutdownPrivilege	2224	IDMAN.exe
Token: SeDebugPrivilege	2224	IDMAN.exe
Token: SeSystemEnvironmentPrivilege	2224	IDMAN.exe
Token: SeChangeNotifyPrivilege	2224	IDMAN.exe
Token: SeRemoteShutdownPrivilege	2224	IDMAN.exe
Token: SeUndockPrivilege	2224	IDMAN.exe
Token: SeManageVolumePrivilege	2224	IDMAN.exe
Token: SeImpersonatePrivilege	2224	IDMAN.exe
Token: SeCreateGlobalPrivilege	2224	IDMAN.exe
Token: 33	2224	IDMAN.exe
Token: 34	2224	IDMAN.exe
Token: 35	2224	IDMAN.exe
Token: 36	2224	IDMAN.exe
Token: SeBackupPrivilege	712	dw20.exe
Token: SeBackupPrivilege	712	dw20.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

IDMAN.exe

pid process

2224 IDMAN.exe

pid	process
2224	IDMAN.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

NanoCore.exeCRACKED.EXEIDMAN.exeNANOCORE.EXE

description	pid	process	target process
PID 4620 wrote to memory of 5548	4620	NanoCore.exe	CRACKED.EXE
PID 4620 wrote to memory of 5548	4620	NanoCore.exe	CRACKED.EXE
PID 4620 wrote to memory of 5548	4620	NanoCore.exe	CRACKED.EXE
PID 4620 wrote to memory of 700	4620	NanoCore.exe	NANOCORE.EXE
PID 4620 wrote to memory of 700	4620	NanoCore.exe	NANOCORE.EXE
PID 5548 wrote to memory of 2224	5548	CRACKED.EXE	IDMAN.exe
PID 5548 wrote to memory of 2224	5548	CRACKED.EXE	IDMAN.exe
PID 5548 wrote to memory of 2224	5548	CRACKED.EXE	IDMAN.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 2224 wrote to memory of 5352	2224	IDMAN.exe	notepad.exe
PID 700 wrote to memory of 712	700	NANOCORE.EXE	dw20.exe
PID 700 wrote to memory of 712	700	NANOCORE.EXE	dw20.exe

C:\Users\Admin\AppData\Local\Temp\NanoCore\NanoCore.exe
"C:\Users\Admin\AppData\Local\Temp\NanoCore\NanoCore.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4620

C:\Users\Admin\AppData\Roaming\CRACKED.EXE
"C:\Users\Admin\AppData\Roaming\CRACKED.EXE"
2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5548

C:\Users\Admin\AppData\Roaming\MSDCSC\IDMAN.exe
"C:\Users\Admin\AppData\Roaming\MSDCSC\IDMAN.exe"
3⤵
- Modifies firewall policy service
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\SysWOW64\notepad.exe
notepad
4⤵
PID:5352

C:\Users\Admin\AppData\Roaming\NANOCORE.EXE
"C:\Users\Admin\AppData\Roaming\NANOCORE.EXE"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 1256
3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3992 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

3

Credential Access

Discovery

Query Registry

3

System Information Discovery

4